BBtoNuke207 fully patched?

Nuke Soldier Joined: Mar 16, 2004 Posts: 24

Just applied this successfully over my Nuke 6.5's bbtonuke206 without any issues. BUT I did notice one thing--

The patches described at the bottom of http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=180610 (the thread which announces 207) does NOT seem to have been applied to bbtonuke207! I quote:

<i>here are the changes for you to make to your source files to patch two new security issues found by Gulftech Security Research: </i>

Open viewforum.php

FIND ( Line 296 )

Code:

$topic_days = ( !empty($HTTP_POST_VARS['topicdays']) ) ? $HTTP_POST_VARS['topicdays'] : $HTTP_GET_VARS['topicdays'];

REPLACE WITH

Code:

$topic_days = ( !empty($HTTP_POST_VARS['topicdays']) ) ? intval($HTTP_POST_VARS['topicdays']) : intval($HTTP_GET_VARS['topicdays']);

Open viewtopic.php

FIND ( Line 365 )

Code:

$post_days = ( !empty($HTTP_POST_VARS['postdays']) ) ? $HTTP_POST_VARS['postdays'] : $HTTP_GET_VARS['postdays'];

REPLACE WITH

Code:

$post_days = ( !empty($HTTP_POST_VARS['postdays']) ) ? intval($HTTP_POST_VARS['postdays']) : intval($HTTP_GET_VARS['postdays']);

For ease of patching, I've adjusted the line numbers above to match the numbers in the current BBtoNuke207.zip's files. The files in question are in modules/Forums/

Question: Does the file need to be upgraded and people using current bbtonuke 207 warned? I just downloaded phpBB207 and it DOES have the changes made.

I'm going to crosspost this to the security forum as well.

W

Nuke Soldier Joined: Mar 16, 2004 Posts: 24

as a followup for chatserv--

have these changes been included as well?

W