The Forum has been Updated
        The code has been upgraded to the latest .NET core version. Please check instructions in the Community Announcements about migrating your account.
    
                        There is a security related bug fix with active.asp. This is a serious fix that can allow someone to achieve admin role in a forum. 
To addthe fix, in active.,asp, where you now have, in lines#123-130:
Replace them by
Then, in inc_func_common.asp, replace the code for the UpdateLastHereDate function (starting around line# 575) by the two functions below:
Fix updated by ruirib - 8th April, 2008<
                To addthe fix, in active.,asp, where you now have, in lines#123-130:
Code:
if Request.Form("AllRead") = "Y" then
	'## The redundant line below is necessary, don't delete it.
	Session(strCookieURL & "last_here_date") = Request.Form("BuildTime")
	Session(strCookieURL & "last_here_date") = Request.Form("BuildTime")
	lastDate = Session(strCookieURL & "last_here_date")
	UpdateLastHereDate Request.Form("BuildTime"),strDBNTUserName
	ActiveSince = ""
end if
Replace them by
Code:
if Request.Form("AllRead") = "Y" then
	lastDate = Request.Form("BuildTime")
    If Not isValidForumDateString(lastDate) Then
        lastDate = DatetoStr(strForumTimeAdjust)
    End If
    '## The redundant line below is necessary, don't delete it.
    Session(strCookieURL & "last_here_date") = lastDate
    Session(strCookieURL & "last_here_date") = lastDate
    UpdateLastHereDate lastDate,strDBNTUserName
    ActiveSince = ""
end if
Code:
[code]
function UpdateLastHereDate(fTime,UserName)
	UserIPAddress = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
	If UserIPAddress = "" or Left(UserIPAddress, 7) = "unknown" Then
		UserIPAddress = Request.ServerVariables("REMOTE_ADDR")
	ElseIf InStr(UserIPAddress, ",") > 0 Then
		UserIPAddress = Left(UserIPAddress, InStr(UserIPAddress, ",")-1)
	ElseIf InStr(UserIPAddress, ";") > 0 Then
		UserIPAddress = Left(UserIPAddress, InStr(UserIPAddress, ";")-1)
	End If
	If InStr(UserIPAddress, ":") > 0 then
		UserIPAddress = Left(UserIPAddress, InStr(UserIPAddress, ":")-1)
	End If
	
	If Not isValidForumDateString(fTime) Then
		fTime = DateToStr(strForumTimeAdjust)
	End If
	
	'## Forum_SQL - Do DB Update
	strSql = "UPDATE " & strMemberTablePrefix & "MEMBERS "
	strSql = strSql & " SET M_LASTHEREDATE = '" & fTime & "'"
	strSql = strSql & ",    M_LAST_IP = '" & UserIPAddress & "'"
	strSql = strSql & " WHERE " & strDBNTSQLName & " = '" & ChkString(UserName, "SQLString") & "' "
 
	my_conn.Execute (strSql),,adCmdText + adExecuteNoRecords
end function
function isValidForumDateString(fDate)
	
	set regEx = New RegExp
	regEx.Global = true
	regEx.Pattern = "^[123][0-9]{13}$"
	retVal = regEx.Test(fDate)
	set regEx = nothing
	if Not retVal Then
           isValidForumDateString = false
	Else
           isValidForumDateString = true
	end if
end function
Fix updated by ruirib - 8th April, 2008<