Bug found in "vbulletin3.inc.php"

Discussion in 'Troubleshooting' started by sirc, Oct 20, 2005.

  1. sirc

    sirc New Member

    Joined:
    Sep 24, 2005
    Messages:
    3
    Hi,

    I have just found a bug in the vbulletin plugin, gives an error saying it can't find table 'am'

    Line: 357
    FROM {$db->config[prefix]}members

    Should be:
    FROM {$db->config[prefix]}members am

    Regards,
    Chris
  2. alex

    alex aMember Pro Customer Staff Member

    Joined:
    Jan 24, 2004
    Messages:
    6,021
    Chris,
    could you paste entire function check_logged_in(..) here ?

    In my case it does not refer to "am" anywhere:

    PHP:
    function vbulletin3_check_logged_in(){
        
    // check if user already logged-in with vbulletin3
        // must return array($login, $pass)
        // of logged-in vbulletin3 customer or empty values
        
    global $plugins$plugin_config;
        global 
    $vb3_db$db;
        
    $this_config $plugin_config['protect']['vbulletin3'];
        
    $vb_db $this_config['db'];
        
    $sess vbulletin_get_session();
        if (
    in_array('vbulletin3'$plugins['protect']) && $sess[userid]){
            
    $q $vb3_db->query("SELECT vb.userid, vb.username, 
                vb.salt, vb.password FROM 
                
    ${vb_db}user vb 
                WHERE userid=
    $sess[userid]
                "
    );
            list(
    $vb_id$vb_user$vb_salt$vb_pass) = mysql_fetch_row($q);
            if (!
    $vb_id) return;
            
    $vb_user $db->escape($vb_user);
            
    $vb_salt $db->escape($vb_salt);
            
    $vb_pass $db->escape($vb_pass);
            
    $q1 $db->query("SELECT 
                MD5(CONCAT(MD5(pass), '
    $vb_salt')) = '$vb_pass', 
                login, pass 
                FROM 
    {$db->config[prefix]}members
                WHERE login = '
    $vb_user'
            "
    );
            list(
    $valid$l$p) = mysql_fetch_row($q);
            if (
    $valid){  
                
    $_SESSION['_amember_logged_from_vb'] = 1;
                return array(
    $l,$p);
            } else {
                
    $l $p '';
            }
        }
        return array(
    $l,$p);
    }
  3. sirc

    sirc New Member

    Joined:
    Sep 24, 2005
    Messages:
    3
    Ok that is different what was in mine:

    Code:
    function vbulletin3_check_logged_in(){
        // check if user already logged-in with vbulletin3
        // must return array($login, $pass)
        // of logged-in vbulletin3 customer or empty values
        global $plugins, $plugin_config;
        global $vb3_db, $db;
        $this_config = $plugin_config['protect']['vbulletin3'];
        $vb_db = $this_config['db'];
        $sess = vbulletin_get_session();
        if (in_array('vbulletin3', $plugins['protect']) && $sess[userid]){
            $q = $vb3_db->query("SELECT vb.userid, vb.username, 
                vb.salt, vb.password FROM 
                ${vb_db}user vb 
                WHERE userid=$sess[userid]
                ");
            list($vb_id, $vb_user, $vb_salt, $vb_pass) = mysql_fetch_row($q);
            if (!$vb_id) return;
            $vb_user = $db->escape($vb_user);
            $vb_salt = $db->escape($vb_salt);
            $vb_pass = $db->escape($vb_pass);
            $q1 = $db->query("SELECT 
                MD5(CONCAT(MD5(am.pass), '$vb_salt')) = '$vb_pass', 
                am.login, am.pass 
                FROM {$db->config[prefix]}members
                WHERE am.login = '$vb_user'
            ");
            list($valid, $l, $p) = mysql_fetch_row($q);
            if ($valid){  
                $_SESSION['_amember_logged_from_vb'] = 1;
                return array($l,$p);
            } else {
                $l = $p = '';
            }
        }
        return array($l,$p);
    }
    You can see where it checks for the password there is referance to 'am' but am isn't used in the FROM field?

    I only downloaded this two weeks ago so if it has been fixed since then that cool. If you haven't changed anything resently then you may want to check whats in the download link.

    Otherwise I am liking this product very much. Saving me a ton of work having to writing this for myself.

    Thanks
    Chris.

Share This Page