Comments on: gCards 1.46 released due to security issues http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/ Just another WordPress weblog Tue, 27 Dec 2011 06:48:25 +0000 hourly 1 By: Renton Currie http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-235765 Renton Currie Thu, 13 Nov 2008 03:43:01 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-235765 I have been hacked - help. What do I do fro here as I love the product and have a few CD's out there with a link to the hacked website :( I have been hacked – help. What do I do fro here as I love the product and have a few CD’s out there with a link to the hacked website :(

]]> By: BubblyBabs http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-79002 BubblyBabs Fri, 13 Jul 2007 02:45:28 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-79002 I wanted to comment that a security issue was found with gcards v1.46 which I'm sure you know about by now... I sent you an email, not sure if you got it, and posted a fix on the forum but I wanted to be sure you approved of it... Babs I wanted to comment that a security issue was found with gcards v1.46 which I’m sure you know about by now… I sent you an email, not sure if you got it, and posted a fix on the forum but I wanted to be sure you approved of it…

Babs

]]> By: BubblyBabs http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-79000 BubblyBabs Fri, 13 Jul 2007 02:38:15 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-79000 I've worked on the client collison problem and think I've got it solved... Please see here: http://www.gregphoto.net/gcards/vanilla/comments.php?DiscussionID=188&page=1#Item_5 Babs I’ve worked on the client collison problem and think I’ve got it solved… Please see here:
http://www.gregphoto.net/gcards/vanilla/comments.php?DiscussionID=188&page=1#Item_5

Babs

]]> By: Joni Solis http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-24489 Joni Solis Mon, 18 Dec 2006 01:29:29 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-24489 >Tascha says...April 13th, 2006 at 3:50 am Awesome script - thanks a lot for all the work :) I was wondering if you plan to make this a wordpress plugin. I am facing now the task to actually integrate this into my wordpress layout >_ I would like more info about using gcards with wordpress. Is anyone doing it. What about a plugin? >Tascha says…April 13th, 2006 at 3:50 am
Awesome script – thanks a lot for all the work :)
I was wondering if you plan to make this a wordpress plugin. I am facing now the task to actually integrate this into my wordpress layout >_

I would like more info about using gcards with wordpress. Is anyone doing it. What about a plugin?

]]> By: Maria Claudia http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-14719 Maria Claudia Mon, 16 Oct 2006 05:46:57 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-14719 hi..... I try gcards in my web site... my hosting recently make an DNS upgrade, so I change the smtp ip for the new one in the config_email.php because I use the smtp functions.... but I have a problem....... it can't send any email There has been a mail error sending to mc_arquitecta@hotmail.com eCard could not be sent… but it's working well after the dns upgrade..... it is possible that this it is the reason of the problem? I'm sure to entered the data well then only changes the IP of the mail server..... sorry my grammar....... María Claudia hi….. I try gcards in my web site… my hosting recently make an DNS upgrade, so I change the smtp ip for the new one in the config_email.php because I use the smtp functions….

but I have a problem……. it can’t send any email

There has been a mail error sending to mc_arquitecta@hotmail.com
eCard could not be sent…

but it’s working well after the dns upgrade…..

it is possible that this it is the reason of the problem? I’m sure to entered the data well then only changes the IP of the mail server…..

sorry my grammar…….

María Claudia

]]> By: Paul http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-4584 Paul Mon, 03 Jul 2006 10:15:18 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-4584 sorry... I just realized I made an incorect statement on my last submission. The error is in the "Submission Line" of the confirmation email. I listed it as not being a problem but it is infact a problem as I copied and pasted from the wrong confirmation email. The subject line actually reads: person1@yahoo.com, person2@aol.com, person3@yahoo.com, person4@hotmail.com, person5@sbcglobal.net, person6@aol.com,.... This is not good considering only one person of the group picked up the card. This makes me think that the other people will NOT be able to pick up their cards because the card now shows picked up and will automatically be removed from the database (or however it is stored). The person who picked up the card should be the ONLY person in the subject line, IMHO. Sorry for the mix up. Paul sorry… I just realized I made an incorect statement on my last submission. The error is in the “Submission Line” of the confirmation email.

I listed it as not being a problem but it is infact a problem as I copied and pasted from the wrong confirmation email.

The subject line actually reads: person1@yahoo.com, person2@aol.com, person3@yahoo.com, person4@hotmail.com, person5@sbcglobal.net, person6@aol.com,….

This is not good considering only one person of the group picked up the card. This makes me think that the other people will NOT be able to pick up their cards because the card now shows picked up and will automatically be removed from the database (or however it is stored). The person who picked up the card should be the ONLY person in the subject line, IMHO.

Sorry for the mix up.
Paul

]]> By: Paul http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-4583 Paul Mon, 03 Jul 2006 09:49:06 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-4583 So far this looks to be an awesome script. In testing out the multiple email addresses (which is seperated by a comma) so a card will go out to multiple people... I have found a bug that prevents ALL the people from picking up the card. Here is the rundown of this issue: 1) When creating the card there is a section that allows you to add the email of the person(s) you are sending the card to. I wanted to send out an unlimited amount of cards so there were about 27 email addresses listed. 2) I selected the option box "Notify me when card is picked up" 3) Sent the card out to all the emails listed And here is where the problem comes in... when a person of the group picks up the card I get a "Person has Picked up your Card" email. This email shows the following: 1) Subject line of the email: This line shows the email address of the person who picked up the card. (This is fine) 2) The body of the confirm email: (this is the problem) This lists all the people and their email addreses that had this card sent to them. Next to the email address of the person who picked up the card says "picked up your eCard". For example.. person1@yahoo.com, person2@aol.com, picked up your eCard person3@yahoo.com, person4@hotmail.com, person5@sbcglobal.net, person6@aol.com, person7@yahoo.com person8@yahoo.com Does that mean that because one person of the many that had this card sent to them closes the card because it shows it was picked up? In other words... if pesron "A" picks up the card will person "B" also be able to pick it up (at a later time) considering it shows the card was all ready picked up? I would hope that when I place multiple email addresses into the email field that it would create individual cards for each email address. This means that the card would remain until EACH person picked up their card, or until the time limit of picking the card expires. Please let me know what this program does in regards to multiple email addresses pertaining to the situation above. Before I release this on my site I want to make sure it does in fact create individual cards for each email address that is listed in the email field. I look forward to your response, Paul So far this looks to be an awesome script. In testing out the multiple email addresses (which is seperated by a comma) so a card will go out to multiple people… I have found a bug that prevents ALL the people from picking up the card.

Here is the rundown of this issue:
1) When creating the card there is a section that allows you to add the email of the person(s) you are sending the card to. I wanted to send out an unlimited amount of cards so there were about 27 email addresses listed.
2) I selected the option box “Notify me when card is picked up”
3) Sent the card out to all the emails listed

And here is where the problem comes in… when a person of the group picks up the card I get a “Person has Picked up your Card” email. This email shows the following:

1) Subject line of the email: This line shows the email address of the person who picked up the card. (This is fine)
2) The body of the confirm email: (this is the problem) This lists all the people and their email addreses that had this card sent to them. Next to the email address of the person who picked up the card says “picked up your eCard”. For example..
person1@yahoo.com,
person2@aol.com, picked up your eCard
person3@yahoo.com,
person4@hotmail.com,
person5@sbcglobal.net,
person6@aol.com,
person7@yahoo.com
person8@yahoo.com

Does that mean that because one person of the many that had this card sent to them closes the card because it shows it was picked up? In other words… if pesron “A” picks up the card will person “B” also be able to pick it up (at a later time) considering it shows the card was all ready picked up?

I would hope that when I place multiple email addresses into the email field that it would create individual cards for each email address. This means that the card would remain until EACH person picked up their card, or until the time limit of picking the card expires.

Please let me know what this program does in regards to multiple email addresses pertaining to the situation above. Before I release this on my site I want to make sure it does in fact create individual cards for each email address that is listed in the email field.

I look forward to your response,
Paul

]]> By: Jacob http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-3784 Jacob Mon, 19 Jun 2006 14:59:09 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-3784 What about collisions Greg?!! As far as I understand the fix is fairly simple. What about collisions Greg?!! As far as I understand the fix is fairly simple.

]]> By: Jacob http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-3647 Jacob Mon, 19 Jun 2006 07:48:14 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-3647 Did you fix the client collision problem in the lates version of gcards? The situation is caused by the use of the server time (seconds since epoch) as the identification of cards sent. It is quite obvious that two or more users sending a card in within the same second will collide because the second card cannot be created as it would produce a duplicate key - a MySQL error is generated when this happens. The solution is to identify the cards by a different means Did you fix the client collision problem in the lates version of gcards?

The situation is caused by the use of the server time (seconds since epoch) as the identification of cards sent. It is quite obvious that two or more users sending a card in within the same second will collide because the second card cannot be created as it would produce a duplicate key – a MySQL error is generated when this happens. The solution is to identify the cards by a different means

]]> By: Greg http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/comment-page-1/#comment-3340 Greg Wed, 14 Jun 2006 04:41:17 +0000 http://www.gregphoto.net/index.php/2006/03/27/gcards-146-released-due-to-security-issues/#comment-3340 @Susan - I'll take a look at it - I moved it around on my site and probably screwed up the demo @Frank - sorry you're having problems with the script. Unfortunately I haven't been able to put up a replacement for the forum. It's hard to find good free forum software that can easily block spam and require a minimal amount of maintenance. You can change the interface if you like - it's simple html and php...nothing too fancy. As for storing things - I don't know exactly what you're referring to, but not much is stored in the filesystem aside from the actual images. @Renton Curry - there's nothing built-in to support MPEG...it might be possible to hack it to do that, but nothing in the plans to do that. Greg @Susan – I’ll take a look at it – I moved it around on my site and probably screwed up the demo

@Frank – sorry you’re having problems with the script. Unfortunately I haven’t been able to put up a replacement for the forum. It’s hard to find good free forum software that can easily block spam and require a minimal amount of maintenance. You can change the interface if you like – it’s simple html and php…nothing too fancy. As for storing things – I don’t know exactly what you’re referring to, but not much is stored in the filesystem aside from the actual images.

@Renton Curry – there’s nothing built-in to support MPEG…it might be possible to hack it to do that, but nothing in the plans to do that.

Greg

]]>