TorrentFlux.com Hey, OppTupacShakur, you have 11 messages, 0 are new.
06-27-2007, 12:52:10
Home Help Search Profile Logout donate chat
News:


+  TorrentFlux Forums
|-+  Code Hacks and Tools
| |-+  TorrentFlux 2.1 Hacks
| | |-+  [Hack] Only Admin can see other user torrents
« previous next »
Pages: 1 2 [All] Go Down Reply Notify of replies Send this topic Print
Author Topic: [Hack] Only Admin can see other user torrents  (Read 5100 times)
DD32
Newbie
*
Offline Offline

Posts: 16



View Profile Personal Message (Offline)
« on: 04-24-2006, 23:27:00 » Reply with quote

Well it came that i wanted to allow other users to use my TF box, but i DIDNT want them to see what other users were downloading.

So i hacked the code alittle.

This will make NORMAL users only able to see their OWN torrents, they CANT see what other users are downloading. Admins can still see other files.

This wasnt done to a Vanilla install, this is the "torrentflux_2.1+" install pack from one of thee multihacks things.

Heres the changes for mine:
Code
Line 2916
Find:
   if (sizeof($arListTorrent) > 0)
Replace with:
   if ( (sizeof($arListTorrent) > 0) && (IsAdmin() == true) )
 

Thats the only change.
In a vanilla install(Which i havnt tested) the line is 2520, same change as above should be made.

I was thinking of making it so as the users can see the download percentage/speed/status just couldnt see the torrent names, And i may do that later, this was just a quick hack to add the fuction in so i could let others onto it ASAP.


:::EDIT:::
Part 2:
I Forgot about dir.php! Smiley
Code
Line: About 34
Find
$dir = stripslashes(urldecode(getRequestVar('dir')));
 
And place this after it:
if (IsAdmin() == false){
$cfg['path'] = $cfg['path'].$cfg['user'].'/';
if( substr($dir,0,strlen($cfg['user'])) == $cfg['user'] ){
$dir = substr($dir,strlen($cfg['user']));
}
}
 
it now looks like this:
 
$dir = stripslashes(urldecode(getRequestVar('dir')));
 
if (IsAdmin() == false){
$cfg['path'] = $cfg['path'].$cfg['user'].'/';
if( substr($dir,0,strlen($cfg['user'])) == $cfg['user'] ){
$dir = substr($dir,strlen($cfg['user']));
}
}
 
 

I think i've covered everything thing now Smiley

::::Edit2::::
'doh.. noticed another file.
History.php:
Code
Line: About 55
 
Find this:
 
$sql = "SELECT user_id, file, time FROM tf_log WHERE action=".$db->qstr($cfg["constants"]["url_upload"])." OR action=".$db->qstr($cfg["constants"]["file_upload"])." ORDER BY time desc";
 
Replace with this:
 
if (IsAdmin() == true){
   $sql = "SELECT user_id, file, time FROM tf_log WHERE action=".$db->qstr($cfg["constants"]["url_upload"])." OR action=".$db->qstr($cfg["constants"]["file_upload"])." ORDER BY time desc";
} else {
$sql = "SELECT user_id, file, time FROM tf_log WHERE user_id='".$cfg['user']."' AND ( action=".$db->qstr($cfg["constants"]["url_upload"])." OR action=".$db->qstr($cfg["constants"]["file_upload"])." ) ORDER BY time desc";
}
 
 


Hope its of use to someone

NOTE: can someone else please tell me if download files/tar directory still works? Its failing on my install, and i cant see any reason for it to.

DD32

EDIT:
The Codebase for this was this: http://www.torrentflux.com/forum/index.php/topic,1265.0.html
« Last Edit: 06-02-2006, 05:00:11 by IhatemyISP » Report to moderator   Logged
wobbles
Newbie
*
Offline Offline

Posts: 37



View Profile Email Personal Message (Offline)
« Reply #1 on: 04-25-2006, 06:10:50 » Reply with quote

other users on my tf server wanted this mod and now it is intergrated, tell you later how it goes (Excellent mod though)
Report to moderator   Logged
wobbles
Newbie
*
Offline Offline

Posts: 37



View Profile Email Personal Message (Offline)
« Reply #2 on: 04-25-2006, 06:46:09 » Reply with quote

just tested the mod and it works great.

Good work DD32
Report to moderator   Logged
DD32
Newbie
*
Offline Offline

Posts: 16



View Profile Personal Message (Offline)
« Reply #3 on: 04-25-2006, 07:22:33 » Reply with quote

just tested the mod and it works great.

Good work DD32

Cheers Smiley

First mod knocked over, now to add in wget support somehow..

D
Report to moderator   Logged
mb.Tab
Hero Member
*****
Offline Offline

TF Base: Linux 2.x
Posts: 556


Gotta love my Avatar !!

169560841 mb.Tab@web.de andreas11b



View Profile WWW Email Personal Message (Offline)
« Reply #4 on: 04-25-2006, 09:22:39 » Reply with quote

just tested the mod and it works great.

Good work DD32


Cheers Smiley

First mod knocked over, now to add in wget support somehow..

D

Hey could you pls drop me a line when you have finished the wget support, would be really cool Smiley

mb.Tab
Report to moderator   Logged

watermelon245
Newbie
*
Offline Offline

Posts: 1



View Profile Personal Message (Offline)
« Reply #5 on: 05-11-2006, 18:26:39 » Reply with quote

I'm liking this hack.
Report to moderator   Logged
Host-Away Web Hosting Company
Jr. Member
**
Offline Offline

TF Base: Linux 2.x
Posts: 89


Host-Away Web Hosting Company



View Profile WWW Email Personal Message (Offline)
« Reply #6 on: 05-12-2006, 06:47:12 » Reply with quote

im not quite sure how to apply this hack please could some one PM me a step by step guide

thank you

--host-away
Report to moderator   Logged

Host-Away Web Hosting Company

====================
   = My TF SERVER INFO  =

Intel Centrino Duo 4GHZ
4GB DDR 2
HDD 1 = 250GB (Westeren Digital SATA)
HDD 2 = 250GB (Seagate SATA)
HDD 3 = 250GB (Westeren Digital)
HDD 4 = LaCie Big Disk Extreme with Triple Interface 1TB (Firewire 800)
100 MBPS Dedicated Line
99.9% Uptime
===
PlymWS
Jr. Member
**
Offline Offline

Posts: 53



View Profile Email Personal Message (Offline)
« Reply #7 on: 05-25-2006, 15:39:33 » Reply with quote

Which file do you perform the first code modification on ?
Report to moderator   Logged
lysip
Jr. Member
**
Offline Offline

Posts: 53


lysip92

View Profile Email Personal Message (Offline)
« Reply #8 on: 05-25-2006, 16:58:20 » Reply with quote

whats the point in this? it kinda leads to wasted bandwidth.
Report to moderator   Logged

CentOS 4.2 (kernel: 2.6.9-22.ELsmp)
TorrentFlux version - 2.1
Python version - 2.4.1
PHP Version - 4.3.9
Webserver software and version - Apache 2.0
Add-ons/Hacks - rememberme, multiup
Niko
Newbie
*
Offline Offline

Posts: 15



View Profile Personal Message (Offline)
« Reply #9 on: 05-27-2006, 18:44:58 » Reply with quote

PlymWS,

grep -H arListTorrent *.php
functions.php:    $arListTorrent = array();
functions.php:            array_push($arListTorrent, $output);
functions.php:    if (sizeof($arListTorrent) > 0)
functions.php:        foreach($arListTorrent as $torrentrow)

So it is somewhere in functions.php
Report to moderator   Logged
PlymWS
Jr. Member
**
Offline Offline

Posts: 53



View Profile Email Personal Message (Offline)
« Reply #10 on: 05-28-2006, 04:56:32 » Reply with quote

Nice one.  Thanks.  Got it working fine now.

Shame I can't get wget to work Sad
Report to moderator   Logged
ghaniba
Newbie
*
Offline Offline

Posts: 3





View Profile Personal Message (Offline)
« Reply #11 on: 06-05-2006, 07:22:53 » Reply with quote

I think I found an issue -- a user (Non admin) cannot delete files with the modified dir.php -- Anyone else find this?  There's a chance I botched something up, but it IS hiding other people's directories as it should.  Thoughts?

-Ghan
Report to moderator   Logged
b4rt
Hero Member
*****
Offline Offline

TF Base: Linux 2.x
Posts: 542



View Profile WWW Email Personal Message (Offline)
« Reply #12 on: 06-05-2006, 07:25:51 » Reply with quote

I think I found an issue -- a user (Non admin) cannot delete files with the modified dir.php -- Anyone else find this?  There's a chance I botched something up, but it IS hiding other people's directories as it should.  Thoughts?

-Ghan

yeah that is a bug in this hack.
its based on the fact the hack alters the php-var $dir which the sanity-check for prevention of deleting data not owned by the user relies on.


regards,
b4rt

Report to moderator   Logged

torrentflux-b4rt svn-trunk
Linux 2.4.34.1, Apache 2.0.59, PHP 4.4.5, Perl 5.8.8, Python 2.5, MySQL 4.1.22
flosoft
Newbie
*
Offline Offline

Posts: 3



View Profile Personal Message (Offline)
« Reply #13 on: 07-02-2006, 08:09:22 » Reply with quote

I think I found an issue -- a user (Non admin) cannot delete files with the modified dir.php -- Anyone else find this?  There's a chance I botched something up, but it IS hiding other people's directories as it should.  Thoughts?

-Ghan

yeah that is a bug in this hack.
its based on the fact the hack alters the php-var $dir which the sanity-check for prevention of deleting data not owned by the user relies on.


regards,
b4rt



It really would be nice if this would be fixed. Any fix would be nice.
Report to moderator   Logged
christian.einarsson
Newbie
*
Offline Offline

TF Base: Linux 2.x
Posts: 1



View Profile Personal Message (Offline)
« Reply #14 on: 09-26-2006, 16:52:11 » Reply with quote

I've made a crude fix to the delete bug in this hack, simply by commenting out the code that checks user identity. I don't know if this opens up any security issues. I just thought naively that if users can't see each others files then they can't delete them even if I remove the checking of identity Roll Eyes

to apply this fix you should find two code sections in dir.php (one is shown below and the other one looks almost the same) and comment-out/delete every thing but the long echo that displays the delete button.

Before:
Code:
                // The following lines of code were suggested by Jody Steele jmlsteele@stfu.ca
                // this is so only the owner of the file(s) or admin can delete
                // only give admins and users who "own" this directory
                // the ability to delete sub directories
                if(IsAdmin($cfg["user"]) || preg_match("/^" . $cfg["user"] . "/",$dir))
                {
                    echo "<a href=\"dir.php?del=".urlencode($dir.$entry)."\" onclick=\"return ConfirmDelete('".addslashes($entry)."')\"><img src=\"\images/delete_on.gif\" width=16 height=16 title=\""._DELETE."\" border=0></a>";
                }
                else
                {
                   echo "&nbsp;";
                }

After:
Code:
                // The following lines of code were suggested by Jody Steele jmlsteele@stfu.ca
                // this is so only the owner of the file(s) or admin can delete
                // only give admins and users who "own" this directory
                // the ability to delete sub directories
//              if(IsAdmin($cfg["user"]) || preg_match("/^" . $cfg["user"] . "/",$dir))
//              {
                    echo "<a href=\"dir.php?del=".urlencode($dir.$entry)."\" onclick=\"return ConfirmDelete('".addslashes($entry)."')\"><img src=\"\images/delete_on.gif\" width=16 height=16 title=\""._DELETE."\" border=0></a>";
//              }
//              else
//              {
//                 echo "&nbsp;";
//              }
Report to moderator   Logged
g4v1n
Newbie
*
Offline Offline

TF Base: Linux 2.x
Posts: 7



View Profile Email Personal Message (Offline)
« Reply #15 on: 10-06-2006, 12:17:14 » Reply with quote

Erm both those thingo's u pasted are the same .. ?
Report to moderator   Logged
g4v1n
Newbie
*
Offline Offline

TF Base: Linux 2.x
Posts: 7



View Profile Email Personal Message (Offline)
« Reply #16 on: 10-06-2006, 12:48:11 » Reply with quote

sorry didnt understand your post

Ok well i got it to work just the icon aint showing

Ive tried all types of HTML and made the link proper and it just shows up wierd :/
Report to moderator   Logged
g4v1n
Newbie
*
Offline Offline

TF Base: Linux 2.x
Posts: 7



View Profile Email Personal Message (Offline)
« Reply #17 on: 10-06-2006, 13:02:36 » Reply with quote

ok got it

Do all the code the first post reccomended

For the last one

Ctrl f and find
Code:
<img src=\"images/tar_down.gif\

That is where you will get taken to the page where is has maketorrent

Directly under neath it leave a space and put
(With editing out all of the line it will be similar to the below)
Code:
echo "<a href=\"dir.php?del=".urlencode($dir.$entry)."\" onclick=\"return ConfirmDelete('".addslashes($entry)."')\"><img src=\"images/delete_on.gif\" width=16 height=16 title=\""._DELETE."\" border=0></a>";

Hope that helps =]
« Last Edit: 10-06-2006, 13:07:45 by g4v1n » Report to moderator   Logged
ghaniba
Newbie
*
Offline Offline

Posts: 3





View Profile Personal Message (Offline)
« Reply #18 on: 10-18-2006, 07:49:08 » Reply with quote

Hmmm, not working in 2.2beta1 yet.  The code still fits but it breaks something.  Just an FYI.

-Ghan
Report to moderator   Logged
legend
Newbie
*
Offline Offline

TF Base: Linux 2.x
Posts: 2





View Profile Personal Message (Offline)
« Reply #19 on: 10-21-2006, 15:20:51 » Reply with quote

what file do you edit in the first post that the user code'd :


What file is this?

Thanks!



Code: (php)

Line 2916
Find:
    if (sizeof($arListTorrent) > 0)
Replace with:
    if ( (sizeof($arListTorrent) > 0) && (IsAdmin() == true) )
Report to moderator   Logged
PaulW
Newbie
*
Offline Offline

TF Base: Linux 2.x
Posts: 1



View Profile Email Personal Message (Offline)
« Reply #20 on: 10-26-2006, 20:09:47 » Reply with quote

Ok, my first post, and a solution to the delete files issue...

Do what is mentioned in the first post, EXCEPT for the modification to the dir.php file!!!

Instead, do this

Code:
FIND (line 34)
$dir = stripslashes(urldecode(getRequestVar('dir')));

AFTER, ADD
// TorrentFlux Admin Mod
if (IsAdmin() == false){
if( substr($dir,0,strlen($cfg['user'])) != $cfg['user'] ){
$dir = $cfg["user"] . "/" . $dir;
}
}

This then just hard-codes the dir variable with the username, and even if you try to type the name of another user in its place, it will still not allow access to other files EXCEPT your own when not admin...

Also, legend, the CODE section your wondering what file its in, look in functions.php

Hope this helps!

Paul
Report to moderator   Logged
joewen7
Newbie
*
Offline Offline

Posts: 7



View Profile Personal Message (Offline)
« Reply #21 on: 05-02-2007, 06:38:22 » Reply with quote

Hi, I've encountered a problem here.

Apparently, it doesn't work if I install this together with the CHMOD Hack, found here.

http://www.torrentflux.com/forum/index.php/topic,242.0/all.html

I used the one posted all the way at the bottom, which works for TF2.3. It just doesn't want to work together with the CHMOD hack. It works fine on its own or with other hacks. lol.

Any ideas, anyone?
Report to moderator   Logged
xon
Newbie
*
Offline Offline

Posts: 1



View Profile Personal Message (Offline)
« Reply #22 on: 05-23-2007, 05:54:43 » Reply with quote

what file do you edit in the first post that the user code'd :


What file is this?

Thanks!



Code: (php)

Line 2916
Find:
    if (sizeof($arListTorrent) > 0)
Replace with:
    if ( (sizeof($arListTorrent) > 0) && (IsAdmin() == true) )

-function.php-

The file is quite shorter than it was in an earlier version of TF.
I changed it a few minutes ago and it works like a charm Smiley

THANKS!

xon
Report to moderator   Logged
Pages: 1 2 [All] Go Up Reply Notify of replies Send this topic Print 
« previous next »
Jump to:  


Powered by MySQL Powered by SMF 1.1.1 | SMF © 2006, Simple Machines LLC Powered by PHP