Date: Sat, 1 May 2004 11:20:12 -0700 (PDT) From: Xin LI <delphij@frontfree.net> To: freebsd-ports-bugs@FreeBSD.org Subject: Re: ports/66150: [PATCH] SECURITY UPDATE ports/www/phpbb for IP spoofing vulnerablity Message-ID: <200405011820.i41IKB3P093370@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR ports/66150; it has been noted by GNATS.
From: Xin LI <delphij@frontfree.net>
To: FreeBSD-gnats-submit@FreeBSD.org
Cc: vuxml@FreeBSD.org, Kang LIU <liukang@bjut.edu.cn>,
portmgr@FreeBSD.org
Subject: Re: ports/66150: [PATCH] SECURITY UPDATE ports/www/phpbb for IP spoofing vulnerablity
Date: Sun, 2 May 2004 02:10:52 +0800
--45Z9DzgjV8m4Oswq
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Oops, forgot the attachment, it should be:
Index: includes/sessions.php
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
RCS file: /cvsroot/phpbb/phpBB2/includes/Attic/sessions.php,v
retrieving revision 1.58.2.10
diff -u -r1.58.2.10 sessions.php
--- includes/sessions.php 5 Apr 2003 12:04:33 -0000 1.58.2.10
+++ includes/sessions.php 17 Apr 2004 07:48:20 -0000
@@ -147,7 +147,7 @@
$sql =3D "INSERT INTO " . SESSIONS_TABLE . "
(session_id, session_user_id, session_start, session_time, session_ip, =
session_page, session_logged_in)
VALUES ('$session_id', $user_id, $current_time, $current_time, '$user_i=
p', $page_id, $login)";
- if ( !$db->sql_query($sql) )
+ if ( $user_id !=3D ANONYMOUS && !$db->sql_query($sql) )
{
message_die(CRITICAL_ERROR, 'Error creating new session', '', __LINE__,=
__FILE__, $sql);
}
@@ -380,4 +380,4 @@
return $url;
}
=20
-?>
\ No newline at end of file
+?>
--=20
Xin LI <delphij frontfree net> http://www.delphij.net/
See complete headers for GPG key and other information.
--45Z9DzgjV8m4Oswq
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)
iD8DBQFAk+gsOfuToMruuMARAi/8AJ966cGY3YBeCFYs5ANmxhG1kd00sACffDrw
eHQuUJbkKwTBaeNADCLmxdY=
=PtF9
-----END PGP SIGNATURE-----
--45Z9DzgjV8m4Oswq--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200405011820.i41IKB3P093370>