[Official] WARNING: For Public Rapidleech Servers. Read Special Security Updates

[Palooo 2009]

WARNING:
For Public Rapidleech Servers. Special Security Updates

Bug found due to the insert_location() function (download system) which reveals premium cookies and base_64 encoded auth-strings to end user(s). The premium accounts of rapidleech servers providing premium-account downloads to public, are in danger of having their premium accounts compromised!

Private rapidleech servers are safe for now, but are strongly encouraged to upgrade.

Standard auth system for premium accounts is put in place, any premium plugins not adhering to the new standard will either be compromised, or won't work with the new system. Premium account data using base64 authorization are no longer passed via the insert_location function, instead they are retrieved internally.

New premium cookie encryption system implemented (due to the complexity of cookie system and to keep load on 3rd-party servers to a minimum, cookies are encrypted instead, and then decrypted when needed) New $secretkey in accounts.php, which is used for cookie encryption.

A standard key is included, but you must create your own random string, max 56 characters in length

Rapidshare, Hotfile, Megaupload, Netload premium system updated. Other filehost premium plugins will need to be updated, if needed (this includes paid-for plugins also)

Please replace the old files in your rapidleech with the new security updated files as structured in the zip file below:

Add classes/blowfish.php

Add classes/class.pcrypt.php

Replace classes/other.php

Replace configs/accounts.php

Replace hosts/download/hotfile_com.php

Replace hosts/download/megaupload_com.php

Replace hosts/download/netload_in.php

Replace hosts/download/rapidshare_com.php

Replace index.php

This link is direct:

http://rapidshare.com/files/395697523/Security_Rapidleech.zip

Palooo 2009 Reviewed by Palooo 2009 on 5th Jun 2010. [Official] WARNING: For Public Rapidleech Servers. Read Special Security Updates WARNING: For Public Rapidleech Servers. Special Security Updates Bug found due to the insert_location() function (download system) which reveals premium cookies and base_64 encoded auth-strings to end user(s). The premium accounts of rapidleech servers providing premium-account downloads to public, are in danger of having their premium accounts compromised! Private rapidleech servers are safe for now, but are strongly encouraged to upgrade. Standard auth system for premium accounts Rating: 5