phpBB 2.0.9 to phpBB 2.0.10

[starboy_tehran]

سلام
من اينو تست نكردم . و نميدونم مشكل داره يا نه
فقط رو يه سايت ديدم
گفتم شايد به درد بخوره
اگه مفيد بود دعامون كنيد

اينم از كدهاش :


Open common.php

FIND - Line 43

// Unset globally registered vars - PHP5 ... hhmmm 
if (@$ini_val('register_globals') == '1' || strtolower(@$ini_val('register_globals')) == 'on') 
{ 
   $var_prefix = 'HTTP'; 
   $var_suffix = '_VARS'; 
    
   $test = array('_GET', '_POST', '_SERVER', '_COOKIE', '_ENV'); 

   foreach ($test as $var) 
   { 
      if (is_array(${$var_prefix . $var . $var_suffix})) 
      { 
         unset_vars(${$var_prefix . $var . $var_suffix}); 
      } 

      if (is_array(${$var})) 
      { 
         unset_vars(${$var}); 
      } 
   } 

   if (is_array(${'_FILES'})) 
   { 
      unset_vars(${'_FILES'}); 
   } 

   if (is_array(${'HTTP_POST_FILES'})) 
   { 
      unset_vars(${'HTTP_POST_FILES'}); 
   }

REPLACE WITH

// Unset globally registered vars - PHP5 ... hhmmm 
if (@$ini_val('register_globals') == '1' || strtolower(@$ini_val('register_globals')) == 'on') 
{ 
   $var_prefix = 'HTTP'; 
   $var_suffix = '_VARS'; 
    
   $test = array('_GET', '_POST', '_SERVER', '_COOKIE', '_ENV'); 

   foreach ($test as $var) 
   { 
      if (is_array(${$var_prefix . $var . $var_suffix})) 
      { 
         unset_vars(${$var_prefix . $var . $var_suffix}); 
         @reset(${$var_prefix . $var . $var_suffix}); 
      } 

      if (is_array(${$var})) 
      { 
         unset_vars(${$var}); 
         @reset(${$var}); 
      } 
   } 

   if (is_array(${'_FILES'})) 
   { 
      unset_vars(${'_FILES'}); 
      @reset(${'_FILES'}); 
   } 

   if (is_array(${'HTTP_POST_FILES'})) 
   { 
      unset_vars(${'HTTP_POST_FILES'}); 
      @reset(${'HTTP_POST_FILES'}); 
   } 
} 

// PHP5 with register_long_arrays off? 
if (!isset($HTTP_POST_VARS) && isset($_POST)) 
{ 
   $HTTP_POST_VARS = $_POST; 
   $HTTP_GET_VARS = $_GET; 
   $HTTP_SERVER_VARS = $_SERVER; 
   $HTTP_COOKIE_VARS = $_COOKIE; 
   $HTTP_ENV_VARS = $_ENV; 
   $HTTP_POST_FILES = $_FILES; 
}

There was one bug introduced by a security fix in 2.0.9 making submitting
board settings with single quotes (for example the board description) buggy.
This has been fixed by the following change:

Open admin/admin_board.php

FIND - Line 46

      $default_config[$config_name] = str_replace("'", "\'", $config_value);

REPLACE WITH

      $default_config[$config_name] = isset($HTTP_POST_VARS['submit']) ? str_replace("'", "\'", $config_value) : $config_value;

There was a problem caused by the unsetting of global vars. Because the
style system itself makes two variables global, deleting styles no longer
worked. To fix this problem, the following change is necessary:

Open admin/admin_styles.php

FIND - Line 49

require('./pagestart.' . $phpEx);

AFTER, ADD

$confirm = ( isset($HTTP_POST_VARS['confirm']) ) ? TRUE : FALSE; 
$cancel = ( isset($HTTP_POST_VARS['cancel']) ) ? TRUE : FALSE;

Some users reported problems with the jumpbox not working within the
moderator control panel. The fix:

Open includes/functions.php

FIND - Line 190

   if ( !empty($SID) ) 
   { 
      $boxstring .= '<input type="hidden" name="sid" value="' . $userdata['session_id'] . '" />'; 
   }

REPLACE WITH

   // Let the jumpbox work again in sites having additional session id checks. 
//   if ( !empty($SID) ) 
//   { 
      $boxstring .= '<input type="hidden" name="sid" value="' . $userdata['session_id'] . '" />'; 
//   }

Amit Klein and Ory Segal reported a vulnerability with redirects (Apache users
are not affected by this), which is fixed by these changes:

Open includes/functions.php

FIND - Line 743

   if (!empty($db)) 
   { 
      $db->sql_close(); 
   }

AFTER, ADD

   if (strstr(urldecode($url), "\n") || strstr(urldecode($url), "\r")) 
   { 
      message_die(GENERAL_ERROR, 'Tried to redirect to potentially insecure url.'); 
   }

Open login.php

FIND - Line 96

               $redirect = ( !empty($HTTP_POST_VARS['redirect']) ) ? str_replace('&', '&', htmlspecialchars($HTTP_POST_VARS['redirect'])) : ''; 
               $redirect = str_replace('?', '&', $redirect);

AFTER, ADD

               if (strstr(urldecode($redirect), "\n") || strstr(urldecode($redirect), "\r")) 
               { 
                  message_die(GENERAL_ERROR, 'Tried to redirect to potentially insecure url.'); 
               }

FIND - Line 116

         $redirect = ( !empty($HTTP_POST_VARS['redirect']) ) ? str_replace('&', '&', htmlspecialchars($HTTP_POST_VARS['redirect'])) : ""; 
         $redirect = str_replace("?", "&", $redirect);

AFTER, ADD

               if (strstr(urldecode($redirect), "\n") || strstr(urldecode($redirect), "\r")) 
               { 
                  message_die(GENERAL_ERROR, 'Tried to redirect to potentially insecure url.'); 
               }

Searching for authors sometimes lead to no results, even if the author existed. This is due to special
chars within the username, now searching for these is working correctly:

Open search.php

FIND - Line 62

   $search_author = ( isset($HTTP_POST_VARS['search_author']) ) ? $HTTP_POST_VARS['search_author'] : $HTTP_GET_VARS['search_author'];

AFTER, ADD

   $search_author = htmlspecialchars($search_author);

 

[starboy_tehran]

به نظر مياد چيز مهمي نبوده
چون اصلا كسي نگاهش نكرد
باشه
موفق باشيد

 

[Delphiran]

آخرين نسخه phpBB 2.10 را به دو صورت "نسخه كامل" و "فقط فايلهاي تغيير يافته" ميتونيد از http://phpbb.delphishop.com دريافت كنيد.

 

[starboy_tehran]

Delphiran جان
شما با استفاده از اين كدها اين ورژن رو گذاشتيد رو سايت ؟
مي خوام ببينم مفيد بوده يا نه
اگه بوده كه كپي رايت داره :دي