[1.7 - 1.7.3] Security fix for Cross-Site Scripting Vulnerability

[medo007]

Thank you very much!

[KimmyMarie]

Thank you very much Jan!





Best wishes,
Kimmy

[Fotopez]

Dankeschön! 

[theking6]

Vielen herzlichen Dank

[linux_rh]

first of all  i would thank 4images group for sending me  this massege  for  fixing  the bug in 4images

every thing is done

the bugs fix

thank you agian

[Zhra]

Thanks so much 
have been Updated 

[wallpapers]

I'm maby stupid but what is " Cross-Site Scripting Vulnerability" i have never heard about it 

[mawenzi]

http://en.wikipedia.org/wiki/Cross_site_scripting

[BitBull]

Hi,

I just applied the security fix and viewed the result.

The page in general looks like it has been before but on the Top of the page there are now a lot of additional system messages: 

Code: [Select]

cache[$row['cat_id']] = $row['new_images']; } $site_db->free_result(); // -------------------------------------- $sql = "SELECT cat_id, COUNT(*) AS num_images FROM ".IMAGES_TABLE." WHERE image_active = 1 GROUP BY cat_id"; $result = $site_db->query($sql); while ($row = $site_db->fetch_array($result)) { $cat_cache[$row['cat_id']]['num_images'] = $row['num_images']; } $site_db->free_result(); } //end if GET_CACHES ?>
Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /homepages/blablabla/publik/global.php:450) in /homepages/blablabla/publik/includes/sessions.php on line 86

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /homepages/blablabla/publik/global.php:450) in /homepages/blablabla/publik/includes/sessions.php on line 86

Warning: Cannot modify header information - headers already sent by (output started at /homepages/blablabla/publik/global.php:450) in /homepages/blablabla/publik/includes/sessions.php on line 94

Warning: Cannot modify header information - headers already sent by (output started at /homepages/blablabla/publik/global.php:450) in /homepages/blablabla/publik/includes/sessions.php on line 94

I integrated the gallery in the layout of my site. Can it be that the script tries to modify that layout now too?
What can these messages mean? 

regards

BitBull

[BitBull]

  I tried to log on as registered user ...

There are even more of these messages and I am not able to log in anymore!  : : :

Some guesses somewhere?

regards

BitBull

[Nicky]

seams your global.php is strange...
uploaded as binary... edited with nonconform editor.

[BitBull]

Hmmm ... I guess thats not the problem really.

I am using Phase 5 (HTML Editor). I am using that editor ever and I did all my work on my sites with that editor.

I also removed the fix in global.php with this editor and everything works properly again ...

... but so I haven't applied the security fix.

Any other idea?

thanks and regards

BitBull

[Nicky]

then is something else..
like you can see, all ppl. don't have a problem with it.

[BitBull]

most certainly yes!

But hopefully someone can "understand" these messages and give me a hint where the problem could be to find ...

For me it seems that it has something to do with the header-file because there I integrated the menu etc. of my site. Can it be that with these additions the new line in the global.php has a problem? ...

The mentioned 2 lines in the sessions.php are:
86:

Code: [Select]

    session_start();
and 94:

Code: [Select]

    setcookie($cookie_name, $value, $cookie_expire, COOKIE_PATH, COOKIE_DOMAIN, COOKIE_SECURE);
BitBull

[Jan]

The line that causes this error is in global.php, line 450.

output started at /homepages/blablabla/publik/global.php:450

Can you post whats in (or better in and around) this line.

Jan