[meissenation]

My "harshness" is not directed at the coder. It would be nice if he could pop in and let us know he got the e-mail and plans to fix it or not, but again my main frustration is that vB.org staff found the flaw and I know they have competent coders on their team that could fix it in a handful of minutes if they wanted to.

In other modifications on this site, you will routinely see people other than the developer offering file edits to slightly modify or enhance a product. Fixing the security flaw in this product should be no different. I know we don't want to "give away" what the security risk is to allow the modification be exploited even more easily, but can't the vb.org staff that know what the flaw is just fix the bad line(s) of code and then attach the updated file so we can all move on? It's just frustrating that there are people on this site that know what the flaw is, know how to fix it, and yet just sit back saying "Well, too bad - it's the developer's problem to fix, not mine..."