The Arcive of Official vBulletin Modifications Site.It is not a VB3 engine, just a parsed copy! |
|
Patched Flash Uploader to Fix Known Exploits Details »» | ||||||||||||||||||||||||
Patched Flash Uploader to Fix Known Exploits
Developer Last Online: Sep 2023
UPDATE Dec 2014: 4.2.2 PL2, 4.2.2 PL3 and 4.2.3 core download packages from vBulletin now include this patched version of uploader.swf as standard.
This is a patched version of YUI 2.9.0 uploader.swf as used by vBulletin 4.x for managing multiple file uploads. An exploit was found in the flash uploader (uploader.swf) file supplied with vBulletin 4.x. This file is part of the Yahoo YUI 2 Library which is end of life and Yahoo have stated that they will not be fixing it. Yahoo recommends that the file is removed as the flash uploader has been deprecated. vBulletin's recommended fix is to replace the file with an empty file of the same name. If you do this, however, and rely solely on the Ajax uploader you will not be able to select multiple files without further modifications. This modification is a recompiled version of uploader.swf with the above exploit fixed. An additional potential exploit has also been fixed by disabling a parameter not used by vBulletin. The YUI source used is provided freely by Yahoo to whom I give full credit. 1) Installation a) Extract uploader.swf from the .zip file and replace your existing file here: <forum_root>/clientscript/yui/uploader/assets/uploader.swf b) Make sure the flash uploader is enabled in the Admin Control Panel Options -> Message Attachment Options -> Asset Manager - Enable -> Select "Yes, Flash Upload by Default" c) Make sure you are NOT using remote YUI vBulletin Options -> Server Settings and Optimization Options Use Remote YUI set to None d) You may also need to clear your browser cache and/or vBulletin cache (Maintenance ->Clear system cache) if you have performed the above steps correctly but clicking the Upload button still does nothing. 2) Changes 11th January 2014 The parameter 'allowedDomain' has been sanitised with a REGEX to prevent malicious javascript being passed in a query string. 11th January 2014 v2 Many thanks to FranzBanz (http://www.vbulletin.com/forum/member/449383-franzbanz) for his suggestions
Non-Flash Alternative Please note that if you would rather avoid using flash altogether an alternative Mod has been released by BirdOPrey5, although there are some compromises/limitations with IE10+. Asset Manager / Image Upload Fix to upload multiple files like the Flash uploader DISCLAIMER I am not a flash developer, I am just another vBulletin customer trying to keep his members happy! This file is provided free of charge for the benefit of the vBulletin community. You use it at your own risk! Copyright ? 2013 Yahoo! Inc. All rights reserved. Redistribution and use of this software in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of Yahoo! Inc. nor the names of YUI's contributors may be used to endorse or promote products derived from this software without specific prior written permission of Yahoo! Inc. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Download Now
Show Your Support
|
20 благодарности(ей) от: | ||
CharlieDelta, davidg, da_judge, djbaxter, furnival, Hostboard, hugh_, John Lester, Judith2, l0l4s0, Lynne, MonkYZ, MrD, ozzy47, puertoblack2003, RichieBoy67, rootsxrocks, SomeSailor, tbworld, thomas |
Comments |
#102
|
||||
|
||||
Quote:
Edit - It seems to be a bug in Firefox, a quick google turns up the XF guys working out a fix for their software here - https://xenforo.com/community/thread...-3#post-832948 |
#103
|
|||
|
|||
Thanks for sharing some clarity on the subject.
|
#104
|
||||
|
||||
Hi,
the Uploader are not Working about 5 days? The other Time, it´s worked perfect. vb 4.2.2 pl2 |
#105
|
||||
|
||||
What's actually happening? If you just upgraded to PL2 did you remember to re-upload uploader.swf?
|
#106
|
||||
|
||||
Hi,
the Window with the Files are not open. only the overlay window. yes i upgrade to 4.2.2 and i re-upload the swf. But now it works, after i clear my cache. It?s Amazing |
#107
|
|||
|
|||
Stopped working out of the blue, went back to ajax and a blank swf file and uploads began working again.
|
#108
|
||||
|
||||
That is because in the latest 4.2.2. patch and 4.2.3 this is included in the vb core.
|
#109
|
||||
|
||||
Does this patch still work or is it still needed after upgrading to 4.2.3 Beta?
|
#110
|
||||
|
||||
IIRC, this is included in 4.2.2. pl2 and 4.2.3
|
#111
|
||||
|
||||
For info
This patch is now included in 4.2.2 PL2/PL3/PL4 and 4.2.3/4.2.4/4.2.5 core downloads from vBulletin. If you are running 4.2.2 PL2 just check the version of uploader.swf you have as the earliest download package had the wrong version. I guess this is why uploader.swf was included again in the 4.2.2 PL3/PL4 patches just in case. It should be 7,410 bytes. uploader.swf file hashes: MD5: A2D3F12746C4552FA0757DB6D2D23F84 SHA1: 9F1A68F926BF3D9C9FF8848CB51561783A8A31FA |
Thread Tools | |
|
|
X vBulletin 3.8.12 by vBS Debug Information | |
---|---|
|
|
More Information | |
Template Usage:
Phrase Groups Available:
|
Included Files:
Hooks Called:
|