My problem is that all HTML code in my news stories is now replaced as if using the htmlentries() php function. I understood some simple HTML was still allowed in news stories but it doesn't seem to work for me. What would be the best way to re-enable the HTML in these news stories? If I understand the security hole correctly the problem is with news submissions and posts containing malicious code. I would rather keep the HTML formatting in my news stories, deactivate the submit news module, and include an email news mailto instead (should work for my sites traffic). Would this seem a reasonable solution to you guys, and how can I get my HTML back?
Also, just an observation on that security fix file. I'm running phpbb 2.0.3 and initially in that security fix I did NOT use the specific module.php file specified for phpbb 2.0.6 users (I used the one that came with the secfix), however this broke my phpbb boards and made it could not read logged in users at all. I applied the modules.php 2.0.6 file and the forums seem to work fine now. (I'm probably an idiot and missing something but I wanted to pass that on in case someone is having similar problems).
Can anyone give some advice on the news html issue?
Thanks in advance for any help.
Streamweaver (http://www.swg-datapad.com/)
chatserv General
Joined: Jan 12, 2003
Posts: 3128
Location: Puerto Rico
Posted:
Sun Mar 30, 2003 1:38 pm
If using PHP-Nuke 6.0 download the secfix patch available at www.phpnuke.org and replace your mainfile.php with the one included in the patch.
_________________ Feed a man a fish and you feed him for a day. Teach a man to fish and you feed him for a lifetime.
ScriptHeaven | NukeResources
Streamweaver Nuke Soldier
Joined: Mar 30, 2003
Posts: 13
Posted:
Sun Mar 30, 2003 2:03 pm
I want to thank you very much for the answer, that fixed the problem. I'm unsure as to why there are two files on two sites both called secfixes6 that give two different results. Thanks again.
As to the submit news module, would you consider it a better security practice to disable "submit news" and use a mailto link instead of a sites news can handle the load?
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
