Recent Topics

1 Dec 16, 2012 03:54    

1.I think users definitely should NOT be able to change their user_login.
If they really want to change something, we always have "nickname" option.

2. Secondly and more importantly, the "user_login" should not be displayed at all, unless it's been explicitely requested so (by default setting, or user preference).If you ask me, it shouldnt even display by default, since b2 generates the same name as "nickname".
Because as far as i am concerned, this may be exploited.If i have a unique user name like "Myadminn" to avoid "admin" brute force attacks, it may well be used for other sites on my server.This is a serious issue, since afaik, we do not have a protection for those.

3.I accidentally found out that, google has indexed a strange url:
http://www.tilqi.com/users/*****makina.com/blog1.php?blog=6&disp=user
Where does that even come from ? ( *****makina.com is a domain on my server but i dont know what it has to do with my b2 or anything)

Oddly enough, it will display anything in between, if you specify an existing blog as param:
http://www.tilqi.com/blablabla/anythinghere/blog1.php?blog=6&disp=user

Is that a bug or something ?

3 Dec 16, 2012 05:52

Yup, renaming htaccess caused a 404.

But my htaccess is pretty straight-forward, i wonder what it causes it, and if there are other crazy urls like that

# Apache configuration for the blog folder
# Lines starting with # are considered as comments.

# PHP SECURITY:
# this will make register globals off in the evo directory
<IfModule mod_php4.c>
php_flag register_globals off
</IfModule>
<IfModule mod_php5.c>
php_flag register_globals off
</IfModule>

# PHP5
# This may need to be in each folder:
# AddHandler application/x-httpd-php5 .php

# CLEAN URLS:
# If you're using Apache 2, you may wish to try this if clean URLs don't work:
# AcceptPathInfo On

# DEFAULT DOCUMENT TO DISPLAY:
# this will select the default blog template to be displayed
# if the URL is just .../blogs/
<IfModule mod_dir.c>
DirectoryIndex index.php index.html
</IfModule>

# CATCH EVERYTHING INTO B2EVO:
# The following will allow you to have a blog running right off the site root,
# using index.php as a stub but not showing it in the URLs.
# This will add support for URLs like: http://example.com/2006/08/29/post-title
<IfModule mod_rewrite.c>
RewriteEngine On

# This line may be needed or not.
# enabling this would prevent running ina subdir like /blog/index.php
# This has been disabled in v 4.0.0-alpha. Please let us know if you find it needs to be enabled.
# RewriteBase /

# Redirect anything that's not an existing directory or file to index.php:
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php
</IfModule>
<IfModule mod_expires.c>
ExpiresActive On

# images
ExpiresByType image/png "access plus 6 month"
ExpiresByType image/gif "access plus 6 month"
ExpiresByType image/jpeg "access plus 6 month"
ExpiresByType image/x-icon "access 1 year"

# css and javascript
ExpiresByType text/css "access plus 2 months"
ExpiresByType application/javascript "access plus 2 months"
ExpiresByType text/javascript "access plus 2 months"
</IfModule>

RewriteCond %{HTTP_HOST} ^tilqi\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.tilqi\.com$
RewriteRule ^ozlusozler\.php$ "http\:\/\/ozlusozler\.tilqi\.com\/" [R=301,L]

@sam2kb wrote:

Oddly enough, it will display anything in between, if you specify an existing blog as param:
http://www.tilqi.com/blablabla/anythinghere/blog1.php?blog=6&amp;disp=user

Is that a bug or something ?

It looks like a standard Apache behavior, not sure though. Rename your .htaccess and see what happens.

4 Dec 16, 2012 18:43

This is how the rules should be organized. It will not fix the problem though.

# CATCH EVERYTHING INTO B2EVO:
# The following will allow you to have a blog running right off the site root,
# using index.php as a stub but not showing it in the URLs.
# This will add support for URLs like: http://example.com/2006/08/29/post-title
<IfModule mod_rewrite.c>
RewriteEngine On

# This line may be needed or not.
# enabling this would prevent running ina subdir like /blog/index.php
# This has been disabled in v 4.0.0-alpha. Please let us know if you find it needs to be enabled.
# RewriteBase /

RewriteCond %{HTTP_HOST} ^tilqi\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.tilqi\.com$
RewriteRule ^ozlusozler\.php$ "http\:\/\/ozlusozler\.tilqi\.com\/" [R=301,L]

# Redirect anything that's not an existing directory or file to index.php:
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php
</IfModule>


Form is loading...