Vwar + XenForo

[Aj_]

Hello everyone,

Finally i have registered to this awesome website, i was trying to say that vwar is vulnerable to hack see it for yourself Here and here.

To overcome this im trying to use the xenforo login system to outcome this issue and hide the main folder of vwar.

But i have a little problem before doing this, first im trying to do the same thing you guys did for your vwar pages that is included nicely to xenforo, but seriously how did you do that.

Step by step is much appreciated.

Thank you.

 

[RobinHood]

Hi Aj, welcome to the site and thanks for not testing out those hacks on us!

Storm3y on the forum actually helped me out with the original vWar integration, and I'm sure he'll correct me if I'm wrong but I believe the steps went something along these lines:

1. Go ahead and setup vWar on your server including creating it's own DB (although I believe you could also integrate it in the XF DB if you want to to consolidate them).
2. Head to the ACP -> Applications -> Display Node Tree -> Create New Node, then create a main page for the vWar home, then child pages for each of the additional vWar pages as below:

3. ^ For each XF page, insert an iframe which will display the corresponding vWar page within it.

4. Once they're all setup you need to insert the links into the nav bar, which you can do by editing the navigation template. Head there by going to ACP -> Appearance -> Templates, then search for 'navigation' and select the corresponding template.

5. You can then insert the following code to display the links to your new forum pages on the nav bar:

I hope that helps

 

[sjc2tk]

the dates on the reported hack is 2006 that is 5 years old, maybe it is better to contact vwars maybe they have already patched the security problem already.

Also maybe it is possible to change security permissions so that vwars is only possible to be seen by full members perhaps by creating a different class for full members.... i am not fully up to speed with this forum yet .... but i am in the process of creating this forum on my server and creating a test site .... see if i can help

 

[RobinHood]

Yeah, good call, setting permissions to be able to view it might work. I'll have a look into that. I'd still be very interested to see if anyone is is able to integrate the registration of XF into vWars. Multiple logins on the same site is a bit of a pain.

Have your purchased a licence SJ? If not, let me know and I'll send you my files to mess with if it's just for private dev use.

 

[FFFShooter]

Yes we did get hack a couple of times a number of years back now and it totally fooked the site up,..

 

[RobinHood]

We have set backups to run regularly in the event of it happening, but prevention is always better than fixing after the fact.

 

[Aj_]

Sorry guys for late reply, heres a fix for your problem and no one will be able to hack your vwar anymore

upload to your vwar folder this .htaccess

RemoveHandler .phtml  .php3 .php4 .php5 .php6 .phps .cgi .exe .pl .asp .aspx .shtml .shtm .fcgi .fpl .jsp .htm  .wml
AddType application/x-httpd-php-source .phtml  .php3 .php4 .php5 .php6 .phps .cgi .exe .pl .asp .aspx .shtml .shtm .fcgi .fpl .jsp .htm  .wml

<IfModule mod_rewrite.c>

RewriteEngine On

# Uncomment and properly set the RewriteBase if the rewrite rules are not working properly
#RewriteBase /

RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule .* nofile.gif [L]

</IfModule>

and upload the following file

you will be able to use iframe but no one will be able to visit that directory of vwar anymore only the files.

Im working on merging the login info but in the mean time its on hold until further notice, keep gaming guys