UnamSanctam / UnamWebPanel

MIT License
174 stars 58 forks source link

Database security #174

Open qmada opened 2 years ago

qmada commented 2 years ago

If my page cant be found then my database is secured? what do i have to do to disable it?

UnamSanctam commented 2 years ago

Yes if they cannot access your database file then they won't be able to access it.

qmada commented 2 years ago

how do i disable my security?

UnamSanctam commented 2 years ago

You mean how to make it so that everyone can access the file? If you're using Apache then you can disable it by editing the .htaccess file and removing the whole <FilesMatch> block (line 2 to 4).

qmada commented 2 years ago

image I cant open .htaccess file.

UnamSanctam commented 2 years ago

Open the .htaccess file with a text editor and change it. If it's on a remote webserver then you can first download the .htaccess file, then edit it and then upload it again.

qmada commented 2 years ago

i did it, nothing changed

UnamSanctam commented 2 years ago

Then it might be an IIS server, in that case you can just delete the web.config file.

qmada commented 2 years ago

deleted it, still nothing

UnamSanctam commented 2 years ago

Then you didn't modify the .htaccess folder correctly, those two are the only files that limit access to the database file. Unless your webhost itself somehow blocks all .db files from being accessed.

UnamSanctam commented 2 years ago

There could also be a .htaccess file inside the db folder as well if you didn't edit/remove that (if there is then you can remove that), I'm not currently at my computer so I can't check if there is.

qmada commented 2 years ago

why cant i load folders into public html?

qmada commented 2 years ago

can i just copy files without folders?

UnamSanctam commented 2 years ago

It depends on how you upload things, some built-in webhost file managers aren't very good. I would recommend using either FTP or seeing if you can extract .zip files in your file manager.

But to disable the .db protection first edit the .htaccess in the main folder and remove the lines (line 2 to 4), then remove the web.config file and then finally remove the .htaccess file inside the db folder if there is a .htaccess there. That should be enough.

qmada commented 2 years ago

all these files should be in their folders because when moved the db file directly to the public_html folder /unamwebpanel.db worked, it was just a white screen.

UnamSanctam commented 2 years ago

Yes all files need to be in their respective folders, but you can usually create folders inside the webhost file manager and copy individual files into that which was what I meant. Easiest way to upload is usually via FTP or .zip extraction if supported.

qmada commented 2 years ago

yeah i extracted them in their respective folders, but it was only working when i put db into publilc_html

UnamSanctam commented 2 years ago

Yes everything needs to look like this https://github.com/UnamSanctam/UnamWebPanel/tree/master/UnamWebPanel (folders and files) for it to work.

qmada commented 2 years ago

image yes everything looks fine, but not working

UnamSanctam commented 2 years ago

What isn't working, the webpanel or trying to disable the database security?

qmada commented 2 years ago

i cant go to mysite.com/unamwebpanel.db

UnamSanctam commented 2 years ago

You mean mysite.com/db/unamwebpanel.db? Is it still forbidden?

qmada commented 2 years ago

oh, yeah i forgot that i put it back into the folder. Its working now its just a white screen

qmada commented 2 years ago

cant see the login screen when i go to my site just a white screen. What should i do? PHP version is 8

UnamSanctam commented 2 years ago

Well your file sizes don't look correct in your latest screenshot, open up the files in the file manager there and see what they contain.

qmada commented 2 years ago

i have an error and i cant find logs in the unam lib folder. chrome says my site is deceptive

UnamSanctam commented 2 years ago

Which error? And Chrome "malicious/deceptive" site detection is based on URLs usually, so your URL has been scanned/reported and placed into a blacklist. Though that won't affect the miner in any way.

qmada commented 2 years ago

application error

UnamSanctam commented 2 years ago

Then it sounds like not all files have been uploaded correctly.

qmada commented 2 years ago

image Everything seems to be on the place

UnamSanctam commented 2 years ago

Then it should be working, for 000webhost (which it looks like you might be using) then all you need to do for it to work is to 1) Change PHP version to 7.4 or above 2) Upload all the files Then everything will work.

qmada commented 2 years ago

yes, ty. When i copied all these files the original .htaccess file was missing