actualizado el dia en ke salio, perfecto, me anda de lujo
El proceso de actualizacion bueno, subir todos los archivos al server y sobreescribir los antiguos (tuve que reescribir todos los hacks a los archivos nuevos), y luego abrir el script de upgrade, el cual te toma unos 2 minutos en total.....
OJO Que la unica falla de seguridad grande es la del INIT.php, aki dejo la lista de cambios si no quieren actualizar todo
CHANGES MADE FROM 3.0.3 to 3.0.5
Código PHP:
############### OPEN FILE INCLUDES/INIT.PHP ##################
################## FIND CODE ##################
error_reporting(E_ALL & ~E_NOTICE);
################## AFTER ADD ##################
function vb_error_handler($errno, $errstr, $errfile, $errline)
{
if (!error_reporting())
{
return;
}
switch ($errno)
{
case E_WARNING:
case E_USER_WARNING:
$errfile = str_replace(getcwd(), '', $errfile);
echo "<br /><strong>Warning</strong>: $errstr in <strong>$errfile</strong> on line <strong>$errline</strong><br />";
break;
}
}
set_error_handler('vb_error_handler');
################## FIND CODE ##################
if (is_array($GLOBALS))
{
foreach ($GLOBALS AS $_arrykey => $_arryval)
{
if (!in_array($_arrykey, $_allowedvars) AND $_arrykey != '_arrykey' AND $_arrykey != '_arryval')
{
unset($GLOBALS["$_arrykey"]);
}
}
}
else
{
$GLOBALS['_GET'] = &$_GET;
$GLOBALS['_POST'] = &$_POST;
$GLOBALS['_COOKIE'] = &$_COOKIE;
$GLOBALS['_SERVER'] = &$_SERVER;
$GLOBALS['_ENV'] = &$_ENV;
$GLOBALS['_FILES'] = &$_FILES;
}
################## REPLACE CODE WITH ##################
if (is_array($GLOBALS))
{
function deregister_globals($_allowedvars)
{
foreach ($GLOBALS AS $_arrykey => $_arryval)
{
if (!in_array($_arrykey, $_allowedvars) AND $_arrykey != '_arrykey' AND $_arrykey != '_arryval')
{
unset($GLOBALS["$_arrykey"]);
}
}
}
deregister_globals($_allowedvars);
}
else
{
die('<strong>Fatal Error:</strong> Invalid URL.');
}
################## FIND CODE ##################
$script = preg_replace('#(\?.*)#', '', $scriptpath);
################## AFTER ADD ##################
if (!defined('THIS_SCRIPT') AND strpos(strtolower($script), 'global.php') !== false)
{
die('<p><strong>Critical Error</strong><br />global.php must not be called directly.</p>');
}
################## FIND CODE ##################
$stylechoosercache = array();
################## AFTER ADD ##################
if (!is_array($specialtemplates))
{
$specialtemplates = array();
}
################## FIND CODE ##################
WHERE title IN ('" . implode("', '", $specialtemplates) . "')
################## REPLACE CODE WITH ##################
WHERE title IN ('" . implode("', '", array_map('addslashes', $specialtemplates)) . "')
################## FIND CODE ##################
unset($storeitem);
$DB_site->free_result($datastoretemp);
}
}
}
################## AFTER ADD ##################
// referrer check for POSTs
if (strtoupper($_SERVER['REQUEST_METHOD']) == 'POST' AND !defined('SKIP_REFERRER_CHECK'))
{
if ($_SERVER['HTTP_HOST'] OR $_ENV['HTTP_HOST'])
{
$http_host = ($_SERVER['HTTP_HOST'] ? $_SERVER['HTTP_HOST'] : $_ENV['HTTP_HOST']);
}
else if ($_SERVER['SERVER_NAME'] OR $_ENV['SERVER_NAME'])
{
$http_host = ($_SERVER['SERVER_NAME'] ? $_SERVER['SERVER_NAME'] : $_ENV['SERVER_NAME']);
}
if ($http_host AND $_SERVER['HTTP_REFERER'])
{
$referrer_parts = parse_url($_SERVER['HTTP_REFERER']);
$http_host = preg_replace('#^www\.#i', '', $http_host);
$thishost = preg_quote($http_host . !empty($referrer_parts['port']) ? ":$referrer_parts[port]" : '', '#');
$refhost = $referrer_parts['host'] . !empty($referrer_parts['port']) ? ":$referrer_parts[port]" : '';
if (!preg_match('#' . $thishost . '$#siU', $refhost))
{
die("POST requests from foreign hosts are not allowed.");
}
}
}
CHANGES MADE FROM 3.0.4 to 3.0.5
Código PHP:
############### OPEN FILE INCLUDES/INIT.PHP ##################
################## FIND CODE ##################
error_reporting(E_ALL & ~E_NOTICE);
################## AFTER ADD ##################
function vb_error_handler($errno, $errstr, $errfile, $errline)
{
if (!error_reporting())
{
return;
}
switch ($errno)
{
case E_WARNING:
case E_USER_WARNING:
$errfile = str_replace(getcwd(), '', $errfile);
echo "<br /><strong>Warning</strong>: $errstr in <strong>$errfile</strong> on line <strong>$errline</strong><br />";
break;
}
}
set_error_handler('vb_error_handler');
################## FIND CODE ##################
if (is_array($GLOBALS))
{
foreach ($GLOBALS AS $_arrykey => $_arryval)
{
if (!in_array($_arrykey, $_allowedvars) AND $_arrykey != '_arrykey' AND $_arrykey != '_arryval')
{
unset($GLOBALS["$_arrykey"]);
}
}
}
else
{
$GLOBALS['_GET'] = &$_GET;
$GLOBALS['_POST'] = &$_POST;
$GLOBALS['_COOKIE'] = &$_COOKIE;
$GLOBALS['_SERVER'] = &$_SERVER;
$GLOBALS['_ENV'] = &$_ENV;
$GLOBALS['_FILES'] = &$_FILES;
}
################## REPLACE CODE WITH ##################
if (is_array($GLOBALS))
{
function deregister_globals($_allowedvars)
{
foreach ($GLOBALS AS $_arrykey => $_arryval)
{
if (!in_array($_arrykey, $_allowedvars) AND $_arrykey != '_arrykey' AND $_arrykey != '_arryval')
{
unset($GLOBALS["$_arrykey"]);
}
}
}
deregister_globals($_allowedvars);
}
else
{
die('<strong>Fatal Error:</strong> Invalid URL.');
}
################## FIND CODE ##################
$stylechoosercache = array();
################## AFTER ADD ##################
if (!is_array($specialtemplates))
{
$specialtemplates = array();
}
################## FIND CODE ##################
$http_host = preg_replace('#^www\.#i', '', $http_host);
################## AFTER ADD ##################
$thishost = preg_quote($http_host . !empty($referrer_parts['port']) ? ":$referrer_parts[port]" : '', '#');
$refhost = $referrer_parts['host'] . !empty($referrer_parts['port']) ? ":$referrer_parts[port]" : '';
################## FIND CODE ##################
if (!preg_match('#' . preg_quote($http_host, '#') . '$#siU', $referrer_parts['host']))
################## REPLACE CODE WITH ##################
if (!preg_match('#' . $thishost . '$#siU', $refhost))