This morning I received information about an XSS exploit in the shoutbox. A user can plant malicious code via the shout_name field. Knowing my code, I immediatey knew the same trick can be done in comments. Two fixes then which are comments_include.php and shoutbox_panel.php. Existing v6.00.303 users can download the file '6.00.304 update for v6.00.303'. Simply upload the inluded files and click upgrade under System Admin. The Sourceforge packages have also been updated as usual. Thanks to Ruyn for the heads up
Feb 11 2006 @ 19:30 Update I've been informed of a weakness in the $srch_text variable in messages.php. I've added the updated file to the 304 patch and have updated the Sourceforge packages. Thanks to system_meltdown for letting me know.
