The Arcive of Official vBulletin Modifications Site.

Erwin · #1 07-28-2005, 10:21 PM

Read here:
http://www.vbulletin.com/forum/showthread.php?t=148584

Main changes:

1. MySQL 4.1 Support added.

2. XSS Flaws in faq.php, private.php, and several templates fixed.

To manually patch your vB 3.0.7 to fix the file security issues 3.0.8:

In private.php, find:

PHP Code:


			
 // PREVIEW THE MESSAGE, AND FALL BACK TO 'NEWPM'
 if (isset($pm['preview']))
 {
  define('PMPREVIEW', 1);
  $foruminfo = array('forumid' => 'privatemessage');
  $preview = process_post_preview($pm);
  $_REQUEST['do'] = 'newpm';
 }

REPLACE with:

PHP Code:


			
 // PREVIEW THE MESSAGE, AND FALL BACK TO 'NEWPM'
 if (isset($pm['preview']))
 {
  $temp = $pm['title'];
  $pm['title'] = htmlspecialchars_uni(fetch_censored_text($pm['title']));
  define('PMPREVIEW', 1);
  $foruminfo = array('forumid' => 'privatemessage');
  $preview = process_post_preview($pm);
  $_REQUEST['do'] = 'newpm';
  $pm['title'] = $temp;
 }

And in faq.php, find:

PHP Code:


			
 // construct navbits

ABOVE, add:

PHP Code:


			
$q = htmlspecialchars_uni($q);

Done!

Then to fix the template IE XSS problem, in all your templates where you see:

HTML Code:

<title>

Move that so that it is BELOW:

HTML Code:

$headinclude

Done fixing the potential security issues.

Corriewf · #2 07-28-2005, 11:34 PM

Nice to see a new version on the 3.0.x series.

Marco van Herwaarden · #3 07-29-2005, 03:38 AM

Hmm didn't 2.x have the same issues with MySQL?

Erwin · #4 07-29-2005, 12:30 PM

Bump - added to the first post the security file and template changes needed.

yoyoyoyo · #5 07-29-2005, 12:39 PM

Quote:

Originally Posted by Erwin

Done fixing the potential security issues.

THANKS MUCH!

where's the install button?

Quote:

Originally Posted by erwin

Then to fix the template IE XSS problem, in all your templates where you see:

HTML Code:

 <title>

Move that so that it is BELOW:

HTML Code:

 $headinclude

Is there a quick way to do this, such as a "replace all" that is safe to do or do I have to search through all of the templates?

Marco van Herwaarden · #6 07-29-2005, 12:59 PM

Maybe with a SQL-Replace directly in the database.

Andreas · #7 07-29-2005, 01:03 PM

I love vB search

http://www.vbulletin.com/forum/showthread.php?t=143320

As mySQL also supports regex, it might also be possible to do this directly in the DB.
But mySQL Regex is not PCRE compatible, eg. different Syntax.

Brinnie · #8 07-29-2005, 01:45 PM

So it's just a security release?

Brad · #9 07-29-2005, 02:02 PM

Quote:

Originally Posted by Brinnie

So it's just a security release?

Yes, bug fixes only

Brinnie · #10 07-29-2005, 08:01 PM

Quote:

Originally Posted by Brad

Yes, bug fixes only

Well that's kinda boring. :-\

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.05529 seconds Memory Usage 2,269KB Queries Executed 11 (?)
More Information
Template Usage: (1)SHOWTHREAD (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)ad_showthread_beforeqr (1)ad_showthread_firstpost (1)ad_showthread_firstpost_sig (1)ad_showthread_firstpost_start (4)bbcode_html (4)bbcode_php (4)bbcode_quote (1)footer (1)forumjump (1)forumrules (1)gobutton (1)header (1)headinclude (1)navbar (3)navbar_link (120)option (1)pagenav (1)pagenav_curpage (2)pagenav_pagelink (10)post_thanks_box (10)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (10)post_thanks_postbit_info (10)postbit (10)postbit_onlinestatus (10)postbit_wrapper (1)spacer_close (1)spacer_open (1)tagbit_wrapper Phrase Groups Available: global inlinemod postbit posting reputationlevel showthread	Included Files: ./showthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showthread_start showthread_getinfo forumjump showthread_post_start showthread_query_postids showthread_query bbcode_fetch_tags bbcode_create showthread_postbit_create postbit_factory postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start pagenav_page pagenav_complete tag_fetchbit_complete forumrules navbits navbits_complete showthread_complete
Messages:

The Arcive of Official vBulletin Modifications Site.

It is not a VB3 engine, just a parsed copy!