vBug Tracker Lite 3.5.1

[high]The XSS security flaw reported in this modification has been fixed by Staff and a new zip file (3.5.1a) uploaded.[/high]

Here is a port of my vBug Tracker hack from vb 3.0.x. This mimics the Bug Tracker found at vBulletin.

Details:

• 7 - table additions
  96 - Phrases Added
  3 - file additions
  2 - xml files
  8 - template additions
  3 - Plugins

Please click install for support! For those interested, the Pro version is in development and should be out soon. It will be released at vb-scripts.com.

Sept 25, 2005
Bug fixes:

• * Added Missing phrases for editing status, type & severity.
  * Fixed bug in changing displayorder

Sept 26, 2005
Bug Fixes/Changes

• * Fixed bugcache issue and tested
  * Added admin usergroup permissions

Sept 27, 2005 (Part 1)
Bug Fixes:

• * Fixed subscribe issues and missing phrases.

Sept 27, 2005 (Part 2)

• * Complete rewrite of the subscription piece including the unsubscribe.
  * Subscriptions fully tested and working from all aspects!

Nov 7, 2005

• * Fixed missing table prefix when editing status.
  * Fixed issue when editing severities.
  * Now supports secondary usergroups.

Nov 24, 2005

• * Fixed extra span tag in list template.
  * Fixed searching on version.
  * Added "unassigned" to dropdown.

Jul 11, 2006

• * XSS Flaw fixed by Staff.

To upgrade:

Import the product xml and select "Allow Overwrite".
Upload all the files overwriting the old ones.

Lastly... Please follow the instructions exactly as they are outlined in the documents/install.txt and in the order as listed to avoid any problems.

Updated for vBulletin 3.7, Get it here

[Dark_Wizard]

Originally Posted by Todi

WTF? What is going on? How serious is this security flaw? Should everyone uninstall the mod? Why is there no information about this except a little notice at the top? I really don't like the sound of this... And since the coder has been MIA for so long, i find it unlikely that any fixes will be coming either. Please give us more information..

I have been notified and it is being worked on...will be out this week with a new update...

[Dark_Wizard]

Issue has been resolved, waiting on a reply to my PM. Also additional bugs have been fixed and included in the update.

[majorxp]

Originally Posted by dark_wizard

A security flaw has been reported in this modification and the author has been contacted for a fix. Until the flaw has been fixed we have removed the files from download. Thank you for your understanding.

It would have been nice to send out an update to all installed users to notify them of the issue so we could uninstall until it is resolved.

/uninstalled
...

[Simplicity]

Looks like we may need to wait a while for the moderators to give this the go-ahead and allow the file download

[Paul M]

The XSS security flaw reported in this modification has been fixed [by Staff] and a new zip file (3.5.1a) uploaded, vbugs.php is the file that has changed.

[majorxp]

Thanks Paul!

[MThornback]

Thanks Alot Paul

[Zelda-King]

Since upgrading to 3.5.1a the "Title / Submitted By / Date" column in the listbit doesn't look right (see attachment).

Also, using this on vB 3.6 RC1 results in the following errors at the top of the page;

Warning: Invalid argument supplied for foreach() in /vbugs.php on line 123

Warning: Invalid argument supplied for foreach() in /vbugs.php on line 128

Warning: Invalid argument supplied for foreach() in /vbugs.php on line 133

Warning: Invalid argument supplied for foreach() in /vbugs.php on line 138

(I realise this isn't officially ready for 3.6 yet. Just leaving feedback to consider.)

[jluerken]

Zelda-King, I have the same
Warning: Invalid argument supplied for foreach() in /vbugs.php on line 123
...and so on.

Is there any fix available?

[jluerken]

It has problems since vb3.6 with those lines in vbugs.php

PHP Code:

foreach ($bugcache['severity'] as $key => $entry) {
  $selected = iif($vbulletin->GPC['vbug_severityid'] == $key, 'selected="selected"');
  $val = $entry['title'];
  eval('$severitybits .= "' . fetch_template('userfield_select_option') . '";');
}
foreach ($bugcache['type'] as $key => $entry) {
  $selected = iif($vbulletin->GPC['vbug_typeid'] == $key, 'selected="selected"');
  $val = $entry['title'];
  eval('$typebits .= "' . fetch_template('userfield_select_option') . '";');
}
foreach ($bugcache['version'] as $key => $entry) {
  $selected = iif($vbulletin->GPC['vbug_versionid'] == $key, 'selected="selected"');
  $val = $entry['title'];
  eval('$versionbits .= "' . fetch_template('userfield_select_option') . '";');
}
foreach ($bugcache['status'] as $key => $entry)
{
        $statuscount = $db->query_first("
        SELECT count(*) AS status
        FROM " . TABLE_PREFIX . "vbug
        WHERE vbug_statusid = $key
        ");
  $numstatuses = $statuscount['status'];
  $selected = iif($vbulletin->GPC['vbug_statusid'] == $key, 'selected="selected"');
  $val = $entry['title']. " (" .$numstatuses. ")";
  eval('$statusbits .= "' . fetch_template('userfield_select_option') . '";');
} 


The foreeach statement is wrong but I am not a programer to say what has changes with 3.6 and how those lines need to look now.