As it was recently
reported, and security issue provided by 'Rino', miniBB can be exploited to execute intrusion JavaScript code.
I personally think despite their theory, these issues are very vague and hard to imitate in practice. Anyway carrying about secure software, we weren't brave to ignore them and did the following updates:
1) In the
Human Authorization (Captcha) add-on, there is a minor update in
addon_authorize.php file. Please note we didn't change the version of the add-on because this issue doesn't affect any kind of the new development in this add-on. Premium customers will just need to download the version from their downloads area and overwrite this file.
2) In the miniBB core, there is update regarding
bb_cookie.php file's function called
getMyCookie. The new condition now will strictly deny any kind of cookie containing < or > signs (which are required to put if you execute JavaScript
plant (previously, there was a security fix only removing clear slashes in the username).
These issues have very low practical importance, however I hope they will be appreciated by a hacking theory followers ;-)
