[Jamsoft]

Hey guys,

I installed this on our forums, and wouldnt you know that our users found a vulnerability almost right away.

Seems that if the users put any HTML or JAVA code inside the comments, it actually renders when the page loads. For example:

Rich agrees: Sounds good <script>alert('hi');</script>

Makes a java window pop open and say hi...

Im sure I dont have to tell you what a malicious hacker can do with something like this.

So, I'd propose this fix to the existing code. Inside the functions_showthread.php, find this code:

			// START PUBLIC DISPLAY OF AFFECTION hack			
			if ($forum['showaffection'])
			{
				$post['affection']="";
				$repcount=0;
				if ($reps = $DB_site->query("SELECT reputation.reputation,reputation.whoadded,reputation.reason,user.username 
											FROM " . TABLE_PREFIX . "reputation 
											LEFT JOIN " . TABLE_PREFIX . "user ON reputation.whoadded=user.userid 
											WHERE reputation.reputation!=0 AND postid='".$post['postid']."'"))
				{
					while ($rep = $DB_site->fetch_array($reps))
					{
						eval('$post[\'affectionbits\'] .= "' . fetch_template('postbit_affectionbit') . '";');
						$repcount++;
					}
					if ($repcount)
					{
						//echo "2";
						eval('$post[\'affection\'] .= "' . fetch_template('postbit_affection') . '";');
					} 
					else
					{	
						//echo "3";
						$post['affection']="";
					}
				}
			}
			// END PUBLIC DISPLAY OF AFFECTION hack

BEFORE the line:

eval('$post[\'affectionbits\'] .= "' . fetch_template('postbit_affectionbit') . '";');

Add this code:

// Fix for HTML entities
$rep[reason] = htmlentities($rep[reason]);

That will protect us from this issue.

Other than that, this is a great hack. Im using it on 3.0.6 on 5 forums...