[X-Files]

Is this what we need to patch this? Can someone provide a definitive answer? I think this version at least needs a fix applied since we have no idea when v2 will be out.

Originally Posted by Acers

Just changes the the php function with vb's own cleaning class.

includes/function_vbplaza.php(line 152)

PHP Code:

$message = strip_tags($message); 


make that

PHP Code:

$message = $vbulletin->input->clean($message, TYPE_NOHTML); 


go to
vbplaza/action.admindonate.php (line 133)

PHP Code:

$action['reason'] = strip_tags($action['reason']); 


make that

PHP Code:

$action['reason'] = $vbulletin->input->clean($action['reason'], TYPE_NOHTML); 


goto
vbplaza/action.changeotherusertitle.php (line 136)

PHP Code:

$newusertitle_stripped = strip_tags($newusertitle); 


make that

PHP Code:

$newusertitle_stripped = $vbulletin->input->clean($newusertitle, TYPE_NOHTML); 


goto
vbplaza/action.changeusertitle.php (line 87)

PHP Code:

$newusertitle_stripped = strip_tags($newusertitle); 


make that

PHP Code:

$newusertitle_stripped = $vbulletin->input->clean($newusertitle, TYPE_NOHTML); 


goto
vbplaza/action.donate.php (line 164)

PHP Code:

$action['reason'] = strip_tags($action['reason']); 


make that

PHP Code:

$action['reason'] = $vbulletin->input->clean($action['reason'], TYPE_NOHTML); 


goto
vbplaza/action.gift.php (line 209)

PHP Code:

$action['giftmessage'] = strip_tags($action['giftmessage']); 


make that

PHP Code:

$action['giftmessage'] = $vbulletin->input->clean($action['giftmessage'], TYPE_NOHTML); 


goto
vbplaza/action.ribbons.php (line 218)

PHP Code:

$action['ribbonmessage'] = strip_tags($action['ribbonmessage']); 


make that

PHP Code:

$action['ribbonmessage'] = $vbulletin->input->clean($action['ribbonmessage'], TYPE_NOHTML);