Does the edit function work after the update? if so i must be pure stupid as i cant figure out how to edit a shout by one of my users - edit found it :D

Hi @ll,

have executed the Security fixed, don't know if its linked to my Issue :

A User is using bbcode in the Shout like

[img ] link to an image with a .htaccess protected folder [/IMG ]

So then all Users getting to Popup to Enter Username and Password. This could be also a security Risk .....

How i can handle this, should i disallow bbcode in the Shoutbox ?

th@nks

Thats not a direct security risk anyone can control, anyone could post a picture to an image thats behind htaccess on anywhere you allow the image bbcode.

So then the Smiley Function is not working anymore, because you have to deactivate the vBCode/Smilies Function.

Any possiblity to disallow the external linking in the Shoutbox ?

ok maybe they will answer this time...

ok i see brad posted a fix but wasnt this a exploit too in it 'shout' => TYPE_STR, as per this post https://vborg.vbsupport.ru/showp...postcount=1192 or does brads update fix this?

i have it loaded on my site all it says is Loading and never does whats the deal?

I got probem after updating the vbshout_fix . I can not type " ... " anymore . The quotation mark doesn't work , please check it out !!!

Lol you can always tell the people that don't read before they post. They're looking into it, it has to do html not being allowed. Just scan some previous posts, it's all there.

It didn't happen with orginal vbshout 2 on my board !!

Yes my update fixes that issue, although it does not restrict input to NOHTML, it simply cleans it when it's called from the database.

My update fixed only one problem and that was allowing users to inject html. :)

Strip_tags will give you results that are just as bad. For example try posting this in the shoutbox "& <-- no &amp;" this will display "&" because everything after < is stripped.

Update

I've uploaded a new version of this hack, dubbed '2.0.2'. This one should fix the issues without breaking special characters. To upgrade, download the new zip file and upload the new vbshout.php file.

Please note that this only fixes the html injection issues. I do not use this hack on my own forum (although I've tested this on a client's board) so I will not be fixing the server load issues. I suggest you do not install this hack if you can't deal with the extra server load, as it's rather intensive.