Bugs and Updates
Модератор: Vladimir
Bugs and Updates
Вы вообще следите за обновлениями движка форума.....
В их ченж логе такая куча багов найденных в версии этого форума...
В смысле phpBB 2.0.4
А на их сайте текущая 2.0.6с.....
1. Changelog
This is a non-exhaustive (but still near complete) changelog for phpBB 2.0.x including beta and release candidate versions. Our thanks to all those people who've contributed bug reports and code fixes.
1.i. Changes since 2.0.5
Fixed sql injection vulnerability in groupcp.php
Fixed xss vulnerability in privmsg.php
Fixed sql injection vulnerability in search.php
Fixed various email issues
Fixed registration email bug with Administrator Confirmation used
Fixed mass emailer
Fixed long post time issue
Fixed bug with usernames containing single quotes
Fixed word list bug - Word boundaries were not considered
Fixed vulnerability in style admin
Fixed sql injection vulnerability in viewtopic
Fixed vulnerability allowing server side variable access in search - tendor
Fixed potential vulnerability in 2.0.5 login username entry - throw away/eomer
Fixed sql injection with reset date format field in profile - tendor
Fixed several vulnerabilities in modcp - Robert Lavierck
Changed whois lookup address within admin index
1.ii. Changes since 2.0.4
Removed user facing session_id checks
Fixed user self-activation after deactivation
Fixed incorrect functioning of phpbb_realpath
Fixed wrong path to database schema files within the upgrade script
Fixed double quote problem with username validation
Allow & within email addresses
Fixed email validation for banned email addresses
Removed underline from email domain validation
Fixed redirection for sentbox folder, installation and email
Fixed poll deletion
Fixed Mozilla navigation bar
Fixed URL bbcode parsing
Fixed database timeouts while searching the forums
Fixed wrong email return path in admin mass mailing - netclectic
Fixed MS-SQL failures within the update script
Fixed memberlist sort order
Fixed not showing leading spaces within Code BBCode
Fixed problem with adding double quotes to subject titles
Remove username input field from profile when user cannot change name
Fixed pagination error with highlighting
Fixed errors if no smilies are installed
Fixed CSS issues with IE 5.2 on MacOS X
Fixed missing sid propagation problem within the Moderator Control Panel
Fixed language variables within Authentication error output
Removed doubled CSS class definitions within input fields
Fixed username change within the Administration Panel
Added missing <tr> tags to index_body.tpl
Added missing username language variable to admin index page
Fixed moderator status update if a usergroup got deleted
Fixed poll handling upon post edit
Fixed remove common words from search table if post get pruned - Nuttzy99
Fixed behaviour on splitting topics if no checkbox is selected
Anonymous is no longer displayed within Username dropdown boxes
Fixed viewprofile redirection if an invalid mode was specified
Fixed fraction settings within determining common words - Novan
Prevent admin change usernames to his own within the ACP
Activation email is sent to all admins
Fixed conversion of & to & in appropriate cases
Fixed display of "greater than topics per page" announcements preventing display of normal posts
Added variable checks to database backup and restore screen
Prevented pm popup window from resetting after visiting avatar gallery
Fixed special character handling with word censor
Added SID to jumpbox
Fixed problems with usernames using html special chars
Added GMT + 13 to English lang_main, all translators are encouraged to do likewise
Deleted doubled 'U_MEMBERLIST' assignment from page_header.php
Fixed wrong display of Signature Checkbox while editing Private Message
Fixed disappearing post text if emoticon was inserted directly after pressing a BBCode button
Display correct alt-tag for smilies within postings
Prevented the ability to apply BBCode to website contents
Fixed maxlength issue with password field in login_body.tpl
Fixed possible username duplication issue with validation and username length
Fixed split words function to handle additional foreign characters
Changed empty email To Field to use a non-disclosure delimiter
Fixed wrong language var in install.php - FTP Config screen
Fixed alt tag for locked topic images in viewforum_body.tpl
Fixed typo in groupcp.php - $lang['Unsub_success'] instead of $lang['Usub_success']
Fixed timezone display
Fixed wrong display of author quote tag within profile - Cl1mh4224rd
Added deletion of sessions of users whose account is deactivated
Added mail header X-MimeOLE to the emailer class
Prevent registration if user is logged in or user trying to register again
Prevent usage of char(255) in usernames
Added check for additional FORWARDED_FOR IP's - cosmos
Fixed handling of non-selection of option when voting
Fixed potential xss issue with memberslist mode
Default English support for visual confirmation - translators are encouraged to support this
В их ченж логе такая куча багов найденных в версии этого форума...
В смысле phpBB 2.0.4
А на их сайте текущая 2.0.6с.....
1. Changelog
This is a non-exhaustive (but still near complete) changelog for phpBB 2.0.x including beta and release candidate versions. Our thanks to all those people who've contributed bug reports and code fixes.
1.i. Changes since 2.0.5
Fixed sql injection vulnerability in groupcp.php
Fixed xss vulnerability in privmsg.php
Fixed sql injection vulnerability in search.php
Fixed various email issues
Fixed registration email bug with Administrator Confirmation used
Fixed mass emailer
Fixed long post time issue
Fixed bug with usernames containing single quotes
Fixed word list bug - Word boundaries were not considered
Fixed vulnerability in style admin
Fixed sql injection vulnerability in viewtopic
Fixed vulnerability allowing server side variable access in search - tendor
Fixed potential vulnerability in 2.0.5 login username entry - throw away/eomer
Fixed sql injection with reset date format field in profile - tendor
Fixed several vulnerabilities in modcp - Robert Lavierck
Changed whois lookup address within admin index
1.ii. Changes since 2.0.4
Removed user facing session_id checks
Fixed user self-activation after deactivation
Fixed incorrect functioning of phpbb_realpath
Fixed wrong path to database schema files within the upgrade script
Fixed double quote problem with username validation
Allow & within email addresses
Fixed email validation for banned email addresses
Removed underline from email domain validation
Fixed redirection for sentbox folder, installation and email
Fixed poll deletion
Fixed Mozilla navigation bar
Fixed URL bbcode parsing
Fixed database timeouts while searching the forums
Fixed wrong email return path in admin mass mailing - netclectic
Fixed MS-SQL failures within the update script
Fixed memberlist sort order
Fixed not showing leading spaces within Code BBCode
Fixed problem with adding double quotes to subject titles
Remove username input field from profile when user cannot change name
Fixed pagination error with highlighting
Fixed errors if no smilies are installed
Fixed CSS issues with IE 5.2 on MacOS X
Fixed missing sid propagation problem within the Moderator Control Panel
Fixed language variables within Authentication error output
Removed doubled CSS class definitions within input fields
Fixed username change within the Administration Panel
Added missing <tr> tags to index_body.tpl
Added missing username language variable to admin index page
Fixed moderator status update if a usergroup got deleted
Fixed poll handling upon post edit
Fixed remove common words from search table if post get pruned - Nuttzy99
Fixed behaviour on splitting topics if no checkbox is selected
Anonymous is no longer displayed within Username dropdown boxes
Fixed viewprofile redirection if an invalid mode was specified
Fixed fraction settings within determining common words - Novan
Prevent admin change usernames to his own within the ACP
Activation email is sent to all admins
Fixed conversion of & to & in appropriate cases
Fixed display of "greater than topics per page" announcements preventing display of normal posts
Added variable checks to database backup and restore screen
Prevented pm popup window from resetting after visiting avatar gallery
Fixed special character handling with word censor
Added SID to jumpbox
Fixed problems with usernames using html special chars
Added GMT + 13 to English lang_main, all translators are encouraged to do likewise
Deleted doubled 'U_MEMBERLIST' assignment from page_header.php
Fixed wrong display of Signature Checkbox while editing Private Message
Fixed disappearing post text if emoticon was inserted directly after pressing a BBCode button
Display correct alt-tag for smilies within postings
Prevented the ability to apply BBCode to website contents
Fixed maxlength issue with password field in login_body.tpl
Fixed possible username duplication issue with validation and username length
Fixed split words function to handle additional foreign characters
Changed empty email To Field to use a non-disclosure delimiter
Fixed wrong language var in install.php - FTP Config screen
Fixed alt tag for locked topic images in viewforum_body.tpl
Fixed typo in groupcp.php - $lang['Unsub_success'] instead of $lang['Usub_success']
Fixed timezone display
Fixed wrong display of author quote tag within profile - Cl1mh4224rd
Added deletion of sessions of users whose account is deactivated
Added mail header X-MimeOLE to the emailer class
Prevent registration if user is logged in or user trying to register again
Prevent usage of char(255) in usernames
Added check for additional FORWARDED_FOR IP's - cosmos
Fixed handling of non-selection of option when voting
Fixed potential xss issue with memberslist mode
Default English support for visual confirmation - translators are encouraged to support this
-
- Король футбола
- Сообщения: 627
- Зарегистрирован: Сб ноя 29, 2003 2:35 pm
- Откуда: Helsinki, Finland
- Контактная информация:
Да ладно, можно КОндопогу и пожалеть, но я бы посоветовал админам новую версию форума забадяжить, дело то серьезноеmauricio писал(а):Сломав форум можно получит доступ к халявному шеллу....Фёдор писал(а):А че его хакать? Кому это нужно, если только придуркам, тут нечего то и сделать, только еслипопрактиковаться...
А этого много кто хочет....Я например....![]()
![]()
Да че тут писать, я вообще в своем уме?
Фёдор писал(а):Да ладно, можно КОндопогу и пожалеть, но я бы посоветовал админам новую версию форума забадяжить, дело то серьезноеmauricio писал(а):Сломав форум можно получит доступ к халявному шеллу....Фёдор писал(а):А че его хакать? Кому это нужно, если только придуркам, тут нечего то и сделать, только еслипопрактиковаться...
А этого много кто хочет....Я например....![]()
![]()
А может возьмем власть в свои руки????
![Twisted Evil :twisted:](./images/smilies/icon_twisted.gif)
![Twisted Evil :twisted:](./images/smilies/icon_twisted.gif)
![Twisted Evil :twisted:](./images/smilies/icon_twisted.gif)
-
- Сообщения: 500
- Зарегистрирован: Пн сен 01, 2003 8:57 pm
- Откуда: Kondopoga
- Контактная информация:
Re: Bugs and Updates
а не из багов ли форум "лежал" на прошлых выходных?mauricio писал(а):
В их ченж логе такая куча багов найденных в версии этого форума...
-
- Король футбола
- Сообщения: 627
- Зарегистрирован: Сб ноя 29, 2003 2:35 pm
- Откуда: Helsinki, Finland
- Контактная информация:
Re: Bugs and Updates
Наверное Маурисио уже пытался взломать.svyazist писал(а):а не из багов ли форум "лежал" на прошлых выходных?mauricio писал(а):
В их ченж логе такая куча багов найденных в версии этого форума...
Да че тут писать, я вообще в своем уме?
Re: Bugs and Updates
Я здесь ни каким боком.....Фёдор писал(а):Наверное Маурисио уже пытался взломать.svyazist писал(а):а не из багов ли форум "лежал" на прошлых выходных?mauricio писал(а):
В их ченж логе такая куча багов найденных в версии этого форума...
![arrow :arrow:](./images/smilies/icon_arrow.gif)
![arrow :arrow:](./images/smilies/icon_arrow.gif)
![arrow :arrow:](./images/smilies/icon_arrow.gif)
-
- Король футбола
- Сообщения: 627
- Зарегистрирован: Сб ноя 29, 2003 2:35 pm
- Откуда: Helsinki, Finland
- Контактная информация:
Маурисио, короче как нить можно зайти под ником админа на сайт, www.fifax.ru/admin.php нудно какая нибудь програ для распознания пароля ![Smile :)](./images/smilies/1smeetsa.gif)
![Smile :)](./images/smilies/1smeetsa.gif)
Да че тут писать, я вообще в своем уме?