10 Jun 2010, 20:24
New Zenner
- Join Date:
- Apr 2008
- Posts:
- 1
- Plugin Contributions:
- 0
(minor) sql injection possible from $nick in phpBB linkage
Hi, I'm sure this must have been addressed by now, but I'm pretty sure that a clean install of 1.3.9d has an sql parsing failure when the phpBB linkage is activated.
The $nick variable is needs to have backslashes added before line 148 of create_account.php (it i used in both this file and includes/classes/class.phpbb.php).
Also note that in class.phpbb.php line 185, users_table.username_clean should have certain characters replaced with others (as phpbb does) and otherwise the users with certain characters in their username will not be able to log into phpbb once registered.
Again, not a huge problem but I figured you should know about it in case it hadn't been brought up before.
Thanks,
daigo