phpMyFAQ

Perhaps I missed it. Is there any comment on the security issues reported to bugtraq at http://rgod.altervista.org/phpmyfuck151.html ?

Well, it turned out to be a corrupt db. Not sure when this happened but in any case it's working fine now that I've recreated the db. Sorry for the wild goose chase. Paypal donation on its way.

I replaced line 124 in admin/insdex.php with: and see no change in behaviour.

Is this code for RC5 or 6? I'm now running 6.
BTW, the output of the previous code addition:
print 'User: '.$user.', Pass: '.$pass;
yielded "User: , Pass: "

Also, just to recap my config:
phpMyFAQ Version
phpMyFAQ 1.5.0 RC6
Server Software
Microsoft-IIS/6.0
PHP Version
PHP 5.0.4
PHP Memory Limit ...

I'm having problems with the admin section of version 1.5 (which keeps returning me to the login prompt) and I am curious if it is related to IIS6 and PHP5 in ISAPI mode or if it's perhaps unique to my configuration. Are there any success stories out there?

No luck. I'm still seeing:
WHERE name = '' AND pass = ''
Sorry to say that I haven't had time to do my own debugging on this but will try to find some time later this week.

I wonder if there is anyone who's using this successfully in the same config as I have...

Yes, the first login is successful and I can see the site stats. Here's what's happening:
When I first load the admin login page I see:
Array
(
[lang] => en
[sid] => 217
)

Then, I can log in successfully and I see:
Array
(
[faqusername] => admin
[faqpassword] => mypassword
[D:\\applications ...

I added the code to admin/index.php and now when I log in and click on User Administration I see at the top:
Array
(
[uin] => 861f3692cde1b037fb5ad4c475727c03
[aktion] => user
[D:\\applications\\phpmyfaq/lang] => en
[wja_pcache_id] => 15925
)

So it's still prompting me to log back in.

And ...

Using version 1.5 RC5.

DELETE FROM phpmyfaqfaqadminsessions WHERE time < 1120585704
SELECT usr, pass FROM phpmyfaqfaqadminsessions WHERE uin = 'a882a3c03561446edcf9af8c67ad8483'
UPDATE phpmyfaqfaqadminsessions SET time = 1120587504 WHERE uin = 'a882a3c03561446edcf9af8c67ad8483'
SELECT id, name ...

Using IIS6 & PHP5.04 ISAPI, when I log in to the admin section I see the Startpage but when I try to do anything on that page I'm taken back to the login page. Any ideas?