Jump to content

Invision Community Blog


Managing successful online communities

bfarber
Sign in to follow this  
 

IP.Board 3.3.x, 3.4.x Security Update

We are releasing a patch for IP.Board 3.3.x and 3.4.x to address two CSRF issues and one XSS issue.

It has been brought to our attention that a cross site request forgery issue exists with gravatar images that can allow a potential attacker to cause a user to store a gravatar profile photo that was not desired.  Further, during internal reviews of the issue we discovered another CSRF issue that can allow an attacker to mark all private messages as read. Finally, a minor "self XSS" issue has also been patched with this update.


To apply the patch
Simply download the attached zip for your IP.Board version and upload the files to your forum server.

IP.Board 3.3.x:

 patch_33x_Feb2015.zip

IP.Board 3.4.x:

 patch_34x_Feb2015.zip

If you are an IPS Community in the Cloud client running IP.Board 3.4 or above, no further action is necessary as we have already automatically patched your account. If you are using a version older than IP.Board 3.4, you should contact support to upgrade.

If you install or upgrade to IP.Board 3.4.7 after the date and time of this post, no further action is necessary as we have already updated the main download zips.

We extend our thanks to Daniel Price, A.K.A ShadeSpeed of the GameMaker Community for notifying us of the gravatar issue privately and promptly.

Sign in to follow this  

Comments



Recommended Comments

Hello, I downloaded archive and inside a folder called "admin". In which folder to attach: in the root directory of the site       /public_html    or     /public_html/admin?

Thanks in advance and thanks for the update .

Share this comment


Link to comment
Share on other sites

Hello, I downloaded archive and inside a folder called "admin". In which folder to attach: in the root directory of the site       /public_html    or     /public_html/admin?

Thanks in advance and thanks for the update .

​Wherever you installed the software at is where "admin" goes. If it's on the root directory then just upload it to the root directory if it's on a subdomain do the same.

 

Also thanks for the update, guys!

Share this comment


Link to comment
Share on other sites

Hi there, after update it appears that alphabetical name sort does not work. Does anyone have a fix for this?

Basically when any letter is pressed it shows ALL members list

thanks

Share this comment


Link to comment
Share on other sites
I can also confirm this patch has a bug or something. I am also getting the exact same issue on IP.Board 3.4.6 as bluejag stated above in his post.
 
The alphabetical name sort is working normally again as soon as I put back the original files on the server this patch replaces.
 
It is definitely something with the patch that is causing the malfunction of the alphabetical name sort.

Share this comment


Link to comment
Share on other sites
Hum...

In the new code for the list "view.php":

 

-               $this->request['quickjump']     = isset($this->request['quickjump']) ? $this->request['quickjump'] : 0;
+               $this->request['quickjump']     = isset($this->request['quickjump']) ? intval( $this->request['quickjump'] ) : 0;


This seems to be the cause of the issue!

Share this comment


Link to comment
Share on other sites

Isn't this something that would have been useful to announce within the admin panel? There was no notice in my admin backend regarding this.

​There is an announcement in the admincp, however the message is cached for a few hours, it will pick it up soon if it hasn't already.

Share this comment


Link to comment
Share on other sites

If you are on our community in the cloud, security updates are automatically applied for you.  :) 

 

 

​Excellent - this was the main reason we chose a hosted solution :)

btw. will the cloud-systems move to 4.0, when it is released?

Share this comment


Link to comment
Share on other sites

This has been noted internally and the team will look into this.  Thanks for the report. 

​When will this be fixed?

I can see the benefit of the security patch override the sort, but please address this as well.

Share this comment


Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Add a comment...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...