2
A patch will be published during the night (in 6-7 hours).
In the meantime if your server is endangered, you can apply the fix manually...
- Open mainfile.php
- Add the following lines around the end, just above the "if"
foreach (array('GLOBALS', '_SESSION', 'HTTP_SESSION_VARS', '_GET', 'HTTP_GET_VARS', '_POST', 'HTTP_POST_VARS', '_COOKIE', 'HTTP_COOKIE_VARS', '_REQUEST', '_SERVER', 'HTTP_SERVER_VARS', '_ENV', 'HTTP_ENV_VARS', '_FILES', 'HTTP_POST_FILES', 'xoopsDB', 'xoopsUser', 'xoopsUserId', 'xoopsUserGroups', 'xoopsUserIsAdmin', 'xoopsConfig', 'xoopsOption', 'xoopsModule', 'xoopsModuleConfig', 'xoopsRequestUri') as $bad_global) {
if (isset($_REQUEST[$bad_global])) {
header('Location: '.XOOPS_URL.'/');
exit();
}
}
So it looks like:
foreach (array(
.... CODE ABOVE....
}
if (!isset($xoopsOption['nocommon']) && XOOPS_ROOT_PATH != '') {
include XOOPS_ROOT_PATH."/include/common.php";
}
PS: If you have the protector module installed then the snippet has to be inserted before the "precheck" include (nevertheless, a site with protector is shielded against this vulnerability).
skalpa.>
Any intelligent fool can make things bigger, and more complex. It takes a touch of genius, a lot of courage, to move in the opposite direction.
Two things are infinite: the universe and human stupidity; and I'm not sure about the 1st one (A.Einstein)
