Revision 353
Added by ryan almost 19 years ago
trunk/CHANGELOG | ||
---|---|---|
11 | 11 |
! = Update/Change |
12 | 12 |
|
13 | 13 |
------------------------------------- 2.6.4 ------------------------------------- |
14 |
20-May-2006 Ryan Djurovich |
|
15 |
# Fixed security issues related to #237 |
|
14 | 16 |
19-May-2006 Ryan Djurovich |
15 | 17 |
# Fixed problem in forgotten login form where email field is too short (#207) |
16 | 18 |
# Fixed typo in forgotten login details email (#190) |
19 |
15-May-2006 Stefan Braunewell |
|
20 |
# Fixed security issues (#237) |
|
17 | 21 |
03-May-2006 Stefan Braunewell |
18 | 22 |
# Fixed problems with pre-2.6.0 modules in section list |
19 | 23 |
# Fixed e-mail bug caused by From: headers in internal mail function calls |
trunk/wb/admin/preferences/details.php | ||
---|---|---|
29 | 29 |
$admin = new admin('Preferences'); |
30 | 30 |
|
31 | 31 |
// Get entered values |
32 |
$display_name = $admin->add_slashes($admin->get_post('display_name'));
|
|
32 |
$display_name = $wb->add_slashes(strip_tags($admin->get_post('display_name')));
|
|
33 | 33 |
$language = $admin->get_post('language'); |
34 | 34 |
$timezone = $admin->get_post('timezone')*60*60; |
35 | 35 |
$date_format = $admin->get_post('date_format'); |
trunk/wb/admin/preferences/email.php | ||
---|---|---|
48 | 48 |
$admin->print_error($MESSAGE['USERS']['INVALID_EMAIL']); |
49 | 49 |
} |
50 | 50 |
|
51 |
$email = $wb->add_slashes($email); |
|
52 |
|
|
51 | 53 |
// Update the database |
52 | 54 |
$database = new database(); |
53 | 55 |
$query = "UPDATE ".TABLE_PREFIX."users SET email = '$email' WHERE user_id = '".$admin->get_user_id()."'"; |
trunk/wb/account/details.php | ||
---|---|---|
29 | 29 |
} |
30 | 30 |
|
31 | 31 |
// Get entered values |
32 |
$display_name = $wb->get_post('display_name');
|
|
32 |
$display_name = $wb->add_slashes(strip_tags($wb->get_post('display_name')));
|
|
33 | 33 |
$language = $wb->get_post('language'); |
34 | 34 |
$timezone = $wb->get_post('timezone')*60*60; |
35 | 35 |
$date_format = $wb->get_post('date_format'); |
trunk/wb/account/email.php | ||
---|---|---|
49 | 49 |
$wb->print_error($MESSAGE['USERS']['INVALID_EMAIL'], $js_back, false); |
50 | 50 |
} |
51 | 51 |
|
52 |
$email = $wb->add_slashes($email); |
|
53 |
|
|
52 | 54 |
// Update the database |
53 | 55 |
$database = new database(); |
54 | 56 |
$query = "UPDATE ".TABLE_PREFIX."users SET email = '$email' WHERE user_id = '".$wb->get_user_id()."' AND password = '".md5($current_password)."'"; |
Also available in: Unified diff
Fixed more security issue's related to ticket #237