حل ثغرة XSS في النسخة Vbulletin 4.0.2

ابحث عن الملف دا دخل مجلد المنتدى على الامتداد التالى

vb/search/type.php


فى اخر الملف دا موجود الكلام ده

protected $form_globals = array (
'query' => TYPE_STR,
'searchuser' => TYPE_STR,
'exactname' => TYPE_BOOL,
'titleonly' => TYPE_BOOL,
'searchdate' => TYPE_NOHTML,
'beforeafter' => TYPE_NOHTML,
'contenttypeid' => TYPE_UINT,
'ajax' => TYPE_BOOL,
'tag' => TYPE_STR,
'type' => TYPE_ARRAY,
'humanverify' => TYPE_ARRAY,
'sortby' => TYPE_NOHTML,
'order' => TYPE_NOHTML,
'sortorder' => TYPE_NOHTML,
'saveprefs' => TYPE_BOOL,
'quicksearch' => TYPE_BOOL,
'search_type' => TYPE_BOOL,
'searchfromtype' => TYPE_STR,
'showposts' => TYPE_UINT,
'userid' => TYPE_UINT,
'starteronly' => TYPE_UINT,
'nocache' => TYPE_BOOL,
'natural' => TYPE_BOOL
);

استبدل بـ

protected $form_globals = array (


'query' => TYPE_NOHTML,
'searchuser' => TYPE_STR,
'exactname' => TYPE_BOOL,
'titleonly' => TYPE_BOOL,
'searchdate' => TYPE_NOHTML,
'beforeafter' => TYPE_NOHTML,
'contenttypeid' => TYPE_UINT,
'ajax' => TYPE_BOOL,
'tag' => TYPE_STR,
'type' => TYPE_ARRAY,
'humanverify' => TYPE_ARRAY,
'sortby' => TYPE_NOHTML,
'order' => TYPE_NOHTML,
'sortorder' => TYPE_NOHTML,
'saveprefs' => TYPE_BOOL,
'quicksearch' => TYPE_BOOL,
'search_type' => TYPE_BOOL,
'searchfromtype' => TYPE_STR,
'showposts' => TYPE_UINT,
'userid' => TYPE_UINT,
'starteronly' => TYPE_UINT,
'nocache' => TYPE_BOOL,
'natural' => TYPE_BOOL
);