Manual Security Patch Instructions for VB 4.x.x

[MK_1]

I fully agree with you, but your manual security path instructions are for ALL vB 4.x versions, too?

So I can't understand why the diff file has an additional step and is not similar to your steps.

[Mark.B]

Ok, i passed all instructions above and re-write files. What changes in forum working process now should I notice?

Nothing, as it is just a patch.

[_Avalon_]

If you are running 4.2.0 you will need to go through the manual instructions.

Ok, i passed all instructions above and re-write files. What changes in forum working process now should I notice?

[BirdOPrey5]

So you tell me that the diff file is not the latest version? Diff file and Joe's post are 90% similar, just this one step.

The diff files will work on ALL vBulletin 4.x versions. The diff files were provided because actual patches were not being released for older VB 4.x versions.

[BirdOPrey5]

Hello Mark B
can u plz let me know where are the manual instructions for vb 4.2.0

regards

This thread is the manual instructions for VB 4.2.0. They are the same instructions for ALL of VB 4.x.x, the code has not changed in years.

[MK_1]

That's from the diff file...you should follow the instructions in Joe's post.

So you tell me that the diff file is not the latest version? Diff file and Joe's post are 90% similar, just this one step.

[kandhro]

Hello Mark B
can u plz let me know where are the manual instructions for vb 4.2.0

regards

[BirdOPrey5]

4.2.0 Patch 4 does NOT contain the fix. The only patch version of 4.x that includes the fix is 4.2.2 Patch 1.

[Mark.B]

Good day, bit not clear, Is it not enough to rewrite files from Security patch: 4.2.0 Suite PL4?

If you are running 4.2.0 you will need to go through the manual instructions.

[_Avalon_]

Good day, bit not clear, Is it not enough to rewrite files from Security patch: 4.2.0 Suite PL4?

[Mark.B]

That's from the diff file...you should follow the instructions in Joe's post.

[MK_1]

I guess this part is missing:
In includes/functions_misc.php

@@ -773,7 +774,7 @@
 */
 function construct_hidden_var_fields($serializedarr)
 {
-    $temp = unserialize($serializedarr);
+    $temp = json_decode($serializedarr, true);
 
     if (!is_array($temp))
     {

http://www.vbulletin.com/forum/forum...x-of-vbulletin

[BirdOPrey5]

Function misc is wrong. You have included:
$string = json_encode($_POST); return '<input type="hidden" name="postvars" value="' . htmlspecialchars_uni(sign_client_string($string)) . '" />' . "\n"; But haven't removed it from the take out line, the forum doesn't function by following these instructions. If you do this word for word
. "\n"; is included twice and breaks the forum.

Hello- the "\n" is there but you need to scroll the code box to the right to see it.

I will update the instructions to remind people they may need to scroll to see the full line of text.

[toon79]

Function misc is wrong. You have included:
$string = json_encode($_POST); return '<input type="hidden" name="postvars" value="' . htmlspecialchars_uni(sign_client_string($string)) . '" />' . "\n"; But haven't removed it from the take out line, the forum doesn't function by following these instructions. If you do this word for word
. "\n"; is included twice and breaks the forum.

[toon79]

I gotcha thanks Mark