Changes:
Fixed several vulnerabilities in admin pages
Fixed sid checking code in admin/pagestart.php
Fixed injection vulnerabilities possible with the img bbcode tag
Limited allowed images in img bbcode tag to jpg, jpeg, gif and png
Fixed redirect problems - 2.0.7a
Fixed sql injection vulnerability in search - 2.0.7a
To view the files that need to be replaced to upgrade from BBtoNuke 2.0.7 to 2.0.8 or to make the changes manually go here, the only two files you won't be able to manually edit are pagestart.php and bbcode.php, the first one underwent changes only valid on PHP-Nuke and the second one was re-ported.
Download here.To be able to access your forum's admin section you need to be logged both as a Nuke admin (i.e God account) and as the normal Nuke user that is listed as the site admin in the forums. The main reason for this is to help secure that section, as you may have noticed the phpbb group has released 3 versions in a short period of time, attacks have increased in recent weeks so the more protection you have the better. If you don't care about the extra security then do not replace your current pagestart.php file but if you decide to keep yours it's at your own risk.
Re: BBtoNuke 2.0.8 (Score: 1) | ![]() | Check the forum here, 2.08 already has a massive sql injection vulnerability :-( |
Re: BBtoNuke 2.0.8 (Score: 1) by Raven on Friday, March 26, 2004 @ 13:54:59 CST (User Info | Send a Message) | |
Thanks so much for the head's up. Where is the QA anymore? |
Re: BBtoNuke 2.0.8 (Score: 1) by ballymuntrev (abuse@microsoft.com) on Friday, March 26, 2004 @ 14:17:43 CST (User Info | Send a Message) http://mydublin.org | |
No probs. I'm more security concious these days as my host (hosting-pp.com) was hacked recently and I lost my whole site and backups of same, had to re-set it all up again. I'm no PHP expert but this is really pishing me off, they could in the very least test out their own code before releasing it :( |