Re: Security and Model Validation Questions

Are you sure someone is actually gaining access to your database? If
they were, I would expect them to do a lot worse than create some
blank records in your user table.

It is possible you have a form somewhere in your app for a model that
is related to User, but are not including User.id field in the form.
If so when you update that record using this form it will create a
blank record in the User table.

HTH, Paul.

On Aug 19, 2:56 am, andrewperk <andrewp...@gmail.com> wrote:
> Hi again, it appears that this did not fix the problem. He's still
> gaining database access.
>
> I've changed my core.php debug to 0. I also changed the password of my
> database. I've checked my server to make sure its not displaying php
> errors. I'm using the security component. I'm on Cake 1.3.10. I'm in
> the process of upgrading my cake folder to 1.3.11 right now.
>
> But yet, even after these changes this person has again somehow gotten
> access to my database. He's inserting users with all fields of the
> user table set to NULL and marking himself as a premium member(its one
> of my fields in the user table). He doesn't give himself a username or
> password so he can't actually log in and abuse my system. He's just
> got access to my database somehow.
>
> I'm not sure how to figure out how he's doing this. Does anyone have
> any ideas? If you need me to paste some code please let me know and
> I'll provide it, as I'm not sure where the error might lie.
>
> Thanks for any help.
>
> On Aug 13, 8:57 am, euromark <dereurom...@googlemail.com> wrote:
>
>
>
>
>
>
>
> > yes, withsecuritycomponent this is not possible.
> > but ceeram is right about the password displayed.
>
> > On 13 Aug., 01:13, andrewperk <andrewp...@gmail.com> wrote:
>
> > > The username and password is specific to just that database luckily.
> > > I've changed the information. Thanks Ceeram.
>
> > > On Aug 12, 3:51 pm, Ceeram <c33...@gmail.com> wrote:
>
> > > > with debug on, and there is an error with db connection, it will show db
> > > > login credentials (this is changed in latest versions), so they probably
> > > > accessed the db itself, is the user allowed for all hosts on the db or just
> > > > local?

--
Our newest site for the community: CakePHP Video Tutorials http://tv.cakephp.org
Check out the new CakePHP Questions site http://ask.cakephp.org and help others with their CakePHP related questions.

To unsubscribe from this group, send email to
cake-php+unsubscribe@googlegroups.com For more options, visit this group at http://groups.google.com/group/cake-php