Modo discussione | Modo lineare

**makpaolo** · 21-01-2008 09:18

Aggiornamento di Sicurezza: MyBB 1.2.12

Disponibile aggiornamento di sicurezza MyBB 1.2.12
in allegato i file da sostituire.

Si raccomanda l'aggiornamento IMMEDIATO della propria Board

[HIGH RISK] SQL Injection vulnerability in inc/datahandlers/pm.php
[MEDIUM RISK] XSRF vulnerabilities in various files (Note: Most require the user to have a moderator account)

Per l'aggiornamento della Board è necessario lanciare la procedura di Upgrade

Discussione ufficiale qui

Discussione sul nostro forum QUI

**mavericck** · 21-01-2008 21:29

I file modificati sono:

admin/
- usergroups.php
inc/
- class_core.php
- class_moderation.php
- class_session.php
- functions.php
- functions_upload.php
- datahandlers/
  - pm.php
- languages/
  - english.php
    - english/
    - global.lang.php
- install/
  - resources/
    - mybb_theme.xml
    - upgrade11.php
- jscripts/
  - thread.js
  - general.js
- polls.php
- editpost.php
- global.php
- search.php
- managegroup.php
- member.php
- report.php
- sendthread.php
- reputation.php
- stats.php
- usercp.php
- moderation.php
- newreply.php
- calendar.php
- private.php
- forumdisplay.php
- newthread.php
- ratethread.php
- xmlhttp.php
Bug corretti:
#19854 - Replying to a PM
#26121 - Saving Draft
#26138 - Smilies
#26218 - disable/modify stats.php
#26275 - Mass PM error
#26300 - link invisible bug
#26366 - Error when trying to delete polls.
#26422 - Wrong age shown in profile
#26494 - Forum password problems
#26673 - potential error in group permissions setting
#26674 - [split] cannot logout bug with sid
#26682 - small bug in editor.js
#26752 - Typo [ usercp.php ]
#26817 - blank page whene you export your pm's in .txt file
#26840 - Unneeded htmlspecialchars in original post after splitting (class_moderation.php)
#26846 - If no avatars exist in the default directory...
#26861 - add a thread together

Modo discussione \| Modo lineare Aggiornamento di Sicurezza: MyBB 1.2.12
Autore	Messaggio