VDS под LiveStreet CMS
VDS под LiveStreet CMS
Здравствуйте!
В LiveStreet CMS 0.5.1 обнаружена XSS уязвимость.
Патч, исправляющий баг — github.com/livestreet/livestreet/commit/7c9f79c2ebafc9ba1694c3c850ba8299aeef1ac3
Подробнее можно прочитать здесь — livestreet.ru/blog/dev_livestreet/10536.html
С уважением, команда LiveStreet CMS
<div id="comment_id_{$oComment->getId()}" class="comment {if !$oUserCurrent or ($oUserCurrent and !$oUserCurrent->isAdministrator())}not-admin{/if} {if $oComment->getDelete()} deleted{elseif $oUserCurrent and $oComment->getUserId()==$oUserCurrent->getId()} self{elseif $sDateReadLast<=$oComment->getDate()} new{/if}" >
{if $oTopic and $oComment->getUserId() == $oTopic->getUserId()}topicstart{/if}
<div id="comment_id_{$oComment->getId()}" class="comment {if !$oUserCurrent or ($oUserCurrent and !$oUserCurrent->isAdministrator())}not-admin{/if} {if $oComment->getDelete()} deleted{elseif $oUserCurrent and $oComment->getUserId()==$oUserCurrent->getId()} self{elseif $sDateReadLast<=$oComment->getDate()} new{/if} {if $oTopic and $oComment->getUserId() == $oTopic->getUserId()}topicstart{/if}" >
.comment.topicstart { background: #желаемый цвет; }
<div id="comment_id_{$oComment->getId()}" class="comment {if !$oUserCurrent or ($oUserCurrent and !$oUserCurrent->isAdministrator())}not-admin{/if} {if $oComment->getDelete()} deleted{elseif $oUserCurrent and $oComment->getUserId()==$oUserCurrent->getId()} self{elseif $sDateReadLast<=$oComment->getDate()} new{/if}" >
{if $oUser->isAdministrator()}admin{else}user{/if}
<div id="comment_id_{$oComment->getId()}" class="comment {if !$oUserCurrent or ($oUserCurrent and !$oUserCurrent->isAdministrator())}not-admin{/if} {if $oComment->getDelete()} deleted{elseif $oUserCurrent and $oComment->getUserId()==$oUserCurrent->getId()} self{elseif $sDateReadLast<=$oComment->getDate()} new{/if} {if $oUser->isAdministrator()}admin{else}user{/if}" >
.comment.admin { background: #желаемый цвет; }
$this->DropInviteRegister();
$this->Hook_Run('user_add_after', array('oUser' => $oUser));
$this->DropInviteRegister();
$this->Viewer_Assign('bRefreshToHome', true);
$this->User_Authorization($oUser, false);
$this->Hook_Run('user_add_activation_after', array('oUser' => $oUser))
<img src="{cfg name='path.root.engine_lib'}/external/kcaptcha/index.php?{$_sPhpSessionName}={$_sPhpSessionId}" onclick="this.src='{cfg name='path.root.engine_lib'}/external/kcaptcha/index.php?{$_sPhpSessionName}={$_sPhpSessionId}&n='+Math.random();" />
<p><input type="text" name="captcha" value="" maxlength="3" class="input-100" /></p>
<script type="text/javascript" src="http://api.recaptcha.net/challenge?k=ЗДЕСЬ_ВАШ_Public_Key">
</script><noscript>Включите JavaScript или обновите ваш браузер!</noscript>
<script type="text/javascript">
var RecaptchaOptions = {
custom_translations : {
instructions_visual : "Введите два слова:",
instructions_audio : "Введите что вы слышите",
play_again : "Включить заново",
cant_hear_this : "Скачать в формате MP3",
visual_challenge : "Визуальный режим",
audio_challenge : "Режим аудио",
refresh_btn : "Обновить",
help_btn : "Помощь",
incorrect_try_again : "Неверно. Пожалуйста, попробуйте еще раз.",
},
lang : 'ru', // Unavailable while writing this code (just for audio challenge)
theme : 'white' // Make sure there is no trailing ',' at the end of the RecaptchaOptions dictionary
};
</script>
require_once ($_SERVER['DOCUMENT_ROOT']."/engine/lib/external/recaptcha/recaptchalib.php");
if (!isset($_SESSION['captcha_keystring']) or $_SESSION['captcha_keystring']!=strtolower(getRequest('captcha'))) {
$this->Message_AddError($this->Lang_Get('registration_captcha_error'),$this->Lang_Get('error'));
$bError=true;
$resp = null;
if (array_key_exists('recaptcha_response_field',$_POST)){
$resp = recaptcha_check_answer ('ЗДЕСЬ_ВАШ_Private_Key',$_SERVER["REMOTE_ADDR"],$_POST["recaptcha_challenge_field"],$_POST["recaptcha_response_field"]);}
if ($resp==null or !$resp->is_valid){
$this->Message_AddError($this->Lang_Get('registration_captcha_error'),$this->Lang_Get('error'));
$bError=true;
}