Miscellaneous Hacks - Disallow HTML code in Thread Titles

Disallow HTML code in Thread Titles v1.01

Originally Posted by Staff Note

Staff Note:
Unmodified vBulletin will not evaluate HTML in thread titles. Using this modification without a hack installed that has security vulnerabilities is useless.

Also installing this modification, even with a modification installed that would make your board vulnerable to this type of HTML posting in thread titles, only will give you a false sense of security since there are many other options to exploit this, even without the use of the ">" character.

Everyone is encouraged to remove or update the vulnerable modification instead of using this hack.

Marco van Herwaarden.

By Jason Williams/Andrew Calderbank
03/09/2006

Recently there has been a spate of members posting html redirection code in thread titles, which when parsed on the forum homepage runs and redirects to whatever site they insert into the title.

This code simply disallows the characters < and > from being used in the thread titles, this is also is checked when editing the post.

It's fairly simple but puts to and end members signing up and posting redirect links. I don't know whether you'd class this as a hack or bug fix, but I hope this helps other members who are frustrated with this issue.

2 file edits
1 new phrase

Should be fairly straightforward to install.

**ALWAYS BACK UP FILES BEFORE YOU EDIT THEM!!**

v1.00

Original release

v1.01

Slight code update

[Nuguru]

Originally Posted by Nuguru

Hello,

I was wondering if this security issue applies to 3.5.4 and will this fix work with 3.5.4? Or how to I get the same result making code changes with 3.5.4. Advice would be appreciated.



Thank You,

Nuguru

Hello,

I was wondering if this fix works for vb 3.5.4? If not, is there a way it could?


Thank You,

Nuguru

[xman_79]

I did that what you said , but nothing changed .

[filmking]

Not working at all for me

[captainslater]

You can add this HTML-stuff do your bad word list, this works fine at my board.

[karlm]

For those working in vb3.5.4, try this quick fix I found here.

Go into you AdminCP and under vB Options choose Censorship Options.

In the Censored Words window add this.

{meta} >>>> {http-equiv} "Refresh" """"

That will put an end this nonsense.

[bashy]

Great idea lol

Originally Posted by captainslater

You can add this HTML-stuff do your bad word list, this works fine at my board.

[TAL_NEW]

Good work

[tuanvic]

hi i can't found in my Admin Cp this Phrase Type : Front-End Error Messages. can any one help me i using vbb 3.6

[Scott MacVicar]

vBulletin does not allow HTML code in thread titles, the problem is the TopXStats modification which does absolutely no checking before storing / displaying data.

I'm thinking this thread should be closed since its going to cause a misconception that its a vBulletin problem, the much easier solution is to fix your TopXStats modification.

It also doesn't fix the cases where you can use things other than >, what about injecting a new parameter.

" onmouseover="window.location='www.hax0r.com'"

That should work as a title as well.

[Marco van Herwaarden]

<font size="3">Staff Note:
Unmodified vBulletin will not evaluate HTML in thread titles. Using this modification without a hack installed that has security vulnerabilities is useless.

Also installing this modification, even with a modification installed that would make your board vulnerable to this type of HTML posting in thread titles, only will give you a false sense of security since there are many other options to exploit this, even without the use of the ">" character.

Everyone is encouraged to remove or update the vulnerable modification instead of using this hack.</font>