Requirements checker doesn't send license key via HTTPS?

[Aaron M]

Posting here since email support is no longer a thing.

We noticed that L341 in the ips4.php requirements checker (ref https://invisioncommunity.com/files/file/7046-invision-community-requirements-checker/) attempts to communicate with the IPS licensing server through HTTP?? Is this not a security vulnerability by not using HTTPS - you're basically just transmitting the key in cleartext over unencrypted channels.

The line in question:

<?php if ( file_exists( 'conf_global.php' ) and isset( $mysql ) and $licensekey = @$mysql->query("SELECT * FROM core_sys_conf_settings WHERE conf_key='ipb_reg_number';") and $licensekey = @$licensekey->fetch_assoc() and $licensekey and $licensekey['conf_value'] and $lkeyData = @file_get_contents( "http://license.invisionpower.com/?a=info&key=%7B$licensekey[%27conf_value%27]%7D" ) and $lkeyData = json_decode( $lkeyData ) ): ?>

Recommend that gets changed to HTTPS asap. Cheers!

[Gary]

Hi @Aaron M,

The same level of support is available to all clients, it is just how you obtain it that has changed slightly. The Help & Support forum is your go to place for any help you need relating to our product suite and is staffed by our Team, but also opens up our community to assisting you as well if we don't get there first. We have the ability to transfer your topic to a ticket for issues that may require escalation.

I have tagged the devs to have a look at this to address any security concerns you have. Thanks for highlighting this for us.

[Ryan Ashbrook]

The current version of the file does appropriately use https.

<?php if ( file_exists( 'conf_global.php' ) and isset( $mysql ) and $licensekey = @$mysql->query("SELECT * FROM " . $INFO['sql_tbl_prefix'] . "core_sys_conf_settings WHERE conf_key='ipb_reg_number';") and $licensekey = @$licensekey->fetch_assoc() and $licensekey and $licensekey['conf_value'] and $lkeyData = @file_get_contents( "https://remoteservices.invisionpower.com/license/{$licensekey['conf_value']}", FALSE, $streamContext ) and $lkeyData = json_decode( $lkeyData, TRUE ) ): ?>

This was updated almost two years ago.

[Aaron M]

Perfect, thanks!