[UberCMS] Clienf Forward

[cuperus]

Hello,

For the peapol who wants to forward there rooms on the client, i did make some script.
Idea comes from LucasReis

Edit the first line on generic-top.tpl to:

<body onunload="location.href='client_close.php'" id="%body_id%" class="<?php if (!LOGGED_IN) { echo 'anonymous'; } ?> ">

Make a client_close.php file and add this on it:

<?php
/*=======================================================================
| UberCMS - Advanced Website and Content Management System for uberEmu
| #######################################################################
| Copyright (c) 2010, Roy 'Meth0d' and updates by Matthew 'MDK'
| http://www.meth0d.org & http://www.sulake.biz
| #######################################################################
| This program is free software: you can redistribute it and/or modify
| it under the terms of the GNU General Public License as published by
| the Free Software Foundation, either version 3 of the License, or
| (at your option) any later version.
| #######################################################################
| This program is distributed in the hope that it will be useful,
| but WITHOUT ANY WARRANTY; without even the implied warranty of
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
| GNU General Public License for more details.
\======================================================================*/

define('HIDE_FEEDBACK', true);

require_once "global.php";
require_once "inc/class.rooms.php";

if (!LOGGED_IN)
{
	header("Location: " . WWW. "/login_popup");
	exit;
}

dbquery("UPDATE users SET home_room = '48' WHERE id = '" . USER_ID . "' LIMIT 1");

?>

goto client.php and add under

require_once "global.php";
require_once "inc/class.rooms.php";

if (!LOGGED_IN)
{
	header("Location: " . WWW. "/login_popup");
	exit;
}

this

error_reporting('0');
dbquery("UPDATE users SET home_room = '' WHERE id = '" . USER_ID . "' LIMIT 1");

and add under:

if ($users->getUserVar(USER_ID, 'newbie_status') == "0")
{
	if (isset($_GET['createRoom']) && is_numeric($_GET['createRoom']))
	{
		$roomId = RoomManager::CreateRoom(USER_NAME . "'s room", USER_NAME, 'model_s');

		switch (intval($_GET['createRoom']))
		{
			default:
			case 0:
			
				RoomManager::PaintRoom($roomId, '1701', '601');
				break;
				
			case 1:
			
				RoomManager::PaintRoom($roomId, '607', '111');
				break;
				
			case 2:
			
				RoomManager::PaintRoom($roomId, '1901', '301');
				break;
				
			case 3:
			
				RoomManager::PaintRoom($roomId, '1801', '110');
				break;
				
			case 4:
			
				RoomManager::PaintRoom($roomId, '503', '104');
				break;
				
			case 5:
			
				RoomManager::PaintRoom($roomId, '804', '107');
				break;
		}
	}
	else
	{
		header("Location: " . WWW . "/client?createRoom=" . rand(0, 5));
		exit;
	}
}

this

if ($_GET['roomId'] == "")
{

} else {
dbquery("UPDATE users SET home_room = '$_GET[roomId]' WHERE id = '" . USER_ID . "' LIMIT 1");
}

Like it? Press the like button!
Credits To:
Me 90% (for coding)
LucasReis 10% (for idea)

 

[CHGFbPage]

Oh Nice, ill try this out. Thanks

 

[cuperus]

Oh Nice, ill try this out. Thanks

Your welcome

 

[Matthew]

Possible SQL injection noticed. The get is not filtered in anyway therefore is a potential exploit. One could do:

if ($_GET['roomId'] == "'0', SET rank = '7'")

Client side:

http://hotelurl.com/client?roomId=,SET rank = '7'

Fix:

(NOT TESTED)

if ($_GET['roomId'] == "")
$roomId = filter($_GET['roomId']); 
{ 

} else { 
dbquery("UPDATE users SET home_room = '".$roomId."' WHERE id = '" . USER_ID . "' LIMIT 1"); 
}

 

[RageStefan]

awesome !
tnx alot man !

 

[LucasReis]

where is my credits?