Administrative Note

[Wes]

I conducted an edit of the viewtopic.php file in accordance with this post on PHPBB.com for security reasons.

// 
// Was a highlight request part of the URI? 
// 
$highlight_match = $highlight = ''; 
if (isset($HTTP_GET_VARS['highlight'])) 
{ 
   // Split words and phrases 
   $words = explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight'])))); 

   for($i = 0; $i < sizeof($words); $i++) 
   {

was replaced with

// 
// Was a highlight request part of the URI? 
// 
$highlight_match = $highlight = ''; 
if (isset($HTTP_GET_VARS['highlight'])) 
{ 
   // Split words and phrases 
   $words = explode(' ', trim(htmlspecialchars($HTTP_GET_VARS['highlight']))); 

   for($i = 0; $i < sizeof($words); $i++) 
   {

 

[Tyler]

Supposedly, what did the change do?

 

[Wes]

There was a possibility someone could use quotes in a certain way in the highlight field to insert extra code and do stuff to people's cookies and other worse stuff.