vb.org Archive - vBulletin Security Patch for vBulletin 4.1.12 for Suite & Forum

vBulletin has released a security patch to improve the security of the vBulletin 4 MAPI for 4.1.12 Suite & Forum as the result of a recent internal security review. Although no exploits have been reported, we urge our customers to upgrade as soon as possible.

The changes do not affect vBulletin 4.0.0 - 4.1.1.

This patch has been issued for vBulletin 4.1.12. A separate set of patches have been issued for vBulletin 4.1.2 - 4.1.11.

The MAPI security improvements have been added for vBulletin 3.x with the release of 3.x MAPI 1.4.3.

To improve the security of your vBulletin 4 installation, please download the patch from the members area of vBulletin: http://members.vbulletin.com/

In addition to the security improvements, we've resolved the following 4.1.12 issues.

VBIV-14742 - Push notifications broken in FR 4.1.12 add-on.
VBIV-14685 - Tag in static page cause Fatal error on page with General Search widget set to return Static Pages
VBIV-14663 - Quoting doesn't work in the mobile style
VBIV-14660 - Static HTML in CMS always displays all content
VBIV-14754 - unset($VB_API_PARAMS_TO_VERIFY['vbseourl']) to match vB3 MAPI change.
VBIV-14681 - HTML is stripped from article previews
VBIV-14667 - Category pages do not load if using basic/advanced friendly URLs

The upgrade process is slightly more complicated for this patch level release.

Download PL1 for vBulletin 4.1.12 from https://members.vbulletin.com.
Upload the patch do your server.
Unzip the patch to your vBulletin 4 install directory. (Ex. /var/www/html/myforum)
Run ./install/upgrade.php. (Required for 4.1.12.)
Download the "API-Log-Clean.xml" attached to this thread. (Included in the do_not_upload folder for full installs.)
Import "API-Log-Clean.xml" using the "Manage Products" interface in the "Plugins & Products" section of your Admin CP. The cleanup script will run on install. AdminCP -> Plugins & Products -> Manage Products -> Add/Import Product
Delete "API-Log-Clean" using the "Product Manager" option in the "Plugins & Products" section of your Admin CP. (Optional. The product is automatically disabled after the script runs.)

Advanced Users - Files updated in the patch are:

/api.php
/forumrunner/push.php
/includes/class_friendly_url.php
/includes/init.php
/install/vbulletin-mobile-style-blog.xml
/install/vbulletin-mobile-style.xml
/packages/vbcms/content/phpeval.php
/packages/vbcms/content/staticpage.php
/packages/vbcms/item/content/article.php
/packages/vbcms/item/content/phpeval.php
/packages/vbcms/search/result/staticpage.php

Please note that this issue and fix affects BOTH vBulletin 4 SUITE and FORUM.

Discuss the security patch - HERE

Discuss vBulletin 4.1.12 - HERE
Attached Files

https://www.vbulletin.com/forum/images/attach/xml.gif API-Log-Clean.xml&lrm; (1.9 KB)

More...

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.04085 seconds Memory Usage 1,718KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (1)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: