Новая версия PHPBB

And_Y

Вот порядок обновления с 2.0.11 до 2.0.12 (выкладываю так как знаю, что многие используют PHPBB)

phpBB 2.0.11 to phpBB 2.0.12 Code Changes

These are the Changes from phpBB 2.0.11 to phpBB 2.0.12 summed up into a little Mod. This might be very helpful if you want to update your Board and have installed a bunch of Mods. Then it's normally easier to apply the Code Changes than to install all Mods again.

When you find a 'AFTER, ADD'-Statement, the Code have to be added after the last line quoted in the 'FIND'-Statement.
When you find a 'BEFORE, ADD'-Statement, the Code have to be added before the first line quoted in the 'FIND'-Statement.
When you find a 'REPLACE WITH'-Statement, the Code quoted in the 'FIND'-Statement have to be replaced completely with the quoted Code in the 'REPLACE WITH'-Statement.
When you find a 'DELETE'-Statement, the Code have to be deleted.

After you have finished this tutorial, you have to upload the update_to_latest.php file, execute it and then delete it from your webspace.

Ok, lets start:

admin/admin_db_utilities.php

FIND - Line 696
Код:

$tables = array('auth_access', 'banlist', 'categories', 'config', 'disallow', 'forums', 'forum_prune', 'groups', 'posts', 'posts_text', 'privmsgs', 'privmsgs_text', 'ranks', 'search_results', 'search_wordlist', 'search_wordmatch', 'sessions', 'smilies', 'themes', 'themes_name', 'topics', 'topics_watch', 'user_group', 'users', 'vote_desc', 'vote_results', 'vote_voters', 'words');

REPLACE WITH
Код:

$tables = array('auth_access', 'banlist', 'categories', 'config', 'disallow', 'forums', 'forum_prune', 'groups', 'posts', 'posts_text', 'privmsgs', 'privmsgs_text', 'ranks', 'search_results', 'search_wordlist', 'search_wordmatch', 'sessions', 'smilies', 'themes', 'themes_name', 'topics', 'topics_watch', 'user_group', 'users', 'vote_desc', 'vote_results', 'vote_voters', 'words', 'confirm');

admin/index.php

FIND - Line 562
Код:

 "L_NO_GUESTS_BROWSING" => $lang['No_users_browsing'])
 );
}

AFTER, ADD
Код:

// Check for new version
$current_version = explode('.', '2' . $board_config['version']);
$minor_revision = (int) $current_version[2];

$errno = 0;
$errstr = $version_info = '';

if ($fsock = @fsockopen('www.phpbb.com', 80, $errno, $errstr))
{
 @fputs($fsock, "GET /updatecheck/20x.txt HTTP/1.1\r\n");
 @fputs($fsock, "HOST: www.phpbb.com\r\n");
 @fputs($fsock, "Connection: close\r\n\r\n");

 $get_info = false;
 while (!@feof($fsock))
 {
 if ($get_info)
 {
 $version_info .= @fread($fsock, 1024);
 }
 else
 {
 if (@fgets($fsock, 1024) == "\r\n")
 {
 $get_info = true;
 }
 }
 }
 @fclose($fsock);

 $version_info = explode("\n", $version_info);
 $latest_head_revision = (int) $version_info[0];
 $latest_minor_revision = (int) $version_info[2];
 $latest_version = (int) $version_info[0] . '.' . (int) $version_info[1] . '.' . (int) $version_info[2];

 if ($latest_head_revision == 2 && $minor_revision == $latest_minor_revision)
 {
 $version_info = '' . $lang['Version_up_to_date'] . '';
 }
 else
 {
 $version_info = '' . $lang['Version_not_up_to_date'];
 $version_info .= ' ' . sprintf($lang['Latest_version_info'], $latest_version) . sprintf($lang['Current_version_info'], '2' . $board_config['version']) . '';
 }
}
else
{
 if ($errstr)
 {
 $version_info = '' . sprintf($lang['Connect_socket_error'], $errstr) . '';
 }
 else
 {
 $version_info = '' . $lang['Socket_functions_disabled'] . '';
 }
}

$version_info .= '' . $lang['Mailing_list_subscribe_reminder'] . '';

$template->assign_vars(array(
 'VERSION_INFO' => $version_info,
 'L_VERSION_INFORMATION' => $lang['Version_information'])
);

common.php

FIND - Line 56
Код:

$test = array('HTTP_GET_VARS' => NULL, 'HTTP_POST_VARS' => NULL, 'HTTP_COOKIE_VARS' => NULL, 'HTTP_SERVER_VARS' => NULL, 'HTTP_ENV_VARS' => NULL, 'HTTP_POST_FILES' => NULL);

REPLACE WITH
Код:

$test = array('HTTP_GET_VARS' => NULL, 'HTTP_POST_VARS' => NULL, 'HTTP_COOKIE_VARS' => NULL, 'HTTP_SERVER_VARS' => NULL, 'HTTP_ENV_VARS' => NULL, 'HTTP_POST_FILES' => NULL, 'phpEx' => NULL, 'phpbb_root_path' => NULL);
FIND - Line 75
Код:

else if (@ini_get('register_globals') == '1' || strtolower(@ini_get('register_globals')) == 'on')
{
// PHP4+ path

AFTER, ADD
Код:

$not_unset = array('HTTP_GET_VARS', 'HTTP_POST_VARS', 'HTTP_COOKIE_VARS', 'HTTP_SERVER_VARS', 'HTTP_SESSION_VARS', 'HTTP_ENV_VARS', 'HTTP_POST_FILES', 'phpEx', 'phpbb_root_path');
FIND - Line 92
Код:

unset($input['input']);

while (list($var,) = @each($input))
{
   unset($$var);
}

REPLACE WITH
Код:

unset($input['input']);
unset($input['not_unset']);

while (list($var,) = @each($input))
{
   if (!in_array($var, $not_unset))
   {
      unset($$var);
   }
}
FIND - Line 207
Код:

$client_ip = ( !empty($HTTP_SERVER_VARS['REMOTE_ADDR']) ) ? $HTTP_SERVER_VARS['REMOTE_ADDR'] : ( ( !empty($HTTP_ENV_VARS['REMOTE_ADDR']) ) ? $HTTP_ENV_VARS['REMOTE_ADDR'] : $REMOTE_ADDR );

REPLACE WITH
Код:

$client_ip = ( !empty($HTTP_SERVER_VARS['REMOTE_ADDR']) ) ? $HTTP_SERVER_VARS['REMOTE_ADDR'] : ( ( !empty($HTTP_ENV_VARS['REMOTE_ADDR']) ) ? $HTTP_ENV_VARS['REMOTE_ADDR'] : getenv('REMOTE_ADDR') );

includes/functions.php

FIND - Line 80
Код:

$username = htmlspecialchars(rtrim(trim($username), "\\"));
$username = substr(str_replace("\\'", "'", $username), 0, 25);
$username = str_replace("'", "\\'", $username);

REPLACE WITH
Код:

$username = substr(htmlspecialchars(str_replace("\'", "'", trim($username))), 0, 25);
$username = phpbb_rtrim($username, "\\");
$username = str_replace("'", "\'", $username);
FIND - Line 83
Код:

return $username;
}

AFTER, ADD
Код:

// added at phpBB 2.0.12 to fix a bug in PHP 4.3.10 (only supporting charlist in php >= 4.1.0)
function phpbb_rtrim($str, $charlist = false)
{
if ($charlist === false)
{
 return rtrim($str);
}

$php_version = explode('.', PHP_VERSION);

// php version < 4.1.0
if ((int) $php_version[0] < 4 || ((int) $php_version[0] == 4 && (int) $php_version[1] < 1))
{
 while ($str{strlen($str)-1} == $charlist)
 {
 $str = substr($str, 0, strlen($str)-1);
 }
}
else
{
 $str = rtrim($str, $charlist);
}

return $str;
}
FIND - Line 608
Код:

$debug_text .= ' Line : ' . $err_line . ' File : ' . $err_file;

REPLACE WITH
Код:

$debug_text .= ' Line : ' . $err_line . ' File : ' . basename($err_file);

includes/page_tail.php

FIND - Line 38
Код:

'PHPBB_VERSION' => '2' . $board_config['version'],

REPLACE WITH
Код:

// 'PHPBB_VERSION' => '2' . $board_config['version'],

includes/template.php

FIND - Line 233
Код:

$filename = phpbb_realpath($this->root . '/' . $filename);

REPLACE WITH
Код:

$filename = ($rp_filename = phpbb_realpath($this->root . '/' . $filename)) ? $rp_filename : $filename;

includes/usercp_avatar.php

FIND - Line 54
Код:

{
global $board_config, $userdata;

AFTER, ADD
Код:

$avatar_file = basename($avatar_file);
FIND - Line 69
Код:

function user_avatar_gallery($mode, &$error, &$error_msg, $avatar_filename)
{
global $board_config;

AFTER, ADD
Код:

$avatar_filename = str_replace(array('../', '..\\', './', '.\\'), '', $avatar_filename);
if ($avatar_filename{0} == '/' || $avatar_filename{0} == "\\")
{
return '';
}
FIND - Line 235
Код:

         $move_file = 'copy';
      }

AFTER, ADD
Код:

      if (!is_uploaded_file($avatar_filename))
      {
         message_die(GENERAL_ERROR, 'Unable to upload file', '', __LINE__, __FILE__);
      }

includes/usercp_register.php

FIND - Line 462
Код:

$avatar_mode = ( !empty($user_avatar_name) ) ? 'local' : 'remote';

REPLACE WITH
Код:

$avatar_mode = (empty($user_avatar_name)) ? 'remote' : 'local';

language/lang_english/lang_admin.php

FIND
Код:

//
// That's all Folks!
// -------------------------------------------------

BEFORE, ADD
Код:

//
// Version Check
//
$lang['Version_up_to_date'] = 'Your installation is up to date, no updates are available for your version of phpBB.';
$lang['Version_not_up_to_date'] = 'Your installation does not seem to be up to date. Updates are available for your version of phpBB, please visit <a href="http://www.phpbb.com/downloads.php" target="_new">http://www.phpbb.com/downloads.php</a> to obtain the latest version.';
$lang['Latest_version_info'] = 'The latest available version is phpBB %s.';
$lang['Current_version_info'] = 'You are running phpBB %s.';
$lang['Connect_socket_error'] = 'Unable to open connection to phpBB Server, reported error is: %s';
$lang['Socket_functions_disabled'] = 'Unable to use socket functions.';
$lang['Mailing_list_subscribe_reminder'] = 'For the latest information on updates to phpBB, why not <a href="http://www.phpbb.com/support/" target="_new">subscribe to our mailing list</a>.';
$lang['Version_information'] = 'Version Information';

templates/subSilver/admin/index_body.tpl

FIND - Line 80
Код:

</table>

 

AFTER, ADD
Код:

<h1>{L_VERSION_INFORMATION}</h1>

{VERSION_INFO}

templates/subSilver/overall_footer.tpl

FIND - Line 8
Код:

Powered by phpBB {PHPBB_VERSION} line, with phpBB linked to www.phpbb.com. If you refuse
to include even this then support on our forums may be affected.

The phpBB Group : 2002
// -->
Powered by <a href="http://www.phpbb.com/" target="_phpbb" class="copyright">phpBB</a> {PHPBB_VERSION} © 2001, 2002 phpBB Group {TRANSLATION_INFO}</div>

REPLACE WITH
Код:

Powered by phpBB line, with phpBB linked to www.phpbb.com. If you refuse
to include even this then support on our forums may be affected.

The phpBB Group : 2002
// -->
Powered by <a href="http://www.phpbb.com/" target="_phpbb" class="copyright">phpBB</a> © 2001, 2005 phpBB Group {TRANSLATION_INFO}</div>

templates/subSilver/simple_footer.tpl

FIND - Line 8
Код:

Powered by phpBB {PHPBB_VERSION} line, with phpBB linked to www.phpbb.com. If you refuse
to include even this then support on our forums may be affected.

The phpBB Group : 2002
// -->
Powered by <a href="http://www.phpbb.com/" target="_phpbb" class="copyright">phpBB</a> {PHPBB_VERSION} © 2001,2002 phpBB Group</div>

REPLACE WITH
Код:

Powered by phpBB line, with phpBB linked to www.phpbb.com. If you refuse
to include even this then support on our forums may be affected.

The phpBB Group : 2002
// -->
Powered by <a href="http://www.phpbb.com/" target="_phpbb" class="copyright">phpBB</a> © 2001, 2005 phpBB Group</div>

viewtopic.php

FIND - Line 498
Код:

unset($words);

$highlight = urlencode($HTTP_GET_VARS['highlight']);

AFTER, ADD
Код:

$highlight_match = phpbb_rtrim($highlight_match, "\\");

Rastyapa

Srjeznaya tema. tolko nih..ya neponyatnaya. naverno 4eto extrimalnoe

Ace

Ну, смотри, видишь как все просто

Приделай нам еще че-нибудь к форуму...

And_Y

Чат наверное завтра прикручу. День рождения форума будем отмечать? :-)

29 февраля, т.е. 1 марта получается

Ace

ну если тока вечером погонять стрит?

и потом попить пивка...

And_Y

phpBB Group announces the release of phpBB 2.0.13, the "Beware of the furries" edition. This release addresses two recent security exploits, one of them critical. They were reported a few days after .12 was released and no one is more annoyed than us, having to release a new version in such a short period of time.
Fortunately both fixes are easy and in each case just one line needs to be edited.

The first issue is critical (session handling allowing everyone gaining administrator rights) and we urge you to fix it on your forums as soon as possible:

Open includes/sessions.php

Find:
Code:
if( $sessiondata['autologinid'] == $auto_login_key )

Replace with:
Code:
if( $sessiondata['autologinid'] === $auto_login_key )

A second minor issue reported to bugtraq several days ago was the path disclosure bug in viewtopic.php which got fixed by applying the following steps:

Open viewtopic.php

Find:
Code:
$message = str_replace('\"', '"', substr(preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se', "preg_replace('#\b(" . $highlight_match . ")\b#i', '\\\\1', '\\0')", '>' . $message . '<'), 1, -1));

Replace with:
Code:
$message = str_replace('\"', '"', substr(@preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se', "@preg_replace('#\b(" . $highlight_match . ")\b#i', '\\\\1', '\\0')", '>' . $message . '<'), 1, -1));

As with all new releases we urge you to upgrade as soon as possible. You can of course find this download available on our downloads page. As per usual three packages are available to simplify your upgrade.

Новая версия PHPBB

Кто сейчас на конференции