[2006/04/07] phpBB 2.0.20 安全性修正版本釋出

[Mac]

phpBB 2.0.20 [ 完整安裝包 ]
phpBB 2.0.20 [ 只包含修改檔案 ]
phpBB 2.0.20 [ 只包含 Patch 檔案 ]
phpBB 2.0.20 [ 代碼差異指示 ] 1.0.1 版

# [修正] Prevent login attempts from incrementing for inactive users
# [修正] Do not check maximum login attempts on re-authentication to the admin panel - tomknight
# [修正] Regenerate session keys on password change
# [修正] retrieving category rows in index.php (Bug #90)
# [修正] improved index performance by determining the permissions before iterating through all forums (Bug #91)
# [修正] Better handling of short usernames within the search (bug #105)
# [修正] Send a no-cache header on admin pages as well as normal board pages (Bug #149)
# [修正] Apply word censors to the message when quoting it (Bug #405)
# [修正] Improved performance of query in admin_groups (Bug #753)
# [修正] Workaround for an issue in either PHP or MSSQL resulting in a space being returned instead of an empty string (bug #830)
# [修正] Correct use of default_style config value (Bug #861)
# [修正] Replace unneeded unset calls in admin_db_utilities.php - vanderaj
# [修正] Improved error handling in modcp.php
# [修正] Improved handling of forums to which the user does not have any explicit permissions - vanderaj
# [修正] Assorted fixes and cleanup of admin_ranks.php, now requires confirmation of deletions
# [修正] Assorted fixes and cleanup of admin_words.php, now requires confirmation of deletions
# [修正] Addition and editing of smilies can no longer be performed via GET, now requires confirmation of deletions
# [修正] Escape group names in admin_groups.php
# [改變] Changed handling of the case where a selected style doesn't exist in the database
# [改變] Changed handling of topic pruning to improve performance
# [改變] Changed default forum permissions to only allow registered users to post in new forums
# [安全修正] Replace strip_tags with htmlspecialchars in private message subject
# [安全修正] Some changes to HTML handling if enabled
# [安全修正] Escape any special characters in reverse dns - Anthrax101
# [安全修正] Typecast poll id values - Anthrax101
# [安全修正] Added configurable search flood control to reduce the effect of DoS style attacks
# [安全修正] Changed the way we create "random" values for use as keys - chinchilla/Anthrax101
# [安全修正] Enabled Visual Confirmation by default

中文安裝指示網頁版

如果你遇到了引言時出現奇怪亂碼，修正如下：

打開 includes/fucntions_post.php

尋找

代碼: 選擇全部

$message = addslashes($message);

之後, 加上

代碼: 選擇全部

$message = str_replace('"', '\\"', $message);

~Mac

[Mac]

這個是我個人先發佈的修正程式，如果有疑慮，請等官網發佈

在使用 phpBB-2.0.20-codechanges.zip 後，請做以下動作

打開

代碼: 選擇全部

privmsg.php

找到

代碼: 選擇全部

			if ( !($privmsg = $db->sql_fetchrow($result)) )
			{
				redirect(append_sid("privmsg.$phpEx?folder=$folder", true));
			}
			$privmsg_subject = preg_replace($orig_word, $replacement_word, $privmsg_subject);

取代為

代碼: 選擇全部

			if ( !($privmsg = $db->sql_fetchrow($result)) )
			{
				redirect(append_sid("privmsg.$phpEx?folder=$folder", true));
			}

找到

代碼: 選擇全部

			$privmsg_subject = ( ( !preg_match('/^Re:/', $privmsg['privmsgs_subject']) ) ? 'Re: ' : '' ) . $privmsg['privmsgs_subject'];

取代為

代碼: 選擇全部

			$orig_word = $replacement_word = array();
			obtain_word_list($orig_word, $replace_word);

			$privmsg_subject = ( ( !preg_match('/^Re:/', $privmsg['privmsgs_subject']) ) ? 'Re: ' : '' ) . $privmsg['privmsgs_subject'];
			$privmsg_subject = preg_replace($orig_word, $replacement_word, $privmsg_subject);

請看：官網版本

~Mac

[Mac]

第一個動作寫錯了
其實是刪掉

代碼: 選擇全部

         $privmsg_subject = preg_replace($orig_word, $replacement_word, $privmsg_subject);

或者是取代為

代碼: 選擇全部

         if ( !($privmsg = $db->sql_fetchrow($result)) )
         {
            redirect(append_sid("privmsg.$phpEx?folder=$folder", true));
         } 

以上文章已修正

~Mac

[mickeylam001]

can't download

[心靈捕手]

can't download

目前, (包含 Code Changes) 已經可以下載了.

參考連結:
http://www.phpbb.com/downloads.php
http://www.phpbb.com/phpBB/viewtopic.ph ... 51#2079351

[mickeylam001]

有中文化完整板嗎？

[jwxinst]

竹貓應該會在短時間內發佈~
大家也在期待

[mickeylam001]

thx a lot

[hsientsung]

這是新的版本耶，也一樣做了很多修正呢。也很期待中文版的出現，
辛苦了各位大大們～


也謝謝 Mac 率先修改了一些錯誤，其他相關錯誤就等官網發佈囉！

[CPC309001]

花了幾小時才升級到 PHPbb2.0.20.

●架設主機作業系統：Window 2000
●上網方式：WWW
●安裝的程式：php + MSSQL Server 2000
●phpBB2 版本：phpBB 2.0.20
●網站：http://www.waterhorse.com.tw/


CPC309001
04/10/2006

[oscerropper]

我也更新完畢了

語言方面lang\..\email的檔案都不需要改～因為都是改字母修正

至於lang_*新增了”搜索緩衝時間”的限制說明..

[hentaibbc]

這次需要改中文的地方...
多了一個「搜尋間隔時間」

其他的...
就是過濾文字、等級名稱、表情符號在移除時多了一個確認的動作

大概就這樣

[kljian]

phpBB 2.0.20 [ 代碼差異指示 ] 1.0.1 版

使用這個連結下載修正了兩小時也終於升級完成！

上網方式：虛擬主機

[spring53025]

請問一下 如果全新架的
是否只要安裝phpBB 2.0.20 [ 完整安裝包 ] 這個就好了???
其他三個是升級用的嗎?
感謝解答 謝謝

[chiouss]

請問一下 如果全新架的
是否只要安裝phpBB 2.0.20 [ 完整安裝包 ] 這個就好了???
其他三個是升級用的嗎?
感謝解答 謝謝

是