[Dollah]

Originally Posted by Raptor

there is a security flaw if you direct link to vbshout.php - you can execute java and html

this should fix

// ---------------------------------------------------
// Shout
// ---------------------------------------------------
if ($_POST['do'] == 'shout')
{
$vbulletin->input->clean_array_gpc('p', array(
'shout' => TYPE_STR,


if you change that to

// ---------------------------------------------------
// Shout
// ---------------------------------------------------
if ($_POST['do'] == 'shout')
{
$vbulletin->input->clean_array_gpc('p', array(
'shout' => TYPE_NOHTML,

which is;

http://www.vbulletin.com/docs/html/m...estandards_gpc

changes..
# TYPE_STR - Trimmed String (No leading or trailing whitespace)
to
# TYPE_NOHTML - Trimmed String sent through htmlspecialchars_uni()

im sorry i'm new at this where do i find this at please