[1.7.2] Security fix for global.php

[Murat]

Hımmm..

thanks V@no .

[V@no]

I've updated the original post with some more instructions (see step 2)

[BartAfterDark]

so the only thing that needs to get replaced is

Code: [Select]

/* and */ ?

If you want to read about this bug: http://secunia.com/advisories/19745/

[quartz]

thanks for that update

[hyde101]

Thank you for the update, I have several sites running 1.7.2 but others were 1.7.
Would this be OK if I applied it on 1.7 ?

Thank You.

[mawenzi]

@ ufkydpnr,

An 4images installation version 1.7 with all "security fixes" does not contain this "security hole"!

[hyde101]

Dear Mawenzi,
Thanks for your reply, I guess you replied the same thing in German before, but thanks again since I don't speak German.

[Ston4Img]

Hi.

What is with the Bug from here? http://www.4homepages.de/forum/index.php?topic=10921.0 is it in 1.7.2 included ? I can register with "<" oder ">" in the Name....???

Hallo.
Was ist mit diesem Fehler: http://www.4homepages.de/forum/index.php?topic=10921.0. Ist das in der Verision 1.7.2 integriert? Ich kann wieder Benutzer registrieren mit > oder < im Namen ???
... macht das nicht eigentlich fast das gleiche?

Edit 1:

Code: [Select]

if ($site_db->not_empty($sql)) {
        $msg .= (($msg != "") ? "<br />" : "").$lang['username_exists'];
        $error = 1;
      }
    }
    else {
      $msg .= (($msg != "") ? "<br />" : "").$field_error = preg_replace("/".$site_template->start."field_name".$site_template->end."/siU", str_replace(":", "", $lang['user_name']), $lang['field_required']);
      $error = 1;
Can´t find this ...

Finde diesen Bereich nicht mehr

Code: [Select]

elseif (preg_match("#[<>]#", $user_name))
      {
        $msg .= (($msg != "") ? "<br />" : "").$lang['username_bad_characters'];
        $error = 1;
      }


[V@no]

What is with the Bug from here? http://www.4homepages.de/forum/index.php?topic=10921.0 is it in 1.7.2 included ? I can register with "<" oder ">" in the Name....???

Please pay attention to the version number of the security fix.
If its says v1.7 / v1.7.1 it means only v1.7 and v1.7.1 affected, v1.7.2 is already fixed. If it says v1.7.2 that means only v1.7.2 has the bug all previous version dont have it.
Now, if you are having problem installing the fix for v1.7 or v1.7.1, then why would reply to this topic?

[linux_rh]

 

hi  all  thank you for the bug sulation that was found in  version 1.7.2   in the  global.php

i replace   that old file with new file   and we try  to register  but  we can n't 

it means  that  the problem is solved   

thank youuuuuuuuuuuuuuuuuuuuuuu

[V@no]

Just a note:
With this fix you can not post any <script> <iframe> etc HTML code anywhere from regular members pages (profile, descriptions, comments, etc)
If you, as admin, wish to add such code, you'll have to do it via ACP

[brice626]

Just a note:
With this fix you can not post any <script> <iframe> etc HTML code anywhere from regular members pages (profile, descriptions, comments, etc)
If you, as admin, wish to add such code, you'll have to do it via ACP

Question: I just posted this topic: http://www.4homepages.de/forum/index.php?topic=12761.new#new

Is the reason the issue you mention above? If by ACP you mean "Admin Control Panel" (I'm just guessing) that didn't seem to be the case for me. After the upgrade, all my existing HTML in the description fields stopping working and even when entered from the Admin Control Panel it will not work.

[caballonegro]

 
Ist eine Änderung denn auch notwendig wenn 4images bei registrierungen auf die Userdatenbank von phpbb zugreift? : : :


danke u. gruß
 

[milius.net]

auf die userdatenbank von phpbb?
bin neu hier aber ich an deiner stelle würde die änderungen einfügen ...

[FransisDastinut]

thanks a lot for [1.7.2] Security fix