Reply to thread

Message

Here, replace it by this: http://pastie.org/private/zgpebrk4xuc1t3kxlyx6sw ; Now go to your class.core.php:

replace this:
[PHP] final public function handleCall($k)
{
global $users, $template, $_CONFIG;

if($_CONFIG['hotel']['in_maint'] == false)
{
if(!isset($_SESSION['user']['id']))
{
switch($k)
{
case "index":
case null:
case "login":
$users->login();
break;

case "register":
$users->register();
break;

case "forgot":
$users->forgotten();
break;

case "maintenance":
case "ToS":
//
break;

case "me":
case "account":
case "news":
header('Location: '.$_CONFIG['hotel']['url'].'/index');
exit;
break;

default:
//Nothing
break;
}
}
else
{
if($_SESSION['user']['ip_last'] != $_SERVER['REMOTE_ADDR'])
{
header('Location: '.$_CONFIG['hotel']['url'].'/logout');
}

switch($k)
{
case "index":
case null:
header('Location: '.$_CONFIG['hotel']['url'].'/me');
exit;
break;

case "register":
header('Location: '.$_CONFIG['hotel']['url'].'/me');
exit;
break;

case "forgot":
header('Location: '.$_CONFIG['hotel']['url'].'/me');
exit;
break;

case "client":
$users->createSSO($_SESSION['user']['id']);
$users->updateUser($_SESSION['user']['id'], 'ip_last', $_SERVER['REMOTE_ADDR']);
$template->setParams('sso', $users->getInfo($_SESSION['user']['id'], 'auth_ticket'));
break;

case "help":
$users->help();
break;

case "account":
$users->updateAccount();
break;

default:
//nothing
break;
}
}
}
elseif($_GET['url'] != 'maintenance')
{
header('Location: '.$_CONFIG['hotel']['url'].'/maintenance');
exit;
}
}[/PHP]

by this:

[PHP] final public function handleCall($k)
{
global $users, $template, $_CONFIG;

if($_CONFIG['hotel']['in_maint'] == false)
{
if(!isset($_SESSION['user']['id']))
{
switch($k)
{
case "index":
case null:
case "login":
$users->login();
break;

case "register":
$users->register();
break;

case "maintenance":
//
break;

case "me":
case "account":
case "news":
header('Location: '.$_CONFIG['hotel']['url'].'/index');
exit;
break;

default:
//Nothing
break;
}
}
else
{
if($_SESSION['user']['ip_last'] != $_SERVER['REMOTE_ADDR'])
{
header('Location: '.$_CONFIG['hotel']['url'].'/logout');
}

switch($k)
{
case "index":
case null:
header('Location: '.$_CONFIG['hotel']['url'].'/me');
exit;
break;

case "register":
header('Location: '.$_CONFIG['hotel']['url'].'/me');
exit;
break;

case "client":
$users->createSSO($_SESSION['user']['id']);
$users->updateUser($_SESSION['user']['id'], 'ip_last', $_SERVER['REMOTE_ADDR']);
$template->setParams('sso', $users->getInfo($_SESSION['user']['id'], 'auth_ticket'));
break;

case "account":
$users->updateAccount();
break;

default:
//nothing
break;
}
}
}
elseif($_GET['url'] != 'maintenance')
{
header('Location: '.$_CONFIG['hotel']['url'].'/maintenance');
exit;
}
}[/PHP]

Now go on 'interface.users.php' and remove: 'public function forgotten();' & 'public function help();'. Make sure you do this, if you don't it will return a blank white page or an error.

See if the attackers can cause damage again, let me know if they do.

<blockquote data-quote="Khalil" data-source="post: 296199" data-attributes="member: 9938">Here, replace it by this: <a href="http://pastie.org/private/zgpebrk4xuc1t3kxlyx6sw" target="_blank">http://pastie.org/private/zgpebrk4xuc1t3kxlyx6sw</a> ; Now go to your class.core.php:replace this:[PHP]&nbsp; &nbsp; final public function handleCall($k)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; global $users, $template, $_CONFIG;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if($_CONFIG['hotel']['in_maint'] == false)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(!isset($_SESSION['user']['id']))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; switch($k)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;index&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case null:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;login&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;login();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;register&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;register();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;forgot&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;forgotten();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;maintenance&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;ToS&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;me&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;account&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;news&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/index');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; default:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //Nothing&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if($_SESSION['user']['ip_last'] != $_SERVER['REMOTE_ADDR'])&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/logout');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; switch($k)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;index&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case null:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/me');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;register&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/me');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;forgot&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/me');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;client&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;createSSO($_SESSION['user']['id']);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;updateUser($_SESSION['user']['id'], 'ip_last', $_SERVER['REMOTE_ADDR']);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $template-&gt;setParams('sso', $users-&gt;getInfo($_SESSION['user']['id'], 'auth_ticket'));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;help&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;help();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;account&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;updateAccount();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; default:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //nothing&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; elseif($_GET['url'] != 'maintenance')&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/maintenance');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }[/PHP]by this:[PHP]&nbsp; &nbsp; final public function handleCall($k)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; global $users, $template, $_CONFIG;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if($_CONFIG['hotel']['in_maint'] == false)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(!isset($_SESSION['user']['id']))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; switch($k)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;index&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case null:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;login&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;login();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;register&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;register();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;maintenance&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;me&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;account&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;news&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/index');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; default:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //Nothing&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if($_SESSION['user']['ip_last'] != $_SERVER['REMOTE_ADDR'])&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/logout');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; switch($k)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;index&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case null:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/me');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;register&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/me');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;client&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;createSSO($_SESSION['user']['id']);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;updateUser($_SESSION['user']['id'], 'ip_last', $_SERVER['REMOTE_ADDR']);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $template-&gt;setParams('sso', $users-&gt;getInfo($_SESSION['user']['id'], 'auth_ticket'));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; case &quot;account&quot;:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $users-&gt;updateAccount();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; default:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //nothing&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; elseif($_GET['url'] != 'maintenance')&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header('Location: '.$_CONFIG['hotel']['url'].'/maintenance');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }[/PHP]Now go on 'interface.users.php' and remove: 'public function forgotten();' &amp; 'public function help();'. Make sure you do this, if you don't it will return a blank white page or an error.See if the attackers can cause damage again, let me know if they do.</blockquote>

[QUOTE="Khalil, post: 296199, member: 9938"] Here, replace it by this: [URL]http://pastie.org/private/zgpebrk4xuc1t3kxlyx6sw[/URL] ; Now go to your class.core.php: replace this: [PHP] final public function handleCall($k) { global $users, $template, $_CONFIG; if($_CONFIG['hotel']['in_maint'] == false) { if(!isset($_SESSION['user']['id'])) { switch($k) { case "index": case null: case "login": $users->login(); break; case "register": $users->register(); break; case "forgot": $users->forgotten(); break; case "maintenance": case "ToS": // break; case "me": case "account": case "news": header('Location: '.$_CONFIG['hotel']['url'].'/index'); exit; break; default: //Nothing break; } } else { if($_SESSION['user']['ip_last'] != $_SERVER['REMOTE_ADDR']) { header('Location: '.$_CONFIG['hotel']['url'].'/logout'); } switch($k) { case "index": case null: header('Location: '.$_CONFIG['hotel']['url'].'/me'); exit; break; case "register": header('Location: '.$_CONFIG['hotel']['url'].'/me'); exit; break; case "forgot": header('Location: '.$_CONFIG['hotel']['url'].'/me'); exit; break; case "client": $users->createSSO($_SESSION['user']['id']); $users->updateUser($_SESSION['user']['id'], 'ip_last', $_SERVER['REMOTE_ADDR']); $template->setParams('sso', $users->getInfo($_SESSION['user']['id'], 'auth_ticket')); break; case "help": $users->help(); break; case "account": $users->updateAccount(); break; default: //nothing break; } } } elseif($_GET['url'] != 'maintenance') { header('Location: '.$_CONFIG['hotel']['url'].'/maintenance'); exit; } }[/PHP] by this: [PHP] final public function handleCall($k) { global $users, $template, $_CONFIG; if($_CONFIG['hotel']['in_maint'] == false) { if(!isset($_SESSION['user']['id'])) { switch($k) { case "index": case null: case "login": $users->login(); break; case "register": $users->register(); break; case "maintenance": // break; case "me": case "account": case "news": header('Location: '.$_CONFIG['hotel']['url'].'/index'); exit; break; default: //Nothing break; } } else { if($_SESSION['user']['ip_last'] != $_SERVER['REMOTE_ADDR']) { header('Location: '.$_CONFIG['hotel']['url'].'/logout'); } switch($k) { case "index": case null: header('Location: '.$_CONFIG['hotel']['url'].'/me'); exit; break; case "register": header('Location: '.$_CONFIG['hotel']['url'].'/me'); exit; break; case "client": $users->createSSO($_SESSION['user']['id']); $users->updateUser($_SESSION['user']['id'], 'ip_last', $_SERVER['REMOTE_ADDR']); $template->setParams('sso', $users->getInfo($_SESSION['user']['id'], 'auth_ticket')); break; case "account": $users->updateAccount(); break; default: //nothing break; } } } elseif($_GET['url'] != 'maintenance') { header('Location: '.$_CONFIG['hotel']['url'].'/maintenance'); exit; } }[/PHP] Now go on 'interface.users.php' and remove: 'public function forgotten();' & 'public function help();'. [B]Make sure you do this, if you don't it will return a blank white page or an error.[/B] See if the attackers can cause damage again, let me know if they do. [/QUOTE]

Reply to thread

Connect with us

Newest members