Codezwiz >> Forums >> General PHP Nuke Help >> WOW! Please, really need help with this inline frame module

Hello,

The first section is the module. I have read sevral websites on posts on this and the php nuke section manual and it still wont work. Im using phpnuke7.9. I have double checked the speling so i dont know whee to go from here. I heard the was a change in the mainfile.php so i did that change and still nothing. That change for teh mainfile.php is after the module one.

Thanks and would appeciate any help

<?
if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {
die ("You can't access this file directly...");
}
if(!IsSet($mainfile)) { include ("mainfile.php"); }
$index=0;
$theme="Tobacco";
$go_to_address1="http://www.usacollectiblesonline.com/EN-Book/index.html";
$go_to_address=rawurldecode($go_to_address1);
include("header.php");
OpenTable();
echo "<center><h4><a href=\"index.php\">Click to close.</a></h4></center>";
echo "<iframe SRC=\"".$go_to_address."\" width=\"100%\" height=\"1200\"
framespacing=0 frameborder=no border=0 scrolling=auto></iframe>";
echo " <center>NB. Using iframes!</center> ";
CloseTable();
include("footer.php");
die;
?>

--------------------------------------------------------------------------------------
The change made for the mainfile.php which said i by passed some securty file,.ssx or somethign like that was suppost to make inline frames work. Also i know inline frames wont work in some broowsers bu im running the latest IE and it wiorks in that. anyway heres the change
---------
from this
---------
}

// Die message for not allowed HTML tags
$htmltags = "<center><img src=\"images/logo.gif\"> ";
$htmltags .= "The html tags you attempted to use are not allowed ";
$htmltags .= "[ <a href=\"javascript:history.go(-1)\">Go Back</a> ]";

// Die message for empty HTTP_REFERER
$posttags = "Warning: your browser doesn't send the HTTP_REFERER header to the website. ";
$posttags .= "This can be caused due to your browser, using a proxy server or your firewall. ";
$posttags .= "Please change browser or turn off the use of a proxy ";
$posttags .= "or turn off the 'Deny servers to trace web browsing' in your firewall ";
$posttags .= "and you shouldn't have problems when sending a POST on this website.";

if (!defined('ADMIN_FILE')) {
foreach ($_GET as $sec_key => $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*body*\"?[^>]*>", $secvalue)) ||
(eregi("$[^>]*\"?[^)]*$", $secvalue)) ||
(eregi("\"", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key))) {
die ($htmltags);
}
}

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
die ($htmltags);
}
}
}

--------
to this
----------
if(isset($admin))
{
$admin = base64_decode($admin);
$admin = addslashes($admin);
$admin = base64_encode($admin);
}

if(isset($user))
{
$user = base64_decode($user);
$user = addslashes($user);
$user = base64_encode($user);
}

// Die message for not allowed HTML tags
$htmltags = "<center><img src=\"images/logo.gif\"> ";
$htmltags .= "The html tags you attempted to use are not allowed ";
$htmltags .= "[ <a href=\"javascript:history.go(-1)\">Go Back</a> ]";

// Die message for empty HTTP_REFERER
$posttags = "Warning: your browser doesn't send the HTTP_REFERER header to the website. ";
$posttags .= "This can be caused due to your browser, using a proxy server or your firewall. ";
$posttags .= "Please change browser or turn off the use of a proxy ";
$posttags .= "or turn off the 'Deny servers to trace web browsing' in your firewall ";
$posttags .= "and you shouldn't have problems when sending a POST on this website.";

if (!defined('ADMIN_FILE')) {
foreach ($_GET as $sec_key => $secvalue) {
if((eregi("<[^>]*script*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*onmouseover *\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*body *\"?[^>]*",
$secvalue)) ||
(eregi("$[^>]*\"?[^)]*$", $secvalue)) ||
(eregi("\"", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key)))
{
die ($htmltags);
}

}

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*iframe*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*onmouseover*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]script*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]*body*\"?[^>]*",
$secvalue)) ||
(eregi("<[^>]style*\"?[^>]*",
$secvalue)))
{
die ($htmltags);
}
}
}