[2005/06/28] phpBB 2.0.16 安全性修正版本
發表於 : 2005-06-28 03:01
為了您的站台安全性起見，請務必立即進行更新，本次更新內容並不包含語系檔，所以繼續沿用之前語系檔即可。
Hi everyone,
phpBB Group announces the release of phpBB 2.0.16. This release addresses some bugfixes and one critical security issue. To fix this, please apply the following change:
In viewtopic.php(請使用編輯器開啟檔案 viewtopic.php 在修改前，請先記得備份檔案)
Find(找到下列的字串):
Replace with(覆蓋貼上後存檔):
What has changed in this release? (這次的更新修正了什麼呢？)
The changelog (contained within this release) is as follows:
- 以下為 2.0.15 升級到 2.0.16 的修改程序，請您在修改檔案之前一定要先備份檔案，並小心修改！
- 如果您的討論區並沒有安裝任何外掛，您可以嘗試覆蓋升級檔案後執行update_to_latest.php 這個資料庫升級檔案，請記得一定要執行這個檔案，否則您的更新無法順利完成還會出現錯誤訊息。
- update_to_latest.php 這個資料庫升級檔案，在解壓縮後的 install 裡面。
- 有安裝外掛的請在升級過後檢查您的外掛，如果有必要請重新安裝外掛。
此次更新內容轉載官方公告如下：
Hi everyone,
phpBB Group announces the release of phpBB 2.0.16. This release addresses some bugfixes and one critical security issue. To fix this, please apply the following change:
In viewtopic.php(請使用編輯器開啟檔案 viewtopic.php 在修改前，請先記得備份檔案)
Find(找到下列的字串):
代碼: 選擇全部
$message = str_replace('"', '"', substr(@preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se', "@preg_replace('#\b(" . str_replace('\\\', '\\\\\\\', $highlight_match) . ")\b#i', '<span style="color:#" . $theme['fontcolor3'] . ""><b>\\\\\\\1</b></span>', '\\\0')", '>' . $message . '<'), 1, -1)); 代碼: 選擇全部
$message = str_replace('"', '"', substr(@preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se', "@preg_replace('#\b(" . str_replace('\\\\', '\\\\\\\', addslashes($highlight_match)) . ")\b#i', '<span style="color:#" . $theme['fontcolor3'] . ""><b>\\\\\\\1</b></span>', '\\\0')", '>' . $message . '<'), 1, -1));The changelog (contained within this release) is as follows:
- Fixed critical issue with highlighting - Discovered and fix provided by Ron van Daal
- Url descriptions able to be wrapped over more than one line again
- Fixed bug with eAccelerator in admin_ug_auth.php
- Check new_forum_id for existence in modcp.php - alessnet
- Prevent uploading avatars with no dimensions - Xpert
- Fixed bug in usercp_register.php, forcing avatar file removal without updating avatar informations within the database - HenkPoley
- Fixed bug in admin re-authentication redirect for servers not having index.php as one of their default files set