Phorum 3.2.8 Released / Security Update
| From: | Jason Birch | Date: | Thu, 23 Nov 2000 20:00:04 +0000 |
| Subject: | Phorum 3.2.8 Released / Security Update | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-26861@lists.php.net to get a copy of this message | ||
It has been brought to our attention that the recent security fix did
not entirely remove the possibility of exploiting a file include in
Phorum. To deal with this recent report, we have released a new
version of the Phorum code, 3.2.8. Those of you running Phorum can use
the information in this post to fix your existing installation. This
is a serious issue, and we advise users to take corrective action as
soon as possible.
Many thanks go to Joao Gouveia for reporting this problem and working
with us to make Phorum safer for our users.
To apply this fix, either replace your current common.php file with
the version found in the 3.2.8 release package, or identify the
following code segment in common.php and modify it as instructed.
First, find the section near the end of common.php that starts with:
require ($inf_file);
and ends with:
require ("./plugin/plugin.php");
Replace the code bounded by these lines with the following code:
require ($inf_file);
if($num || $f){
if($f) $num=$f;
$num=(int) $num;
if(file_exists("$admindir/forums/$num.php")){
include "$admindir/forums/$num.php";
if($ForumLang!=""){
include ("./".$ForumLang);
}
}
else{
header("Location: $forum_url/$forum_page.$ext");
}
}
else {
include ("./".$default_lang);
}
require ("./plugin/plugin.php");
Jason Birch
-------------------------------------------------------------------------
Phorum Dev Team - http://phorum.org/
Making better forums with PHP
-------------------------------------------------------------------------