Re: security problem in the /fetch/docsauth.php

(Sorry for staring a new thread, but I'm not receiving any e-mail... I'm reading the mails in the on-line archive.) The last change to the file is completly bogus: - $_GET['token'] != '97669cf8c9a1449eb2099ea6147d125697669cf8c9a1449eb2099ea6147d1256') { +md5($_GET['token']) != '97669cf8c9a1449eb2099ea6147d125697669cf8c9a1449eb2099ea6147d1256') { a md5 hash has always only 32 chars. What you wanted to do was something like: +md5($_GET['token']) != 'baeed6d497bd4f4676306544a0e7faba') { where 'baeed6d497bd4f4676306544a0e7faba' is the hash for secret_pass. The problem of the $_SERVER['REMOTE_ADDR'] is real. Now the master server has already updated (and now its impossible to get access, because of the md5 bug) but before you could do this: http://master.php.net/fetch/docsauth.php?_SERVER[REMOTE_ADDR]=81.57.253.132&token=97669cf8c9a1449eb2099ea6147d125697669cf8c9a1449eb2099ea6147d1256 With this, you had permission to use the script. Nuno