Forums Patched

[The Beatles]

Hello All,

I've finally patched up our forum software to close the security holes that were present in it. The Secunia Advisories of the holes I've patched, or verified the patch was installed for, are:

http://secunia.com/advisories/14329/
http://secunia.com/advisories/11053/
http://secunia.com/advisories/11008/
http://secunia.com/advisories/10530/
http://secunia.com/advisories/9883/
http://secunia.com/advisories/9712/
http://secunia.com/advisories/7154/
http://secunia.com/advisories/9266/
http://secunia.com/advisories/8182/
http://secunia.com/advisories/15265/
http://secunia.com/advisories/16348/ (This was much more subtle, it was actually disallowing multiple headers in one line and not sending them at all, which was undetected due to an @-call.)

Vulnerabilities I THINK I've fixed, but am not sure:
http://secunia.com/advisories/10446/

Not-patched, but not critical:
http://secunia.com/advisories/15545/

Most of them didn't apply to our version.

[Freenhult]

Way to go Beatles!

[Gen. Volkov]

Excellent job there!

[Slasher]

You're gonna be chuffed...

http://faf.staronesw.com/forum/index.php?act=Stats&CODE=leaders

"The Moderating Team"

needs fixing

Theres a fix on invisionize somewhere

but other than that, nice one

[Slasher]

This is a problem caused by your host upgrading their version of mySQL. It now uses the word 'mod' as a keyword, but this query was already using it, so it gets confused. To fix this, open sources/misc/stats.php and find:

code: Select all

    $DB->query("SELECT m2.id, m2.name, m2.email, m2.hide_email, m2.location, m2.aim_name, m2.icq_number,
                       f.id as forum_id, f.read_perms, f.name as forum_name, c.state
                FROM forum_moderators mod
                  LEFT JOIN forum_forums f ON(f.id=mod.forum_id)
                  LEFT JOIN forum_categories c ON(c.id=f.category AND c.state != 0)
                  LEFT JOIN forum_members m2 ON (mod.member_id=m2.id)
                ");

Change this to:

code: Select all

    $DB->query("SELECT m2.id, m2.name, m2.email, m2.hide_email, m2.location, m2.aim_name, m2.icq_number,
                       f.id as forum_id, f.read_perms, f.name as forum_name, c.state
                FROM forum_moderators moder
                  LEFT JOIN forum_forums f ON(f.id=moder.forum_id)
                  LEFT JOIN forum_categories c ON(c.id=f.category AND c.state != 0)
                  LEFT JOIN forum_members m2 ON (moder.member_id=m2.id)
                ");

Find this:

code: Select all

    $DB->query("SELECT m.id, m.name, m.email, m.hide_email, m.location, m.aim_name, m.icq_number,
                       f.id as forum_id, f.read_perms, f.name as forum_name, c.state
                FROM forum_moderators mod
                  LEFT JOIN forum_forums f ON(f.id=mod.forum_id)
                  LEFT JOIN forum_categories c ON(c.id=f.category AND c.state != 0)
                  LEFT JOIN forum_members m ON ((mod.is_group=1 and mod.group_id=m.mgroup))
                ");

Change to:

code: Select all

    $DB->query("SELECT m.id, m.name, m.email, m.hide_email, m.location, m.aim_name, m.icq_number,
                       f.id as forum_id, f.read_perms, f.name as forum_name, c.state
                FROM forum_moderators moder
                  LEFT JOIN forum_forums f ON(f.id=moder.forum_id)
                  LEFT JOIN forum_categories c ON(c.id=f.category AND c.state != 0)
                  LEFT JOIN forum_members m ON ((moder.is_group=1 and moder.group_id=m.mgroup))
                ");

Then save and upload.




Source: http://forums.invisionize.com/index.php?showtopic=70543

[The Beatles]

Someone posted a rather disgusting set of images here that I shan't dwell on.

[Slasher]

People keep doing that, I usually see them before any of you lot wake up, and Freenhult usually deletes them too... I think it might be an idea to install a mod that doesn't allow images or links to be added to posts until the post count is around about 10 at least or something like that.

[Death]

Was it the pain series or just pron?
*Might attract more things*

[Freenhult]

Most likely the latter.

[Death]

If it's that bad, I would suggest looking into more recent forum software. A lot of good free ones are out there, and you can transfer all the information you have.

[Slasher]

I'd recommend SMF if we have to change, but I like this one so if it can be patched that would be better.