There is a security related bug fix with active.asp. This is a serious fix that can allow someone to achieve admin role in a forum.
To addthe fix, in active.,asp, where you now have, in lines#123-130:
if Request.Form("AllRead") = "Y" then
'## The redundant line below is necessary, don't delete it.
Session(strCookieURL & "last_here_date") = Request.Form("BuildTime")
Session(strCookieURL & "last_here_date") = Request.Form("BuildTime")
lastDate = Session(strCookieURL & "last_here_date")
UpdateLastHereDate Request.Form("BuildTime"),strDBNTUserName
ActiveSince = ""
end if
Replace them by
if Request.Form("AllRead") = "Y" then
lastDate = Request.Form("BuildTime")
If Not isValidForumDateString(lastDate) Then
lastDate = DatetoStr(strForumTimeAdjust)
End If
'## The redundant line below is necessary, don't delete it.
Session(strCookieURL & "last_here_date") = lastDate
Session(strCookieURL & "last_here_date") = lastDate
UpdateLastHereDate lastDate,strDBNTUserName
ActiveSince = ""
end if
Then, in inc_func_common.asp, replace the code for the UpdateLastHereDate function (starting around line# 575) by the two functions below:
function UpdateLastHereDate(fTime,UserName)
UserIPAddress = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
If UserIPAddress = "" or Left(UserIPAddress, 7) = "unknown" Then
UserIPAddress = Request.ServerVariables("REMOTE_ADDR")
ElseIf InStr(UserIPAddress, ",") > 0 Then
UserIPAddress = Left(UserIPAddress, InStr(UserIPAddress, ",")-1)
ElseIf InStr(UserIPAddress, ";") > 0 Then
UserIPAddress = Left(UserIPAddress, InStr(UserIPAddress, ";")-1)
End If
If InStr(UserIPAddress, ":") > 0 then
UserIPAddress = Left(UserIPAddress, InStr(UserIPAddress, ":")-1)
End If
If Not isValidForumDateString(fTime) Then
fTime = DateToStr(strForumTimeAdjust)
End If
'## Forum_SQL - Do DB Update
strSql = "UPDATE " & strMemberTablePrefix & "MEMBERS "
strSql = strSql & " SET M_LASTHEREDATE = '" & fTime & "'"
strSql = strSql & ", M_LAST_IP = '" & UserIPAddress & "'"
strSql = strSql & " WHERE " & strDBNTSQLName & " = '" & ChkString(UserName, "SQLString") & "' "
my_conn.Execute (strSql),,adCmdText + adExecuteNoRecords
end function
function isValidForumDateString(fDate)
set regEx = New RegExp
regEx.Global = true
regEx.Pattern = "^[123][0-9]{13}$"
retVal = regEx.Test(fDate)
set regEx = nothing
if Not retVal Then
isValidForumDateString = false
Else
isValidForumDateString = true
end if
end function
Fix updated by ruirib - 8th April, 2008<