Critical Bug in Joomla 1.5.5 (and older 1.5.x versions)

Post by: tom on August 18th, 2008 | File Under Security, Webapps
Tags:

The password of the user with the lowest ID (typically an administrator) can be reset by an unauthorized user in Joomla 1.5.x installations prior version 1.5.6 because of a bug in the password remind functionality.

All 1.5.x installations prior to and including 1.5.5 are affected

The Joomla developer team advises to upgrade to 1.5.6 (or patch the /components/com_user/models/reset.php file with the code below).

After global $mainframe; on line 113 of reset.php, add:

if(strlen($token) != 32) {
    $this->setError(JText::_('INVALID_TOKEN'));
    return false;
}


 
See: Joomla! Developer - Password Remind Functionality


Comments (No responses yet)



New Theme @ tom’s blog

Post by: tom on April 10th, 2008 | File Under Webapps

.. the Dark Side of the Force are they ..
more to say?


Comments (No responses yet)



Wordpress / enabling (built in) cache

Post by: tom on January 22nd, 2008 | File Under Memento, Webapps
Tags: ,

Edit wp-config.php and add
define('ENABLE_CACHE', true);

Create the directory cache in the folder wp-content/ (take care it’s writeable!)

If you want to take control about expiration time, you can do this including these lines in wp-config.php:
define('CACHE_EXPIRATION_TIME', 900);

That’s all : )
The next time, your blog is being visted, the pages will be cached..
B.t.w.: You can empty the cache directory every time you want (in case of trouble, etc..).

More infos:
http://www.mitternachtshacking.de/blog/356-wordpress-cache-aktiviert (de)
http://sw-guide.de/2007-07/bessere-blog-performance-dank-wordpress-internen-cache/ (de)

Update (!):
The file-based caching mechanism has been removed from the WordPress 2.5 code. Detailed infos at neosmart.net.


Comments (No responses yet)



Joomla - howto active SEF (search engine friendly URLs)

Post by: tom on April 12th, 2007 | File Under Security, Webapps
Tags: ,

If not already done, enable “Override” for Options and FileInfo in your apache configuration (needed for mod_rewrite and symlinks):

<Directory "/srv/www/htdocs/##user##/html">
AllowOverride Options FileInfo
</Directory>


Move the default htaccess.txt to .htaccess and activate SEF in your Joomla config. That’s all : )


Comments (No responses yet)



Wordpress-Release 2.1.1 vulnerable

Post by: tom on March 3rd, 2007 | File Under Security, Webapps
Tags: ,

If you’ve downloaded release 2.1.1 within the last 4 days, your version may include dangerous code. You should upgrade all your files to v.2.1.2 immediately!

According to the developers of wordpress, a server has been hacked and the download-package was replaced with a version that included some backdoors to implement php code.

Official statement / German news (at heise) / Upgrade instructions


Comments (No responses yet)



Save and convert flash streams

Post by: tom on February 11th, 2007 | File Under Multimedia, Webapps

If you want to convert a flash stream into a more comfortable format, that can be saved on your local disc and be played by most software/hardware, here’s a short guide:

Save your prefered video (from i.e. YouTube, MyVideo, etc.) with KeepVid.

When FFmpeg is installed, the conversion in Linux is quite simple:
ffmpeg -i input.flv -ab 128 -ar 44100 -b 900 \
-s 640x480 output.mpg


-b = videobitrate
-ab = audiobitrate
-ar = audiosamplerate (Hz)
-s = framesize width * height


Comments (No responses yet)



Joomla vs. Wordpress

Post by: tom on February 1st, 2007 | File Under Webapps

I get more and more requests for several special Apache settings, like: “please turn off Safe-Mode” regarding Joomla. I keep questioning myself what is the big advantage comparing Joomla to Wordpress or any other CMS. Any suggestion is appreciated!


Comments (2 responses so far)