[popowich]

A special e-mail should have gone out for this issue a long time ago!

Is there a similar feature that is more regularly maintained?

Are there any other known issues besides this post?

-Raymond

Originally Posted by georgedd

BTW, I've gone ahead and fixed the "non entity" bug I reported above. For those interested, inside topxstats.php (or edit directly in vbulletin control panel), find the lines:

		else
		{
			$getstats_thread[titletrimmed] = $getstats_thread[title];
		}
	}

and add beneath it one extra line:

		else
		{
			$getstats_thread[titletrimmed] = $getstats_thread[title];
		}
	}
	$getstats_thread[titletrimmed]=htmlspecialchars($getstats_thread[titletrimmed]);

Also, inside the template "topXstats_thread_bit", find:

title="<phrase 1="$getstats_thread[title]"

and change that to:

title="<phrase 1="$getstats_thread[titletrimmed]">

I highly recommend you implement the above changes or changes of your own. Otherwise, someone can execute arbitrary JavaScript code on your site just by entering as the title of a thread the script, such as:

<script>alert("hi")</script>