Zabezpieczenie BBCode i użycia javascript

[DawPi]

IP.Board 2.3.4 Security Enhancements

We are releasing a minor security update to address issues recently reported regarding areas of IP.Board 2.3.4. These security issues are rather low priority and the impact is minimal due to other security features in the software.

Issue

Due to Internet Explorer's overly zealous and often ambitious parsing engine, specifically crafted BBCodes can contain javascript. This issue is mitigated due to the use of httpOnly cookies which makes this more of a nuisance than a genuine threat.

Patching Your IP.Board

The IP.Board 2.3.4 download in the client area has already been updated with the required changes. If you download IP.Board after the date of this announcement your installation will be up to date.

Changed Files

Download the zip file below which includes only the changed files for this update. Simply upload and overwrite the old files.

http://forums.invisionpower.com/index.php?...st&id=16288

Zobacz cały artykuł

Manual zmian:

Otwórz plik: sources/classes/bbcode/class_bbcode_core.php

Znajdź:

  //-----------------------------------------
	// Don't let emos in URL..
	//-----------------------------------------

	if ( $this->parse_smilies )
	{
		if ( count( $this->ipsclass->cache['emoticons'] ) > 0 )
		{
			foreach( $this->ipsclass->cache['emoticons'] as $row)
			{
				$code	= $row['typed'];
				$code	= str_replace( '<', '<', str_replace( '>', '>', $code ) );	

				if( strpos( $url, $code ) )
				{
					$new  = '';

					for( $i=0; $i<strlen($code); $i++ )
					{
						//print dechex(ord($code{$i})).'<Br>';
						$new .= '%' . dechex(ord($code{$i}));
					}

					$url = str_replace( $code, $new, $url );
				}
			}
		}
	}

	$url = htmlspecialchars($url);

Znajdź:

  //-----------------------------------------
	// Don't let emos in URL..
	//-----------------------------------------

	if ( $this->parse_smilies )
	{
		if ( count( $this->ipsclass->cache['emoticons'] ) > 0 )
		{
			foreach( $this->ipsclass->cache['emoticons'] as $row)
			{
				$code	= $row['typed'];
				$code	= str_replace( '<', '<', str_replace( '>', '>', $code ) );	

				if( strpos( $url['html'], $code ) )
				{
					$new  = '';

					for( $i=0; $i<strlen($code); $i++ )
					{
						//print dechex(ord($code{$i})).'<Br>';
						$new .= '%' . dechex(ord($code{$i}));
					}

					$url['html'] = str_replace( $code, $new, $url['html'] );
				}
			}
		}
	}

Znajdź:

  //-----------------------------------------
	// clean up the ampersands / brackets
	//-----------------------------------------

Dodaj poniżej:

$url['html'] = htmlspecialchars( $url['html'] );