As you know a vulnerablity about function unserialize() is found in PHP <= 4.3.9
This can cause some crackings via newbb 1.0, because newbb uses unserialize() against $_COOKIE.
This is the security patches.
If your server's PHP still <= 4.3.9 and you use newbb 1.0, patch this.
Although I don't know newbb2, it may be safe because newbb looks it does not store informations of last_read in COOKIE.
le="color: #000000"><?php diff -rc newbb_old/index.php newbb/index.php *** newbb_old/index.php Fri Jan 30 08:28:30 2004 --- newbb/index.php Wed Dec 22 16:16:09 2004 *************** *** 75,81 **** continue; } // Read 'lastread' cookie, if exists ! $topic_lastread = !empty($HTTP_COOKIE_VARS['newbb_topic_lastread']) ? unserialize($HTTP_COOKIE_VARS['newbb_topic_lastread']) : array(); foreach ( $forums as $forum_row ) { unset($last_post); if ( $forum_row['cat_id'] == $categories[$i]['cat_id'] ) { --- 75,93 ---- continue; } // Read 'lastread' cookie, if exists ! //$topic_lastread = !empty($HTTP_COOKIE_VARS['newbb_topic_lastread']) ? unserialize($HTTP_COOKIE_VARS['newbb_topic_lastread']) : array(); ! // GIJ start ! if( empty( $_COOKIE['newbb_topic_lastread'] ) ) $topic_lastread = array(); ! else { ! $topic_lastreadtmp = explode( ',' , $_COOKIE['newbb_topic_lastread'] ) ; ! foreach( $topic_lastreadtmp as $tmp ) { ! $idmin = explode( '|' , $tmp ) ; ! $id = empty( $idmin[0] ) ? 0 : intval( $idmin[0] ) ; ! $min = empty( $idmin[1] ) ? 0 : intval( $idmin[1] ) ; ! $topic_lastread[ $id ] = $min * 60 ; ! } ! } ! // GIJ end foreach ( $forums as $forum_row ) { unset($last_post); if ( $forum_row['cat_id'] == $categories[$i]['cat_id'] ) { diff -rc newbb_old/post.php newbb/post.php *** newbb_old/post.php Fri Jan 30 08:28:30 2004 --- newbb/post.php Wed Dec 22 16:11:54 2004 *************** *** 45,50 **** --- 45,53 ---- } $forumdata = $xoopsDB->fetchArray($result); + // GIJ Patch + if( empty( $forumdata['allow_html'] ) ) $HTTP_POST_VARS['nohtml'] = 1 ; + if ( $forumdata['forum_type'] == 1 ) { // To get here, we have a logged-in user. So, check whether that user is allowed to view // this private forum. diff -rc newbb_old/viewforum.php newbb/viewforum.php *** newbb_old/viewforum.php Wed Feb 4 00:58:48 2004 --- newbb/viewforum.php Wed Dec 22 16:12:32 2004 *************** *** 192,198 **** } // Read topic 'lastread' times from cookie, if exists ! $topic_lastread = !empty($HTTP_COOKIE_VARS['newbb_topic_lastread']) ? unserialize($HTTP_COOKIE_VARS['newbb_topic_lastread']) : array(); while ( $myrow = $xoopsDB->fetchArray($result) ) { if ( empty($myrow['last_poster']) ) { --- 192,210 ---- } // Read topic 'lastread' times from cookie, if exists ! //$topic_lastread = !empty($HTTP_COOKIE_VARS['newbb_topic_lastread']) ? unserialize($HTTP_COOKIE_VARS['newbb_topic_lastread']) : array(); ! // GIJ start ! if( empty( $_COOKIE['newbb_topic_lastread'] ) ) $topic_lastread = array(); ! else { ! $topic_lastreadtmp = explode( ',' , $_COOKIE['newbb_topic_lastread'] ) ; ! foreach( $topic_lastreadtmp as $tmp ) { ! $idmin = explode( '|' , $tmp ) ; ! $id = empty( $idmin[0] ) ? 0 : intval( $idmin[0] ) ; ! $min = empty( $idmin[1] ) ? 0 : intval( $idmin[1] ) ; ! $topic_lastread[ $id ] = $min * 60 ; ! } ! } ! // GIJ end while ( $myrow = $xoopsDB->fetchArray($result) ) { if ( empty($myrow['last_poster']) ) { diff -rc newbb_old/viewtopic.php newbb/viewtopic.php *** newbb_old/viewtopic.php Thu Feb 5 03:43:44 2004 --- newbb/viewtopic.php Wed Dec 22 16:15:28 2004 *************** *** 348,354 **** $xoopsTpl->assign(array('forum_jumpbox' => make_jumpbox($forum), 'lang_forum_index' => sprintf(_MD_FORUMINDEX,$xoopsConfig['sitename']), 'lang_from' => _MD_FROM, 'lang_joined' => _MD_JOINED, 'lang_posts' => _MD_POSTS, 'lang_poster' => _MD_POSTER, 'lang_thread' => _MD_THREAD, 'lang_edit' => _EDIT, 'lang_delete' => _DELETE, 'lang_reply' => _REPLY, 'lang_postedon' => _MD_POSTEDON)); // Read in cookie of 'lastread' times ! $topic_lastread = !empty($HTTP_COOKIE_VARS['newbb_topic_lastread']) ? unserialize($HTTP_COOKIE_VARS['newbb_topic_lastread']) : array(); // if cookie is not set for this topic, update view count and set cookie if ( empty($topic_lastread[$topic_id]) ) { $sql = 'UPDATE '.$xoopsDB->prefix('bb_topics').' SET topic_views = topic_views + 1 WHERE topic_id ='. $topic_id; --- 348,366 ---- $xoopsTpl->assign(array('forum_jumpbox' => make_jumpbox($forum), 'lang_forum_index' => sprintf(_MD_FORUMINDEX,$xoopsConfig['sitename']), 'lang_from' => _MD_FROM, 'lang_joined' => _MD_JOINED, 'lang_posts' => _MD_POSTS, 'lang_poster' => _MD_POSTER, 'lang_thread' => _MD_THREAD, 'lang_edit' => _EDIT, 'lang_delete' => _DELETE, 'lang_reply' => _REPLY, 'lang_postedon' => _MD_POSTEDON)); // Read in cookie of 'lastread' times ! //$topic_lastread = !empty($HTTP_COOKIE_VARS['newbb_topic_lastread']) ? unserialize($HTTP_COOKIE_VARS['newbb_topic_lastread']) : array(); ! // GIJ eliminated unserialize ! if( empty( $_COOKIE['newbb_topic_lastread'] ) ) $topic_lastread = array(); ! else { ! $topic_lastreadtmp = explode( ',' , $_COOKIE['newbb_topic_lastread'] ) ; ! foreach( $topic_lastreadtmp as $tmp ) { ! $idmin = explode( '|' , $tmp ) ; ! $id = empty( $idmin[0] ) ? 0 : intval( $idmin[0] ) ; ! $min = empty( $idmin[1] ) ? 0 : intval( $idmin[1] ) ; ! $topic_lastread[ $id ] = $min * 60 ; ! } ! } ! // GIJ end // if cookie is not set for this topic, update view count and set cookie if ( empty($topic_lastread[$topic_id]) ) { $sql = 'UPDATE '.$xoopsDB->prefix('bb_topics').' SET topic_views = topic_views + 1 WHERE topic_id ='. $topic_id; *************** *** 356,362 **** } // Update cookie // FIXME: doesn't check if 4kB limit of cookie is exceeded! ! $topic_lastread[$topic_id] = time(); ! setcookie("newbb_topic_lastread", serialize($topic_lastread), time()+365*24*3600, $bbCookie['path'], $bbCookie['domain'], $bbCookie['secure']); include XOOPS_ROOT_PATH.'/footer.php'; ?> --- 368,389 ---- } // Update cookie // FIXME: doesn't check if 4kB limit of cookie is exceeded! ! // GIJ Patch begin ! //$topic_lastread[$topic_id] = time(); ! //setcookie("newbb_topic_lastread", serialize($topic_lastread), time()+365*24*3600, $bbCookie['path'], $bbCookie['domain'], $bbCookie['secure']); ! $topic_lastread[$topic_id] = intval( ceil( time() / 60 ) ) ; ! ! arsort($topic_lastread); ! ! $counter = 300 ; ! $str4cookie = '' ; ! foreach( $topic_lastread as $id => $time ) { ! $str4cookie .= intval( $id ) . '|' . intval( $time ) . ',' ; ! if( -- $counter < 0 ) break ; ! } ! $str4cookie = substr( $str4cookie , 0 , -1 ) ; ! ! setcookie("newbb_topic_lastread", $str4cookie , time()+365*24*3600, $bbCookie['path'], $bbCookie['domain'], $bbCookie['secure']); ! // GIJ Patch end include XOOPS_ROOT_PATH.'/footer.php'; ?>
