[1.7 / 1.7.1] Security fix in sessions.php

[Jan]

This is an important security fix.

Open includes/sessions.php and find the following line:

Code: [Select]

$user_id = ($this->read_cookie_data("userid")) ? $this->read_cookie_data("userid") : GUEST;
replace this line with the following code:

Code: [Select]

$user_id = ($this->read_cookie_data("userid")) ? intval($this->read_cookie_data("userid")) : GUEST;

[b.o.fan]

ich hab das gefixed. aber wozu is das? bzw. wo war der bug?

was wurde gesichert. interessiert mich mal interessehalber...

[Jan]

Bitte hab Verständnis dafür, dass ich darauf nicht näher eingehe. Es gibt viele Installationen die diesen Fix nicht haben und wenn ich erkläre wie und wo man das ausnutzt...naja du verstehst

Gruß Jan

[b.o.fan]

verstehe. juut.

gut dass ich das installiert hab

[edwin]

Jan, in News & Ankündigungen you'll say it's for all versions, but in the headline you write ( [1.7.1] Security fix in sessions.php )

is it only for 1.7.1 or for all versions 4images

[martrix]

Edwin:
It is also for 1.7 - so you should also change that!

Jan:
Could you please change the title of this thread, so it says also 1.7?

[mawenzi]

Jan:
Could you please change the title of this thread, so it says also 1.7 ?

martrix, you are right ... that seems to me also very important ... 

mawenzi

[RoadDogg]

Ist damit das bekannte Problem mit der Übernahme einer SiD gelöst?

[graficalicus]

made this change and the whole gallery went down!

direct image link:  http://digiart.graficalicus.com/details.php?image_id=1203

category link: http://digiart.graficalicus.com/categories.php?cat_id=10

home link:  http://digiart.graficalicus.com/

rss link:  http://digiart.graficalicus.com/rss.php

 : : :   help  :

[RoadDogg]

Have you restored your session.php?

which version of 4img do you use?

[graficalicus]

restored - using 1.7 - this is the only change I've made in a few days. Dumped my cache, reloaded the page - nothing!

wonder if I've been hacked........

[graficalicus]

every error line is:

Code: [Select]

$site_template->register_vars(array(
ideas?

[graficalicus]

fixed - I was editing an old sessions.php     now updated   

thanks for looking!

[Murat]

hello all.

no this line :$user_id = ($this->read_cookie_data("userid")) ? $this->read_cookie_data("userid") : GUEST;

I integrated phpBB 2.0.15 .

[V@no]

no this line :$user_id = ($this->read_cookie_data("userid")) ? $this->read_cookie_data("userid") : GUEST;

I integrated phpBB 2.0.15 .

that version does not have this hole, dont worry about this fix