"Very High Severity" bugfix in phpBB 2.0.11

Nuke Soldier Joined: Mar 16, 2004 Posts: 24

Sorry if this is a dupe but I didn't see a posting about it yet.

According to phpbb's website, there's a "very high severity" bug in previous versions of the bulletin board software.

Quote:

Changes since 2.0.10

Fixed vulnerability in highlighting code (very high severity, please update your installation as soon as possible)
Fixed unsetting global vars - Matt Kavanagh
Fixed XSS vulnerability in username handling - AnthraX101
Fixed not confirmed sql injection in username handling - warmth
Added check for empty topic id in topic_review function
Added visual confirmation mod to code base

I did some searching through the patches, and I think the following will address the most important "high severity" bug:

File: /modules/Forums/viewtopic.php

Find:

Code:

$words = explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));

Replace with:

Code:

$words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight'])));

more line-by-line fixes are described in a thread I just found at nukefixes.com--> here.

Also, a full bbtonuke is available here

W