vBulletin 3.0.6 Critical Update, and a Bug Fix for 3.0.6

[Erwin]

vBulletin 3.0.6 has been released:
http://www.vbulletin.com/forum/showthread.php?t=127027

It fixes an XSS security hold in bbcode parsing so you should at least upload the latest patched /includes/functions_bbcodeparse.php

However, there is a serious bug in the 3.0.6 /includes/functions_bbcodeparse.php file.

This causes this error:

Warning: sprintf(): Too few arguments in /includes/functions_bbcodeparse.php on line 327

Unable to add cookies, header already sent.
File: /includes/init.php
Line: 27

This happens when you are trying to view a thread with custom bbcode.

To fix this, do this:

In functions_bbcodeparse.php, find:

PHP Code:

    return sprintf($return, $param, $option); 


ABOVE IT, ADD:

PHP Code:

    $return = preg_replace('#%(?!\d+\$s)#', '%%', $return); 


Bug description and fix located here:
http://www.vbulletin.com/forum/bugs....iew&bugid=3678

I'm not sure whether the latest 3.0.6 release has this fix in it so I'm posting this manual fix just in case.

[sabret00the]

just applied

[T3MEDIA]

oh man this software is going off the handle. How can I get version 2?

[TTG]

Thanks for the info

[Deaths]

Thanks for the info.

I hate having to update all the time though, can't they make up their mind? Geez...

[yoyoyoyo]

Thanks for the info. It's good to know that I can be safer now with the new patch and this fix. Thanks Erwin!

[the Sandman]

Thanks Erwin!

[Zachery]

Originally Posted by T3MEDIA

oh man this software is going off the handle. How can I get version 2?

In the members area, there is also no way to go from vB3 to vB2 best to stay where you are.

[mOdEtWo]

Hmm, I don't get that error in a thread with custom bb code. And I didn't have the "updated" 3.0.6 version of it either, as I downloaded it half an hour after release yesterday.

Strange?

Anyway, I've applied the "fix".

[Erwin]

Just so people know, CVS version 1.186.2.6 fixes this bug. If you have an earlier version you need to fix this manually.