Welcome to Geeklog, Anonymous Saturday, April 12 2025 @ 07:08 pm EDT

Geeklog Forums

Important security Questions and Pains

Post New Reply

Author:

Mood:

Code

Font Color Font Size Close Tags

Forum BBCode Help

BBCode	Effect
[b]bolded text[/b]	bolded text
[i]italicized text[/i]	italicized text
[u]underlined text[/u]	underlined text
[s]strikethrough text[/s]	strikethrough text
[img]http://www.site.com/forum/images/forum.png[/img] OR [img h=65 w=50]http://www.site.com/forum/images/forum.png[/img]
[url=https://www.geeklog.net]Geeklog[/url]	Geeklog
[quote]quoted text[/quote]	To quote: quoted text
[size=15]Your Text[/size] "12" is usually standard on message boards. Usually measured in pixels (px).	Your Text
[color=red]Red Text[/color] OR [color=#FF0000]Red Text[/color] Can use many different color names or hex codes.	Red Text
[list] []List item 1 []List item 2 [/list] OR [list=1] []List item 1 []List item 2 [/list]	List item 1 List item 2 List item 1 List item 2
[code]monospaced text[/code]	monospaced text
[code=XYX]formatted code[/code] Where XYZ can be any of the following: c css html4strict java javascript jquery perl php plain python SQL and many more...	formatted code
To enter a backslash (\) in your post, use \\\\	\

Subject

[QUOTE][u]Quote by: Anonymous[/u][p]This is not in a negative sense, but it is now getting very difficult 
almost impossible to keep up with the security issues.

The best part of GL in comparison to various other CMSes has been said to 
be its security AND almost atregular interval security flaws are being detected.
This I agree is the norm with any software but then no one has so much 
ensurances and claims on "security" !

When I went thru pains of shifting from 1.3.9 thru 1.3.11 to 1.3.11sr1 
( mind you that we use plugin and customizations and it makes the situation 
all the more difficult, at times impossible,   though developers will say its none of their concern )
I thought , well, now I can settle and manae contents rather than my cms system.
Incidentallt .11sr1 fixed already some SQL injection and I am now :angry: that 
Stefan Esser did not find it all.

Now that Bercegay finds some more I wonder what next !
Can some one please help me now IF they accept the fact that I cannot move 
beyond .11sr1 and already have many changes in various files so that I cannot
replace files.

1) What is the  REAL possibility of SQL injection causing problem ?
2) What are the things that I can avoid ? For example , I can do without SPamX
plugin and I can do withour Search. Does it reduce my chances of vulnerability ?
3) Some quick and dirty fixes eg, some htaccess or similar file to give 
protection without having to touch files ?
4) I can keep the site ONLY for registered users, no anonym inputs
5) others ... ?

[ BTW - can some one say in one or two words *how* they do these injections ?
Though not geek, may be some very simple prevention may be found ..]

It will be very much appreciated that if "geeks" here appreciate that many
very ordinary human beings use GL and they *needed* changes like skin, plugins
so they change the GL they use,and  once changed they have to manage the site
rather than the software as they are really not geeks. Saying them "you have to 
DO this and this ONLY" or "go elsewhere" is disappointing !![/p][/QUOTE]

Options:

HTML Mode

Geeklog Forums

Search

Resources

About

Getting started

Support

Development

Topics

User Functions

What's New

Articles last 4 weeks

Comments last 4 weeks

Pages last 4 weeks

Links last 4 weeks

Downloads last 4 weeks