It seems like it's hunting season for IPB.

As much as it's a pain to have to keep releasing updates, it'd be even worse to not release them.

The announcement is here: http://forums.invisionpower.com/index.php?showtopic=169215

Here are the affected files for IPB 2.0.x

Exactly right. Thanks.

It is better to know something is being done as soon as these things are discovered than not to do anything just because some users don't want to upgrade or because it would mean IPB has security issues.

Again, thank you.

Thanks Matt!

Thanks Matt.

Yep thanks, i like updates/bug fixes

Thanks Matt.

Thank you, Matt! Good to know our boards are well protected.

Matt,
Are you still considering the security audit for IPB? If you do get it, I think you should finish IPB 2.1.0 final completely, and before you release it to customers have it audited first.

If you ask me i will say it is up to the singel user if the wan to test the 2.1 or not, if they wanna be secure stay with 2.0.4 but if they test 2.1 the are not securet...

Just my 5 cent

I don't think you understood what I asked, Nukeman.

:- I were a bit to quick

thanks for the update, get back to work on 2.1! :whip:

Thanks Matt.

Matt, after I uploaded those two files no one could post or PM.
I'm running v2.0.4

I don't got that problem, have you uploadet correct ?

Do you get an error of anykind?

I checked the fixes before releasing them as I have a separate IPB 2.0.4 test board.

Parse error: parse error, unexpected $, expecting T_OLD_FUNCTION or T_FUNCTION or T_VAR or '}' in /............./public_html/forums/sources/post.php on line 2115

whats on 2115 Line #

thanks for constantly fixing the security issues


--------------------

i feel more secure knowing Matt is always on top of this security issues

Matt, everytime we have a new Release, could you please add the files as an upgrade kit in the Client Centre, Even perhaps Increment the version number. This would encourage people to upgrde to the next Release more I think.

Dumb question but, have the main files been updated?

They have

my point exactly


--------------------

Dumb me, I should have read the Company News and Updates forum first.

Thanks!

Thank you!

Thanks Matt

Thankie Doodle

YAY just did it.

Thanks for posting the updates as often as they have been coming. Makes me feel warm and fuzzy in my heart

Thanks Matt, Well Done indeed.

That simply what make IPB rules.

Great work Matt!

I have a question about this lastest security patch. It says to apply the sources/lib/usercp_functions.php edit to the spot for the user's avatar, but similar code exists in the spot for user's photo as well:

Is this function not prone to the same exploit that the official patch was for? Shouldn't the patch be applied here as well?

Thanks for the update

for Fusoya i think you are right so it would look like this

Thanks

Thanks, can we get an official word on whether that is needed or if the vulnerability for this is patched elsewhere?

Can FuSoYa matters conform by the staff here? thanks Will78.

I notice as well the upgarde file been change, myabe thay do it already.

This is great. IPB has beta testers out there looking for bugs for us all the time. You couldn't ask for anything better.

I noticed that too FuS

I almost added the code there instead of the avatar section

Bump - Anyone know?

Can Matt or any of the IPB staff conform this? Thanks in advanced.