[1.X] RevCMS - Security Key [FIX]

[Sledmore]

Hey,

Found this about 6 month ago but never bothered to make a thread as I didn't use the 'Security Key' option in RevCMS and didn't see much others but I have recently.

Have you used this before and noticed how all the hashes in the users table are the same for seckey? Well this simple fix will solve that (not previous hashes but only new ones once the fix is applied).

1) Open up 'app/class.users.php'.
2) Find the following: (Under final public function register())

$this->addUser($template->form->reg_username, $core->hashed($template->form->reg_password), $template->form->reg_email, $_CONFIG['hotel']['motto'], $_CONFIG['hotel']['credits'], $_CONFIG['hotel']['pixels'], 1, $template->form->reg_figure, $template->form->reg_gender, $core->hashed($template->form->reg_key));

3) If you have already customized this code then simply replace the following:

$core->hashed($template->form->reg_key)

With:

$core->hashed($template->form->reg_seckey)

If not you can replace the whole line with the following:

$this->addUser($template->form->reg_username, $core->hashed($template->form->reg_password), $template->form->reg_email, $_CONFIG['hotel']['motto'], $_CONFIG['hotel']['credits'], $_CONFIG['hotel']['pixels'], 1, $template->form->reg_figure, $template->form->reg_gender, $core->hashed($template->form->$core->hashed($template->form->reg_seckey)));

And then you're done, this simple error is now fixed.

 

[Xorflo]

Just wondering. What does the error do anyway?

 

[Sledmore]

Just wondering. What does the error do anyway?

It does what the first post says it does:

Have you used this before and noticed how all the hashes in the users table are the same for seckey? Well this simple fix will solve that (not previous hashes but only new ones once the fix is applied).

 

[Xorflo]

Hm. Wont cause any major stress or possible breaches I guess? xD

 

[Sledmore]

Hm. Wont cause any major stress or possible breaches I guess? xD

Well considering by default the security key entered would be blank the users wouldn't be able to reset their passwords, but no on the stress and breaches.

 

[Weasel]

As far as I'm aware the security key isn't used for that much in Rev 1.9.9.9 - anyways nice fix, as always, Craig.

 

[Sledmore]

As far as I'm aware the security key isn't used for that much in Rev 1.9.9.9 - anyways nice fix, as always, Craig.

This thread is most likely the answer to why.. And thanks.

 

[Weasel]

This thread is most likely the answer to why.. And thanks.

Standard in RevCMS it isn't. Its why I like your post, you make people aware of the use of the security key. People often don't know what to do with it, making a post which fixes it and makes them aware of it, maybe triggers other developers to actually use it.

When you post something, it atleast is usefull.

 

[Kristopher]

Thanks for this!

 

[Sledmore]

Thanks for this!

You're welcome!