IRC log for #uphpu on 20101213

00:22.43*** join/#uphpu cro (~cro@204-228-149-217.ip.xmission.com)
00:28.03*** join/#uphpu ninnypants (~ninnypant@69.169.155.194.provo.static.broadweavenetworks.net)
00:35.33*** mode/#UPHPU [+v tierra] by ChanServ
00:36.07ninnypants~rlart
00:36.07ibotslaps macnewbold upside the head with a wet fish
01:13.02macnewboldgee whiz
02:20.29tierrasomeone did quite the number on this somewhat large PHP script/app....
02:22.41tierra$PageTitle = $_POST[PageTitle]; if (!get_magic_quotes_gpc()) $PageTitle = addslashes($_POST[PageTitle]);
02:22.55tierra$updater = "UPDATE PageContent SET PageContent='$NewCopy', PageName='$PageName', PageTitle='$PageTitle' WHERE Page_ID='$Page_IDz'";
02:24.22tierra... I mean... common... addslashes()?
02:27.08tierrawell, that and no quotes for array keys...
02:28.28tierrathis same application is storing user passwords in the clear in the DB too...
02:33.18ninnypantstierra: what application is that?
02:36.09tierrait's a custom in house job... can't believe the person who wrote this actually got paid to do it
02:38.58ninnypantsahh thought maybe you were looking through the gawker source
02:42.44tierrathis isn't even some old script either... written back in March
02:43.48tierraomg... amazing...
02:44.12tierraif (!ini_get('register_globals')) {
02:44.12tierrawhile (list($key, $val) = @each($_GET)) $GLOBALS[$key] = $val;
02:44.12tierrawhile (list($key, $val) = @each($_POST)) $GLOBALS[$key] = $val;
02:44.12tierrawhile (list($key, $val) = @each($_COOKIE)) $GLOBALS[$key] = $val;
02:44.12tierrawhile (list($key, $val) = @each($_FILES)) $GLOBALS[$key] = $val;
02:44.15tierrawhile (list($key, $val) = @each($_SESSION)) $GLOBALS[$key] = $val;
02:44.17tierra}
02:44.49tierracomment above that: // workaround fix for when register_globals is set to off.
02:47.52tierraI just want to strangle whoever wrote this
03:20.56*** join/#uphpu romanovic-afk (~romanovic@puritynine.com)
03:25.45*** join/#uphpu jnbek (~jnbek@unaffiliated/jnbek)
03:47.32*** join/#uphpu optikal (optikal@failcore.com)
03:47.32*** mode/#UPHPU [+v optikal] by ChanServ
10:40.55*** join/#uphpu brasto (~brasto@c-67-182-203-21.hsd1.ut.comcast.net)
10:40.55*** mode/#UPHPU [+v brasto] by ChanServ
12:55.59*** join/#uphpu itimber (~Adium@106.73.124.24.cm.sunflower.com)
12:55.59*** mode/#UPHPU [+v itimber] by ChanServ
15:21.39*** join/#uphpu cro (~cro@204-228-149-217.ip.xmission.com)
15:25.26*** join/#uphpu bhosie (~bhosie@147.sub-75-220-255.myvzw.com)
15:27.18*** join/#uphpu macnewbold (~Adium@66.60.115.30)
15:27.18*** mode/#UPHPU [+o macnewbold] by ChanServ
15:32.10*** join/#uphpu jamund (~jamund@24-104-129.146.hfc.mediarain.com)
15:51.23*** join/#uphpu josephscott (~josephsco@74.200.246.169)
15:51.23*** mode/#UPHPU [+v josephscott] by ChanServ
16:07.10*** join/#uphpu fungus (~olsonl@bromine.sosstaffing.com)
16:07.10*** mode/#UPHPU [+o fungus] by ChanServ
16:17.50*** join/#uphpu optikal (optikal@failcore.com)
16:17.50*** join/#uphpu mindjuju (~mindjuju@c-174-52-140-19.hsd1.ut.comcast.net)
16:17.50*** mode/#UPHPU [+vo optikal mindjuju] by hubbard.freenode.net
16:19.12*** join/#uphpu bhosie (~bhosie@121.sub-69-98-159.myvzw.com)
16:22.15*** join/#uphpu bhosie_ (~bhosie@179.sub-75-220-136.myvzw.com)
16:27.21*** join/#uphpu sheri (~sheri@static-64-22-40-34.albyny.csvoip.net)
16:31.22mindjujufungus lives
16:31.24mindjuju!
16:37.09*** join/#uphpu PoeticIntensity (~jason@76.8.222.23)
16:37.09*** mode/#UPHPU [+v PoeticIntensity] by ChanServ
16:42.30*** join/#uphpu _psychic_ (~johnander@64.0.193.30)
16:42.30*** mode/#UPHPU [+v _psychic_] by ChanServ
16:45.05herlowoohoo!
16:59.42*** join/#uphpu mgeary (~mgeary@166.70.44.49)
16:59.42*** mode/#UPHPU [+v mgeary] by ChanServ
16:59.56fungushehe, back from the new WoW expansion vacation
17:00.21mindjujuit thought it might have been that
17:00.32mindjujui heard a lot of things changed
17:00.51fungusoh yeah, lots of fun.  Spent all week playing.  
17:01.04mgeary~wiki play
17:01.13mindjujuso what level is your character now?
17:05.52fungus85 (new level cap) of course
17:06.13fungusafter a whole week of playing I should be there of course.
17:06.39mindjujuah
17:07.30mindjujugames like Zelda and Dragon Quest, not withstanding
17:08.24funguslol, it does take "forever", but when you play even longer than forever, you eventually get there.
17:22.28josephscott~rlart
17:22.28ibotslaps ninnypants upside and over the head with one freakishly huge killer whale named hugh
17:26.50*** join/#uphpu thebigdog (~thebigdog@dsl093-228-015.slc1.dsl.speakeasy.net)
17:26.50*** mode/#UPHPU [+o thebigdog] by ChanServ
17:36.49carmonyfungus: is the whole 1-60 areas changed?
17:37.26fungusyes, big time
17:37.48mindjuju~fungus++
17:37.51fungusSmoother quest flows, more interesting quests, more epic in general
17:38.03mindjujui heard there are villages that you start out from that got burned to a crisp
17:38.15fungushehe, yup
17:38.16mindjujuand that gnomes and goblins no longer start out in the same place
17:38.25mindjujuand that there is now a wolfman
17:38.40funguslol, totally.  The wolfman (Worgen) are really fun
17:39.02fungusyou almost sound like a real player.
17:39.14mindjujuso do you actually get to witness village being roasted or was that a one time event or is that a cinematic ?
17:39.46fungusit's a cinematic
17:40.06mindjujuwell, WoW sounds like buckets of fun(TM) and i'd love to play once i've successfully cloned myself several times
17:40.29fungusThat makes sense.  It can consume your life.  
17:40.46fungusbut it doesn't have to.  you have to judge based on your personality.
17:58.42josephscottpotentially bad hole in debian - http://blog.bytemark.co.uk//2010/12/12/fresh-worm-food
17:59.08josephscottremote root, fun
18:06.23unumthanks for letting me know about that
18:07.15mindjuju~josephscott++
18:15.31mindjujuso i'm a little confused on this thing that josephscott posted.  is it just debian implementation of exim4 with remote root exploit or is it all exim4, like the one for centos?
18:18.15funguswhew, i replace exim with postfix on every debian based system I touch
18:19.08josephscottmindjuju: thread on exim email list - http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html
18:19.41jsmithmindjuju: https://bugzilla.redhat.com/show_bug.cgi?id=662012
18:19.44mindjujuthx josephscott
18:19.51mindjuju& jsmith
18:19.53jsmithmindjuju: and https://www.redhat.com/security/data/cve/CVE-2010-4345.html
18:21.18josephscotta few years back I took a long hard look at what I wanted to replace sendmail with, I tried several alternatives, in the end I went with postfix
18:22.04fungusI've used exim, it's nice, but not quite as nice as postfix.  IMHO
18:43.42josephscott~save exim
18:43.43ibotACTION runs into a burning building and saves exim from certain death. Is that enough?
18:53.09josephscottuh, still graphic - http://devour.com/video/lego-black-ops/
18:53.26josephscottin a lego sort of way
19:00.35*** join/#uphpu sheri (~sheri@cpe-67-248-81-27.nycap.res.rr.com)
19:12.21*** join/#uphpu brasto (~brasto@c-67-182-203-21.hsd1.ut.comcast.net)
19:12.21*** mode/#UPHPU [+v brasto] by ChanServ
19:12.43*** part/#uphpu brasto (~brasto@c-67-182-203-21.hsd1.ut.comcast.net)
19:13.00*** join/#uphpu brasto (~brasto@c-67-182-203-21.hsd1.ut.comcast.net)
19:13.01*** mode/#UPHPU [+v brasto] by ChanServ
19:16.17*** join/#uphpu mgeary (~mgeary@166.70.44.49)
19:16.17*** mode/#UPHPU [+v mgeary] by ChanServ
19:21.59*** join/#uphpu Utah_Dave (~Utah_Dave@72-166-51-162.dia.static.qwest.net)
19:22.00*** mode/#UPHPU [+o Utah_Dave] by ChanServ
19:46.48*** join/#uphpu cro (~cro@204-228-149-217.ip.xmission.com)
19:54.55*** join/#uphpu itimber (~Adium@106.73.124.24.cm.sunflower.com)
19:54.55*** mode/#UPHPU [+v itimber] by ChanServ
20:05.14*** join/#uphpu _psychic_ (~johnander@64.0.193.30)
20:05.14*** mode/#UPHPU [+v _psychic_] by ChanServ
20:07.40*** join/#uphpu _psychic_ (~johnander@64.0.193.30)
20:07.40*** mode/#UPHPU [+v _psychic_] by ChanServ
20:09.29*** join/#uphpu influx (~martin@c-67-169-240-135.hsd1.ut.comcast.net)
20:09.37influxoi
20:10.23mgearyyou know, the whole North Korea thing is pretty crazy
20:10.34*** join/#uphpu _psychic_ (~johnander@64.0.193.30)
20:10.34*** mode/#UPHPU [+v _psychic_] by ChanServ
20:11.26influxWhat makes you say that?
20:15.57*** join/#uphpu bhosie (~bhosie@133.sub-69-98-143.myvzw.com)
20:16.42mgearywell, the only thing NK has to lose is their regime, which they can only lose once
20:17.59mgearyso if they ever decide that their regime is indeed seriously threatened, i wouldn't be shocked if they nuke Seoul
20:18.54mgearyat which point, they would clearly be completely taken over, their million-man army notwithstanding. I'd suspect even China would lend a hand there
20:22.54*** join/#uphpu josephscott (~josephsco@74.200.246.169)
20:22.54*** mode/#UPHPU [+v josephscott] by ChanServ
20:36.45*** join/#uphpu _psychic_ (~johnander@64.0.193.30)
20:36.45*** mode/#UPHPU [+v _psychic_] by ChanServ
20:42.09tierrawow... 719 matches found for hardcoded full paths in PHP files in this retarded application I was talking about last night...
20:44.10tierrayet, it does have CONFIGURATION_* defines for other things...
20:46.07tierraI thought I had seen the worst some PHP developers had to offer... sadly, I was wrong
21:01.24*** join/#uphpu influx (~influx@deadink.org)
21:01.57*** part/#uphpu influx (~influx@deadink.org)
21:02.18*** join/#uphpu influx (~influx@deadink.org)
21:58.08*** join/#uphpu WsGator (~WsGator@mail.allreds.net)
22:13.23*** join/#uphpu bhosie (~bhosie@76.sub-75-220-116.myvzw.com)
22:20.52*** join/#uphpu cro (~cro@204-228-149-217.ip.xmission.com)
22:25.10*** join/#uphpu bradym (~bmitchell@12.91.245.190)
22:25.10*** mode/#UPHPU [+v bradym] by ChanServ
22:42.07*** join/#uphpu Utah_Dave (~Utah_Dave@72-166-51-162.dia.static.qwest.net)
22:42.07*** mode/#UPHPU [+o Utah_Dave] by ChanServ
22:59.22*** join/#uphpu bhosie (~bhosie@56.sub-75-196-208.myvzw.com)
23:06.06josephscottand everyone has heard about the gawker account break in right?
23:08.34jsmithjosephscott: I certainly have -- and I made sure I didn't have an account there
23:10.55mgearyi don't even know what gawker is
23:10.58mgeary~wiki gawker
23:11.11mgearyvery helpful
23:12.09DexterTheDragonsomeone needs to fix the wiki factoid to parse out all the wiki syntax
23:12.10josephscottthe problem is, there are a number of sites that are powered by the same backend, I think lifehacker was one
23:16.31thebigdogi think it is just hilarious the crap they get them selves into
23:31.39tierrathis is like a game of "spot 10 things wrong with this line of code":
23:31.42tierra$query = "UPDATE Designers SET Name='$_POST[Name]', Uname='$_POST[Uname]', Pword='$_POST[Pword]', Email='$_POST[Email]' WHERE DesignID='$_POST[DesignID]'";
23:32.29fungusSounds like little bobby tables is gonna kill them.
23:33.15tierrasorry... unrelated to gawker
23:34.01josephscottsql injection, for fun and profit ;-)
23:34.06fungushttp://xkcd.com/327/
23:34.41josephscottsomehow I don't think my wife wouldn't have gone for that name
23:38.09*** join/#uphpu bhosie (~bhosie@11.sub-75-196-193.myvzw.com)
23:55.01ninnypantstierra: you're still messing with that code?
23:56.07tierrayeah
23:57.13tierrain about a month, I'm probably replacing it with something else entirely, but I'll still need to understand how this works, where it stores everything, etc so I can export it out and import it into something new
23:58.32tierrait'll have to be replaced, there's just no way this package can live on

Generated by irclog2html.pl Modified by Tim Riker to work with infobot.