I was really wondering about this last night when I was visiting a few sites to look at how things worked and all. When I got to them and clicked on the Roster link it was displaying the admin login information on the right, like all the admin blocks and things like that, enough that I knew which pages admin functions were located on. This is not a big secret with nuke but it does put temptation at the fingertips of people who might otherwise not medel. Thus, a fairly serious matter in my book (out of sight out of mind right?).

<the beef>

So, I finally figured out what the scoop is -- (and this relates to another thread on this forum about commenting out header.php and mainfile.php) -- when you allow Roster to generate your config file it "COPIES" your page layout into the config file. I like fricken just sucks it down and into it so you can't really tell the difference. "THIS IS BAD" since you have to be the admin to actually install this module in the first place, thus it sucks down your admin layout of the page and makes everyone think they're logged in as the admin and they're like wtf.

<the fix>

DO NOT COMMENT OUT YOUR header.php OR mainfile.php REFERENCES! These are there for a reason (as I suspected). Instead, open your conf.php and remove "EVERYTHING" except for the following section of code:

Code: Select all

<?php
/******************************
 * AUTO-GENERATED CONF FILE
 * DO NOT EDIT !!!
 ******************************/

$db_host   = "server";
$db_name   = "database";
$db_user   = "databaseuser";
$db_passwd = "databasepassword";
$db_prefix = "roster_";

$module_name = basename(dirname(__FILE__));
$roster_dir = "modules/" . $module_name;

define('ROSTER_INSTALLED', true);
?>


That's all folks, should work like a charm after this. Though sadly, it still does not solve the damn web-based guildprofile upload issue.... =\

Cheers!

i'm not sure what problem your talkuing about with the webbase guild profile upload it work fine for me.


and abotu the conf.php, by default it's exacly whats created when i install my roster i'm not quite sure what your refering too as the possible security issue

My original config (upon install) contained this....and I also saw it on someone else's site.... like this....I'll even see about getting a screenshot in a min or two and posting it


<SNIP>

Code: Select all

<META NAME="ROBOTS" CONTENT="INDEX, FOLLOW">
<META NAME="REVISIT-AFTER" CONTENT="1 DAYS">
<META NAME="RATING" CONTENT="GENERAL">
<META NAME="GENERATOR" CONTENT="PHP-Nuke Copyright (c) 2004 by Francisco Burzi. This is free software, and you may redistribute it under the GPL (http://phpnuke.org/files/gpl.txt). PHP-Nuke comes with absolutely no warranty, for details, see the license (http://phpnuke.org/files/gpl.txt). Powered by PHP-Nuke Platinum (http://www.techgfx.com)">
<script language="Javascript" type="text/javascript">
<!--
function img_popup(image_url, image_width, image_height, popup_rand)
{
screenwidth = false;
screenwidth = screen.Width;
if ( !screenwidth )
{
screenwidth = window.outerWidth;
}
screenheight = false;
screenheight = screen.Height;
if ( !screenheight )
{
screenheight = window.outerHeight;
}
if ( screenwidth < image_width || screenheight< image_height || image_width == null || image_height == null )
{
window.open(image_url, 'limit_image_mod_popup_img_' + popup_rand, 'resizable=yes,top=0,left=0,screenX=0,screenY=0,scrollbars=yes', false);
}
else
{
window.open(image_url, 'limit_image_mod_popup_img_' + popup_rand, 'resizable=yes,top=0,left=0,screenX=0,screenY=0,height=' + image_height + ',width=' + image_width, false);
}
}
//-->
</script>
<link rel="alternate" type="application/rss+xml" title="RSS" href="backend.php">

<style type="text/css">
.menuskin{
position:absolute;
background-color:#333333;
border:1px solid black;


</SNIP>

Screenshot, this is what it shows....Important note, keep in mind I "AM" logged out at this point, but it 'shows' that I'm not.

in order to even get it to show up this way you have to comment out the includes I mentioned before (like someone asked about in another thread). If not, it shows up window in window type of situation.

My site was the same, deleting the code fixed everything