There is a safety problem

phpVMS Legacy Support (v2/v5)
1

Hello,

Cheers

edit: PM sended to Nabeel and removed this post.

2

Hi fafakan. Welcome to the forum. Please have a look at this.

Please edit your post and get rid of that link. I would just send Nabeel a quick PM instead. Anyone browsing the forums can see that and a BUNCH of sites would be gone over night. I have already got rid of the ftp info on my files.

3

Thanks for editing that and thanks for pointing that out.

4

This would be an FSFK problem as well, anyone who has access to that URL would be able to download that config file, whether through phpvms or through the fsfk scripts

I’m hoping that VA owners made a restricted username/password for, and didn’t use their main FTP user/password.

5

Thanks for pointing that out Nabeel. I never even thought of using a restricted account to begin with. Now we all know. Lessons learned.

6

I dont use it as its too much of a security risk in my opinion.

7

Hi,

I’ve temporarily solved the problem.

How I dıd it?; I’ve changed the name of the module FSFK and the required changes done in FSFK.php, fsk_xxxxxx.tpl’s and profile_main.tpl.

thus now the links can only be known by registered users. (no standard links more).

Cheers

8

I’ve added a note in the app.config and the generated local.config noting that those should be a FTP user/pass which is used only for that and has only access to that directory

9

Hi,

Here is a another problem;

You can send PIREP’s with FS Flight Keeper (software) to the site and these PIREP’s are accepted without password and/or username.

Why is a username wıth a passward not required?

Normally you can enter userID and password in the FS Flight Keeper (Pilot Edit) but why is it not using during send the PIREP’s?

Cheers

10

Hi,

Here is a another problem;

You can send PIREP’s with FS Flight Keeper (software) to the site and these PIREP’s are accepted without password and/or username.

Why is a username wıth a passward not required?

Normally you can enter userID and password in the FS Flight Keeper (Pilot Edit) but why is it not using during send the PIREP’s?

Cheers

I elected not to do that because the usernames/passwords are transferred over plain-text. If there’s a fake PIREP sent in, an admin can reject it, but if there’s a snoop or something, then the username/password can’t be sniffed out.

Also, I believe the username and password are stored in the config - the password is encrypted, and there’s no way of getting the plain-text version back, so I can’t gen/add that in