phpBB.de

Balint hat geschrieben:Ich habe dieses Mal (ich bin mit dem Board seit 2.0.1 dabei) das Patchfile benutzt. Ich habe zwar keinen Zugriff auf den Unix-Befehl patch, konnte aber eine Win32-Portierung finden, die gut funktioniert hat. Ich bekomme von den veränderten Dateien ein *.orig und manchmal ein *.rej, in denen mißlungene Änderungen drin sind. Diese habe ich manuell nachgeprüft und verändert.

itst hat geschrieben:Solche Fragen bitte im passenden Forum (Installation & Update) posten.

Henne23 hat geschrieben:Kannst mal die Parameter angeben, die du verwendet hast.
Hast du sonst noch was geändert (im Vorfeld)?

Ich bin heute glaube ich zu blöd...

[...]With this done you should run the following command: patch -cl -d [PHPBB DIRECTORY] -p1 < [PATCH NAME] [...]

We've been informed that a possible SQL injection vulnerability has been released to various lists and sites. The issue is unlikely to affect many users given the requirements that surround it.

stefan hat geschrieben:As Announced on www.phpbb.com:

We've been informed that a possible SQL injection vulnerability has been released to various lists and sites. The issue is unlikely to affect many users given the requirements that surround it.

The problem is easily fixed, open viewtopic.php and before:

Code: Alles auswählen

if ( isset($HTTP_GET_VARS[POST_TOPIC_URL]) ) 
{ 
      $topic_id = intval($HTTP_GET_VARS[POST_TOPIC_URL]); 
} 
else if ( isset($HTTP_GET_VARS['topic']) ) 
{ 
      $topic_id = intval($HTTP_GET_VARS['topic']); 
}

add:

Code: Alles auswählen

$topic_id = $post_id = false;

Scroll down and find:

Code: Alles auswählen

$join_sql_table = ( !isset($post_id) ) ? '' : ", " . POSTS_TABLE . " p, " . POSTS_TABLE . " p2 "; 
$join_sql = ( !isset($post_id) ) ? "t.topic_id = $topic_id" : "p.post_id = $post_id AND t.topic_id = p.topic_id AND p2.topic_id = p.topic_id AND p2.post_id <= $post_id"; 
$count_sql = ( !isset($post_id) ) ? '' : ", COUNT(p2.post_id) AS prev_posts"; 

$order_sql = ( !isset($post_id) ) ? '' : "GROUP BY p.post_id, t.topic_id, t.topic_title, t.topic_status, t.topic_replies, t.topic_time, t.topic_type, t.topic_vote, t.topic_last_post_id, f.forum_name, f.forum_status, f.forum_id, f.auth_view, f.auth_read, f.auth_post, f.auth_reply, f.auth_edit, f.auth_delete, f.auth_sticky, f.auth_announce, f.auth_pollcreate, f.auth_vote, f.auth_attachments ORDER BY p.post_id ASC";

Change that to:

Code: Alles auswählen

$join_sql_table = ( empty($post_id) ) ? '' : ", " . POSTS_TABLE . " p, " . POSTS_TABLE . " p2 "; 
$join_sql = ( empty($post_id) ) ? "t.topic_id = $topic_id" : "p.post_id = $post_id AND t.topic_id = p.topic_id AND p2.topic_id = p.topic_id AND p2.post_id <= $post_id"; 
$count_sql = ( empty($post_id) ) ? '' : ", COUNT(p2.post_id) AS prev_posts"; 

$order_sql = ( empty($post_id) ) ? '' : "GROUP BY p.post_id, t.topic_id, t.topic_title, t.topic_status, t.topic_replies, t.topic_time, t.topic_type, t.topic_vote, t.topic_last_post_id, f.forum_name, f.forum_status, f.forum_id, f.auth_view, f.auth_read, f.auth_post, f.auth_reply, f.auth_edit, f.auth_delete, f.auth_sticky, f.auth_announce, f.auth_pollcreate, f.auth_vote, f.auth_attachments ORDER BY p.post_id ASC";

I would like to add that (as now typical ...) we were given practically no time to fix this issue before it appeared on the web.