Security bug announced, xhelp 0.71 released - Modules - XOOPS News

XOOPS

News

News World of XOOPS Developers Hacks Themes Archive Submit News

Modules: Security bug announced, xhelp 0.71 released

Posted by: ackbarrOn 2005/3/30 18:30:28 5872 reads

In response to a security bug discovered by Brian Erdelyi @ SecurityHive.com that allowed users to view other users tickets, we have released xhelp 0.71 to address this issue. In addition we included a couple bug fixes for xhelp 0.7. All users are recommended to upgrade to the latest package.

Changes in 0.71:
1. Fixed email activation link not being sent to new users (eric_juden)
2. Fixed uploading files with undefined mimetypes bug (eric_juden)
3. Fixed bug for ticket subject length being too short in edit ticket (eric_juden)
4. Fixed bug for fatal error while in staff profiles (eric_juden)
5. Security!!! Fixed bug for users being allowed to look at other user's tickets (eric_juden)

The comments are owned by the author. We aren't responsible for their content.

screwed layout on tickets.php after upgrade

stmatrix Published 04/05/2005 12:42 Just popping in Joined 01/14/2005 Comments 43

I upgraded from 0.7 to 0.71 and got into a familliar problem. The layout of my website is getting messed up when entering the ticket screen (ticket.php). On all other screens everything seems fine. I also get a error with php-debug switched on:

 Warning: Call-time pass-by-reference has been deprecated - argument passed by value; If you would like to pass it by reference, modify the declaration of [runtime function name](). If you would like to enable call-time pass-by-reference, you can set allow_call_time_pass_reference to true in your INI file. However, future versions may not support this any longer. in /home/sites/site412/web/modules/xhelp/ticket.php on line 201

I had the same problem with a previous upgrade and it got fixed with help from ejuden (iirc). I searched the site here but can't seem to find that information. I remember there was some typo in the code that needed fixing.

Re: screwed layout on tickets.php after upgrade

ackbarr Published 04/05/2005 13:01 Joined 10/02/2002 Comments 1449

Change:

if($hTickets->delete(&$ticketInfo)){

to:

if($hTickets->delete($ticketInfo)){

Re: screwed layout on tickets.php after upgrade

stmatrix Published 04/05/2005 13:11 Just popping in Joined 01/14/2005 Comments 43

ok, problem solved (again). Thanks a lot.

I'll take it that this typo will be removed in the next release

Re: screwed layout on tickets.php after upgrade

ackbarr Published 04/05/2005 19:20 Joined 10/02/2002 Comments 1449

it has already been removed from the 0.75 branch of code, 0.71 was a quick security release based on 0.70 so it did not have this fix implemented in it.

bug in addTicket.php

aemsonis Published 04/07/2005 9:01 Just popping in Joined 12/02/2004 Comments 3

hello,
when i tried to post a ticket under a user,
i've got the following error :

Parse error: parse error in /home/sites/www.sonis.net/html/modules/xhelp/addTicket.php on line 171

xoops version : 2.0.9.2 fr

i don't see in lines 170 and 171 what could possibly display this error.
is it something you remarked please?

Re: bug in addTicket.php

ackbarr Published 04/07/2005 14:24 Joined 10/02/2002 Comments 1449

please use the xhelp development site to submit bugs or ask for support.

Can you please include lines 170 and 171 from your addTicket.php file? Also, please include what type of webserver your site on which your site is running, and the versions of the software running on the server.

Thanks

Login

Username

Password

Remember me

Search

Advanced Search

Donat-O-Meter

Stats
Goal:	$100.00
Due Date:	Nov 30
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

{{ record.commit.author.name }} {{ record.commit.author.date | formatDate }}

Modules: Security bug announced, xhelp 0.71 released

screwed layout on tickets.php after upgrade

Re: screwed layout on tickets.php after upgrade

Re: screwed layout on tickets.php after upgrade

Re: screwed layout on tickets.php after upgrade

bug in addTicket.php

Re: bug in addTicket.php

Login

Search

Recent Comments

Re: New Admin Theme for XOOPS (Beta)

Sanford Pharmacy: Exceptional Pharmacy Services Tailored to You

Re: New Admin Theme for XOOPS (Beta)

Re: XOOPS 2.5.12 Beta-2 available for Testing

Re: XOOPS 2.5.12 Beta-2 available for Testing

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

Archives

News archives