vB 3.0.8 released!

[Erwin]

Read here:
http://www.vbulletin.com/forum/showthread.php?t=148584

Main changes:

1. MySQL 4.1 Support added.

2. XSS Flaws in faq.php, private.php, and several templates fixed.

To manually patch your vB 3.0.7 to fix the file security issues 3.0.8:

In private.php, find:

PHP Code:

 // PREVIEW THE MESSAGE, AND FALL BACK TO 'NEWPM'
 if (isset($pm['preview']))
 {
  define('PMPREVIEW', 1);
  $foruminfo = array('forumid' => 'privatemessage');
  $preview = process_post_preview($pm);
  $_REQUEST['do'] = 'newpm';
 } 


REPLACE with:

PHP Code:

 // PREVIEW THE MESSAGE, AND FALL BACK TO 'NEWPM'
 if (isset($pm['preview']))
 {
  $temp = $pm['title'];
  $pm['title'] = htmlspecialchars_uni(fetch_censored_text($pm['title']));
  define('PMPREVIEW', 1);
  $foruminfo = array('forumid' => 'privatemessage');
  $preview = process_post_preview($pm);
  $_REQUEST['do'] = 'newpm';
  $pm['title'] = $temp;
 } 


And in faq.php, find:

PHP Code:

 // construct navbits 


ABOVE, add:

PHP Code:

$q = htmlspecialchars_uni($q); 


Done!

Then to fix the template IE XSS problem, in all your templates where you see:

<title>

Move that so that it is BELOW:

$headinclude

Done fixing the potential security issues.