hello

im trying to understand how to protected my hcl ap against users that know hcl.

example:
i dont need to be logged to upload a file with sucess....

if i try to go direct to this urls. 
http://mydomain.com/hcl/live/chat/admin.php

or

http://mydomain.com/hcl/live/chat/upload.php (here its possible to upload files without be logged)

or

http://mydomain.com/hcl/live/chat/display.php (here the display aparently shows the last conversation trasncrption)

what can i do fix this permissions bugs

thanks

You know what, I noticed this also, and for me.. Im finding that HCL is just not right for what I want.
This is a terrible bug, and the fact that I cant even get HCL to work on a normal install just stops me from wanting to trying fixing it anymore. I'm sure a lot of other users are not having as much trouble as I am so for them HCL can be great, unfortunately I'm uninstalling it and looking for something else.

ok. im tryng to fix this @#$@ing bug....

im not php expert, i prefere .net/java...

but with some help i create one include that maybe fix this problem...

so here we go...

1-  with some help i create in class folder one file called valida.php with following code

<?
//special thanks to lfcosta that helps me to understant a little bit php

if(!isset($_SESSION['hcl_username']) || $_SESSION['hcl_username'] == ""){
   header("Location: /root/mysite/hcl/admin/login.php");
   exit;
   }
?>


2- so how i say i?m not expert in php... so this code can be ajusted... the objetive of this code is just to check one more time, if exist something in variable username ... so if exist we presume the user is logged....


3- then we put this  include in the end of all files located in hcl/live/chat folder

exempla:

   // do events that need to be done at the end of the file
    $inc->finished();

// lets check if exist some user logged with our new include
     require('../../class/valida.php');

thats is it...

4 - now when user not logged try to acess direclty the files located in hcl/live/chat folder he was redirected to login page


aparently dont affect anything in system. but solve the problem...... if someone have a better solution please tell me here

thanks and good luck