unsecure admin-area

Hmm...I just edited your first categorie on openmicroblogger.com/admin

:-) ok I check it out right now

insert these 4 lines at line 1508 of /db/library/dbscript/_functions.php

if ( !( in_array( $request->action, $datamodel->allowed_methods, true )))

$action = 'get';

if (!($action == 'get'))

return false;

the public_resource() test is supposed to return true only for GET on a resource

if you want to push the fix I will pull it from your git

should have an $action = $request->action; before that too

$action = $request->action;

if ( !( in_array( $action, $datamodel->allowed_methods, true )))

$action = 'get';

if (!($action == 'get'))

return false;

Wow, that was really fast! :)
Thank you, it works!

glad you like it! :-)

I can push it if you don't want to

Oh, you can't visit the mainpage anymore without being logged in.

If you fix that, you can push it :P

fixed like this

I will push

$action = $request->action;

if ( !( in_array( $action, $datamodel->allowed_methods, true )))

$action = 'get';

if (!($action == 'get' || $action == 'get'))

return false;

oops hold on

are you sure? did you use the 5-line version? I can see home page not logged in

$action = $request->action;

if ( !( in_array( $action, $datamodel->allowed_methods, true )))

$action = 'get';

if (!($action == 'get'))

return false;

Okay, didn't get the 5 line version. now it works with your last post. Thanks! :)

hi Johannes,

I just committed all of your fixes, and the security fix too

http://github.com/voitto/openmicroblogger/commits/master

also posted a new dbscript.net/omb.zip

thanks again for your help -brian

Playing around in Identi.ca I noticed an old test account that is still listed by another Identi.ca user under "subscribers.

While the link showed an old Sportstwit profile url (http://www.sportstwit.com/admin), it actually brought me to: http://openmicroblogger.com/admin.

This can't be good,

Hi Scot,

Could you do me a favor and look at the contents of the .htaccess file at SportsTwit.com

My guess is that the 3rd line says "openmicroblogger.com"

Thanks a lot

-- Brian