Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - bmartino1

Pages: 1 2 [3] 4 5 ... 59
31
HFS ~ HTTP File Server / Re: Start HFS as a service
« on: July 22, 2019, 04:11:54 PM »
Forgive me ... you could explain to me how to do what you suggested, that is

..if you use the service option hfs needs the ini saved to file to run from a batch script that runs from a user account.

Thanks

you have to launch the hfs interface and tell ot to save to file
see dany explanation here:

http://rejetto.com/forum/index.php?topic=11942.msg1064782#msg1064782

and old hfs as service post here:
http://rejetto.com/forum/index.php?topic=4713.msg1059183#msg1059183


32
HFS ~ HTTP File Server / Re: Start HFS as a service
« on: July 22, 2019, 02:03:36 AM »
i had to do a schedule task and a startup script witch would logon to the user and lock that account.

if you use the service option hfs needs the ini saved to file to run from a batch script that runs from a user account.

33
HFS ~ HTTP File Server / Re: HFS including SSl tools
« on: July 16, 2019, 06:38:02 PM »
yes that is normal

that is due to public generate ssl certificate and a issue on the web to sign your certificate. you have to pay a company to sign a certificate ssl key for use in stunnel to remove that message.

https://www.sslshopper.com/ssl-checker.html

https://serverfault.com/questions/177971/how-to-trust-my-own-self-signed-ssl-cert

the fact that you hot the https error cert tell me stunnel is configured properly and working.





34
HFS ~ HTTP File Server / Re: HFS including SSl tools
« on: July 16, 2019, 04:31:25 PM »
i forgot say - my system is windows 10. Port in my settings 84. I try copy and launch program with my settins on virtual win xp. Its ok. stunnel working. In my win10 not(

stunnel errored die to port 443 in use. 0rograms such as slype and teamvoew need a settong chges

Binding service [https] to 0.0.0.0:443: Address already in use (WSAEADDRINUSE) (10048)

this is why it failed

https://answers.microsoft.com/en-us/skype/forum/all/how-do-i-stop-skype-from-using-port-80-and-443-for/fa980ca8-f732-416b-927d-1b854a850820

35
That might take a while--Can you recommend a website that seems effective at teaching me how to read javascript?

w3 schools???

https://www.w3schools.com/jsref/event_oncontextmenu.asp

https://www.w3schools.com/js/

36
HFS ~ HTTP File Server / Re: Anything > 2.2f doesn't show the gui
« on: July 01, 2019, 10:48:49 PM »
where you on a previous windows 10 build before the change?
such as update form buil 1709 to 1809?

ive see some upgrade issues with registry and profile setting

id recommend making a new user account and trying running hfs under that new user as a test.if it works there an issue with the uiser profile form the upgrade

i have no other idea why hfs older version works but the newer version doesn't...
Id recommend a fresh windows install...



37
Bug reports / Re: CVE-2014-6287 False Positive
« on: June 28, 2019, 05:57:37 PM »
yes Mars, i'm on the road a tad to much these days for construction in the states.
most of my time and comments are from a phone.

My apologies. Any ways here is what Im trying to say:

Anyone aware of this problem and is there a way to mitigate this ?
according to Checkpoint advisory cpai-2019-0748  and mitre.org CVE ID CVE-2014-6287

Seems an old bug that emerged again. (?)

So, I follow the "cve" and pay close attention to the cve reports and the comments and there responses here...
Most CVE reports regarding HFS as they are filed respond to older version regarding hfs 2.3b that had a bad template and base code in witch you could use machine code such as the null byte to do some command execution to the pc remotely...  This is one of those reports and as it has been fixed,patched and the stable is not affected by that report, i see no problem. I'm aware of a Security con that a Professor using HFS in a virtual machine to show how web browsing security works and he uses the hfs 2.3b version in his class and study for ethical hacking...

those are some of his reports which is why it looks like a false postie duplication, because the same info is added into the 2014 version of the cve in witch with rejeto responded too and patched/fixed.

the orginal CVE remote execution bug was a problem that from my understanding lied on the default hfs template, in witch a user can still (???potentialy use a bad template) and be affected. the stable default template (Some good users template such as DJ and Danny works) are all stable and don't exhibit bugs in this way.

It may be possible in the current version of hfs with that bad template that one might be able or can get similar remote execution.
I have not been able to replicate that issue since the patch version 2.3 h i believe...

Since then this CVE report is from a new Av pick up on the macro and its find in the the ".execute" macro command...

I was trying to find the original source and there test because it claims that there is still a issue in the pascal lib file that stable version of hfs uses...

*but from what i can find there is no remote execution issue with the latest default template and a fresh download of the current hfs version 2.3 m

The CVE reported a version "2.3 x" in the orginal report ??? so the beta might be being tested as a stable... atm idk as im doing more research on it

----------------------------------------------

For all CVE repotr both new and old see here:

https://www.cvedetails.com/vulnerability-list/vendor_id-14180/Rejetto.html

to be clear the CVE that you are inquiring on is in regards to 2.3 b a bad version of hfs that does exhibit the remote execution code and atm as far as i can tell is only available via source compilation.

Qute from the CVE
"2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action."

to be clear This doesn't affect hfs version 2.3 m, and i believe it was a late post reply in regard to the old CVE report

----------------
@ to whom it may concern

you could adjust mime types to disallow the execution of file such as *.exe and what not via adding a mimetype and using "text/html"

or subtype for scripts to run: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types

38
HTML & templates / Re: Responsive small screen template
« on: June 22, 2019, 10:03:02 PM »
Yes, it's true. I'm glad you also found this error. I've already reported that "hfs.diff.tpl" doesn't work on root HERE, but I didn't get any reply about it. The normal behavior is that "hfs.diff.tpl" should work on root too. I hope Rejetto get attention to this.

looks like you guys may have already answered or solved it. ive foi d that if you dont bind folder to root.

so hfs main directory tree 8s set to a primary folder and dif tpl is i  that folder.

39
HFS ~ HTTP File Server / Re: Access problems
« on: June 20, 2019, 07:48:50 PM »
are both hfs using the same port?

on main pc make sure the port is set to 8080

on backup pc make sure it port os set to 80

id have you read through and double check your network settings

http://rejetto.com/forum/index.php?topic=11540.msg1059916#msg1059916


40
while i recommend upgrading to the stable version hfs

ive found these application memory errors to be hardware error.
event viewer would help diagnosis it further, but the latest versions will help.mogitagte the issue

41
Beta / Re: version 2.4
« on: June 12, 2019, 07:53:47 PM »
Is it possible to add an option to block not just by IP but also to block by user agent in case it's identidied?
For example if I want users to be able to download from Chrome but not from Firefox ?

only thing o can think of 9s a hyml web redirect.

2-3 problems

1 you can use html/jQuery to find what browser has connect to your server:

https://stackoverflow.com/questions/12089942/php-html-css-if-firefox-if-chrome-if-safari

ex
Code: [Select]
   // Safari CSS and Webkit Google Chrome
if ($.browser.webkit) {
   $("#element").css('top', '2px');
} else if ( $.browser.safari ) //not fully supported on 1.7 jQuery {
   $("#element").css('top', '2px');
// Opera CSS
} else if ( $.browser.opera ) {
   $("#element").css('top', '2px');
// Internet Explorer CSS
} else if ( $.browser.msie ) {
   $("#element").css('top', '2px');
// Mozilla FireFox CSS
} else if ( $.browser.mozilla ) {
   $("#element").css('top', '2px');
// Normal Revert, careful and note your the use of !important
} else {
   $("#element").css('top', '2px');
   // You can have normal JavaScript between these too
   document.getElementById("element").style.top="2px";

the above will edit css based on browser

2, last i checked the latest chrome usses Firefox web agent, so theres no guarantee for that browser

3  hfs built in block level is at the protcal level not html browser level

html code

ex to stop ie from html visit

https://www.quora.com/Is-there-a-way-to-block-Internet-Explorer-from-my-website-using-HTML-If-so-is-there-a-way-to-modify-that-code-for-other-browsers

42
Thanks.  But, there's no sound.  What form of clickable link allows the end user to achieve playback? 

It immediately caused 5 Gigabytes of traffic, but it didn't play any of them.

Need to avoid downloads unless the play button is clicked.
After the play button is clicked then it would be nice to download/play one at a time (not all at once).

that sounds like a mime type issue
is the mime type defined and is it set to open directly in browser?

https://images.app.goo.gl/R5EBCrYXcigQxWTP8

http://rejetto.com/forum/index.php?topic=11400.msg1059164#msg1059164

43
I wonder if this is possible:  An icon to shuffle play all mp3's in the current folder?   
That's an awesome old-school feature that has been lost over time.

we have to generate the m3u file via script pulled from macro item-modifed.

somehow we would have to tell a flash player or other html video player the contents of a file folder via URL.

mby look into jplayer

https://stackoverflow.com/questions/14854271/jplayer-create-dynamic-playlist-based-on-files-in-folder

44
??? what casued this was a additon of code that no longer alows for that code to run. we would need you template or html code to further diagnose

45
Bug reports / Re: HFS not able to start.
« on: April 29, 2019, 03:50:16 PM »
@Explorare

unfortuanlely this is a windows build beta issue adn only a windows option atm is the fix. as reported form are from poster user, he was able to geta workaround via turning off the win 10 betat utf-8

Control panel > region settin > administrative tab > admin systeym chage for non -unicode > unchek box if check.
see picture

Apologies for the post on a older thread. I had this issue.
A working fix (on Windows 10 1809) was to disable the "Beta: Use Unicode UTF-8 for worldwide language support" in Windows Region Settings.
(found under Region -> Administrative tab -> Language for non-Unicode programs -> Change system locale... -> Checkbox - Beta: Use Unicode UTF-8 for worldwide language support)

Pages: 1 2 [3] 4 5 ... 59