• Forum
  • Doc
  • Screenshots
  • Download
  • Donate
  • Contributors
  • Contact
  • Follow @phpfreechat
  • DEMO
  • Board index ‹ Version 1.x branch ‹ General Support (v1.x)
  • Change font size
  • FAQ
  • Register
  • Login

PhpFreeChat 1.3

Moderators: OldWolf, re*s.t.a.r.s.*2

Post a reply
2 posts • Page 1 of 1

Postby sandarminaye » Thu Oct 14, 2010 9:45 am

hi,

now i use PhpFreeChat 1.3 for my site. i had download it in http://www.phpfreechat.net/download and then install and modify.
it is easily for customize but i don't know for how to do Admin setup in Chat and which folder that i can delete in package?
If u know , pls help me and give suggestion.

here are some of my coding ...

<?php
include "../mysql.php";
$mysqlcon = new db_sql();
$mysqlcon->connect();

require_once dirname(__FILE__)."/src/phpfreechat.class.php";
$params = array();
$params["title"] = "StampsMyanmar Live Chat";

if ( (isset($_COOKIE['a'])) && (isset($_COOKIE['b'])) )
{
$a = $_COOKIE['a'];

if($_COOKIE['b']=='member')
{
$sql = " SELECT * FROM tablename WHERE field='$a' ";
$row = mysql_query($sql) or die('MySQL error!');
$rows = mysql_fetch_assoc($row);
$nickname = $rows["nickname"];
}
else if($_COOKIE['b']=='admin')
{
$sql = "SELECT * FROM tablename WHERE field='$a' ";
$row = mysql_query($sql) or die('MySQL error!');
$rows = mysql_fetch_assoc($row);

$nickname = $rows["nickname"];
}
else{}

$params["nick"] = $nickname;
}
else
{
$params["nick"] = "";
}

//$params["nick"] = "guest".rand(1,1000); // setup the intitial nickname

$params['admins'] = array('Admin' => 'type password',
'Second Admin' => 'type password');// setup the chat admins

//$params['firstisadmin'] = true;
//$params["isadmin"] = true; // makes everybody admin: do not use it on production servers ;)

$params["serverid"] = md5(__FILE__); // calculate a unique id for this chat
$params["debug"] = false;
$chat = new phpFreeChat( $params );
?>

<html>
<body>
<table cellpadding="0" cellspacing="0" border="0" width="928" align="center" height="100%">
<tr><td height="400" valign="top">
<div class="content">
<?php $chat->printChat(); ?>
<?php if (isset($params["isadmin"]) && $params["isadmin"]) { ?>
<p style="color:red;font-weight:bold;">Warning: because of "isadmin" parameter, everybody is admin. Please modify this script before using it on production servers !</p>
<?php } ?>
</div>
</td></tr>
</table>
</body>
</html>
sandarminaye
New member
 
Posts: 5
Joined: Thu Oct 14, 2010 9:38 am
Top

Postby OldWolf » Fri Oct 15, 2010 6:30 am

This method of authorization is EXTREMELY insecure, and your opening yourself up to sql inject attacks. I would STRONGLY recommend that you use sessions from a referral page, and that you sanitize ANYTHING coming from the user's end (including cookies).
Signature:
Read before Posting: Forum Rules
Note: I am unable to offer support through PM/e-mail at this time.
OldWolf
Site Admin
 
Posts: 1918
Joined: Sun Sep 23, 2007 5:48 am
Top


Post a reply
2 posts • Page 1 of 1

Return to General Support (v1.x)

Who is online

Users browsing this forum: No registered users and 8 guests

  • Board index
  • The team • Delete all board cookies • All times are UTC + 1 hour
Powered by phpBB® Forum Software © phpBB Group
cron
Sign in
Wrong credentials
Sign up I forgot my password
.
jeu-gratuit.net | more partners
Fork me on GitHub