XSS Vulnerability in IFrame Code in phpBB2 Plus 1.5x

phpBB2.de User Anmeldungsdatum: 05.01.2006 Beiträge: 41

morpha hat folgendes geschrieben:

Try that:

Code:

#
#----[OPEN]-----------------------------------------
#

includes/bbcode.php

#
#----[FIND]------------------------------------------
#

// [web]and[/web]
$text = preg_replace("#\[web\](http(s)?://)([a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+]+)\[/web\]#si", "[web:$uid]\\1\\3[/web:$uid]", $text);

#
#----[REPLACE WITH]-------------------------------
#

   // pass [web] only if poster is a admin
   global $userdata;
   if ($userdata['user_level'] == ADMIN)
   {
// [web]and[/web]
$text = preg_replace("#\[web\](http(s)?://)([a-z0-9\-\.,\?!%\*_\#:;~\\&$@\/=\+]+)\[/web\]#si", "[web:$uid]\\1\\3[/web:$uid]", $text);
   }
   // pass [web] only if poster is a admin

I think that should work Smile

can we make this for ADMIN AND MODERATORS?