security problem (1 Viewer)

Wiedmann

Portal Pro
June 22, 2007
107
28
Home Country
Germany Germany
Hello all,

I think there is a problem with the MPWebServices, especially if it is accessible from the Internet:

If you go to "http://mediaportal:81/" with your browser, you must logon with username/password. But this user/password is stored in the file "config.xml", which is accessible with "http://mediaportal:81/config.xml" and without any security check...

(Well, If someone can watch TV is not the big problem. But personal videos/pictures are also available with the MPWebServices ;-) )
 

OnkelChris

Retired Team Member
  • Premium Supporter
  • October 17, 2007
    764
    59
    Home Country
    Germany Germany
    AW: security problem

    I hope gemx isn't angry about this.... ;)


    if you want to get rid of this "security-problem" then do the following:

    1. Replace your "MPWebServices\htdocs\App_Code\Utils.cs" with the one attached
    2. Copy your config.xml to your TVserver plugins dir (same folder as MPWebServices.dll)
    3. try to acces config.xml through browser ;)

    enjoy

    EDIT:
    forgot to mention: if you edit your settings inside tvserver plugin section, you have to repeat step #2. i won't rebuild the tvserver plugin, because i compile against the newest SVN for my needs...
    and if i would do, there would be another version out there which makes it hard to solve problems... ;)
     

    Attachments

    • Utils.zip
      1.5 KB

    Users who are viewing this thread

    Top Bottom