Security Vulnerability... yet another sad story with register_globals set to ON in php.ini

Recently discovered vulnerability, again, is related to the hosting servers, which have register_globals setting turned ON in php.ini. Despite I agree it's our fault this error appeared in the latest release, most importantly it means you have a very insecure hosting, when having turned this on.

Read more info on PHP site:

http://php.net/manual/en/security.registerglobals.php

Issue to solve is top paste at the very top of each of these files:

bb_func_forums.php
bb_func_txt.php
bb_functions.php

the following line:

if (!defined('INCLUDED776')) die ('Fatal error.');

these files are updated in the freshly issued updated package.

Everybody still is recommended to do this short upgrade.

It is possible to write in .htaccess: php_flag register_globals off
Does it help?

It may help only on servers where it's allowed...

It breaks the RSS feed plugin.

Goran

krko
Download the latest version of RSS addon from Downloads section. It has been updated already to be compliant with the latest miniBB release. Also as 1st page news addon has been updated, too.

Actually this line of code should appear in any addon using mentioned updated scripts:

define ('INCLUDED776',1);

Krko

Do you have the latest setup_mysql.php file in your forum folder?

My RSS feed was also broken until I included just that file itself along with the other one (setup_[insert the name of your database here].php).

Actually this line of code should appear in any addon using mentioned updated scripts:

define ('INCLUDED776',1);

Where should it be? At the very top?

What about file upload and private messaging plugin? Do they need to be updated?

At the very top? - yes.

Addons do not contain this hole, they all are already secured... thus remember - they are not publically distributed.

A friend of mine sent me this link today -

http://www.securityfocus.com/bid/20757/info

is it about the same security issue (already solved by adding the line you mention)?

Karel

Karel II
This is bogus, about 5-10 lines above it includes a file which declares $pathToFiles.

include ('./setup_options.php');