[AN-net]

XSS Vulnerability Patched!

All running Beta 1 prior to 11/19/05 are strongly encouraged to apply this patch or download the updated file then overwrite.

To patch this security risk find the following in journal.php(Find and Replace All Instaces):

PHP Code:

$message = trim(convert_wysiwyg_html_to_bbcode($_POST['WYSIWYG_HTML'], 0)); 


Replace that with:

PHP Code:

$message = trim(htmlspecialchars_uni(convert_wysiwyg_html_to_bbcode($_POST['WYSIWYG_HTML'], 0))); 


Find in journal.php(Find and Replace All Instances):

PHP Code:

$entry['message'] = trim(convert_wysiwyg_html_to_bbcode($_POST['WYSIWYG_HTML'], 0)); 


Replace that with:

PHP Code:

$entry['message'] = trim(htmlspecialchars_uni(convert_wysiwyg_html_to_bbcode($_POST['WYSIWYG_HTML'], 0))); 


I have updated the zip and attached the patched file below.