phpBB România

$search_keywords = ( isset($HTTP_POST_VARS['search_keywords']) ) ? $HTTP_POST_VARS['search_keywords'] : $HTTP_GET_VARS['search_keywords'];
}
else
{
$search_keywords = '';
}

if ( isset($HTTP_POST_VARS['search_author']) || isset($HTTP_GET_VARS['search_author']))
{
$search_author = ( isset($HTTP_POST_VARS['search_author']) ) ? $HTTP_POST_VARS['search_author'] : $HTTP_GET_VARS['search_author'];
$search_author = phpbb_clean_username($search_author);
}
else
{
$search_author = '';
}

$search_id = ( isset($HTTP_GET_VARS['search_id']) ) ? $HTTP_GET_VARS['search_id'] : '';

$show_results = ( isset($HTTP_POST_VARS['show_results']) ) ? $HTTP_POST_VARS['show_results'] : 'posts';
$show_results = ($show_results == 'topics') ? 'topics' : 'posts';

if ( isset($HTTP_POST_VARS['search_terms']) )
{
$search_terms = ( $HTTP_POST_VARS['search_terms'] == 'all' ) ? 1 : 0;
}
else

# 
#-----[ OPEN ]--------------------------------------------- 
# 
includes/functions.php 

# 
#-----[ FIND ]--------------------------------------------- 
# Line 80 
// 
// Get Userdata, $user can be username or user_id. If force_str is true, the username will be forced. 
// 

# 
#-----[ BEFORE, ADD ]--------------------------------------------- 
# 
// added at phpBB 2.0.11 to properly format the username 
function phpbb_clean_username($username) 
{ 
   $username = htmlspecialchars(rtrim(trim($username), "\\")); 
   $username = substr(str_replace("\\'", "'", $username), 0, 25); 
   $username = str_replace("'", "\\'", $username); 

   return $username; 
} 


# 
#-----[ FIND ]--------------------------------------------- 
# Line 96 
      $user = trim(htmlspecialchars($user)); 
      $user = substr(str_replace("\\'", "'", $user), 0, 25); 
      $user = str_replace("'", "\\'", $user); 

# 
#-----[ REPLACE WITH ]--------------------------------------------- 
# 
      $user = phpbb_clean_username($user);

Pentru a descărca noua versiune, citeşte primul mesaj din acest subiect.

Schimbările survenite de la versiunea 2.3.10

# fixed bug in GD/Imagick-Detection (on some installations thumbnailing images did not work)
# Added mysql index to attachment table for larger boards
# updated pre-edited files to be compatible with phpBB 2.0.11
# changed order of uploading files, resulting in hopefully getting the correct filesizes if the server does not allow file access outside the working directory
# added check for config table constant to update script
# fixed overwriting of group_id in admin_groups if Categories Hirarchie mod is installed
# fixed bugs regarding the 4GB limits users experienced
# fixed deletion of thumbnails
# fixed directory traversal injection (high severity) - Paul Laudanski (AKA Zhen-Xjell)
With this an attacker could be able to add/remove/execute files outside of the upload directory
# fixed multiple file extensions vulnerability (high severity) - Jeremy Bae at STG Security, Inc.
Due to the handling of mod_mime on multiple extensions an attacker is able to upload arbitrary script files to the web server.