5.01 Question

[WB]

In the 5.01 list it states:

"There is also a security fix applied to the member.php file which adds one line (an intval) to plug a possible security hole with PP5.0."

Just to make sure I'm reading that right, I take it that the potential issue is 5 specific and isn't in 4.86?

We're about to test 5 on our newly purchased test install license but want to make sure that our main 4.86 install is okay in the meantime until we finish our test upgrade.

Thanks!

[Michael P]

Yes, this could potentially effect 4.86 users and we'll be doing a mailing shortly. You can fix this by changing this one line in member.php, line 32:

Content visible to verified customers only.

[WB]

Michael:

Thanks.

We went from:

if ( empty($uid) || !isset($uid) ) $uid = $User['userid'];

to

if ( empty($uid) || !isset($uid) || !is_numeric($uid) ) $uid = $User['userid'];

in member.php.

Thanks for the quick reply.

[SaN-DeeP]

thnx fixed 4.86