Manual Security Patch Instructions for VB 4.x.x

[Mark.B]

For vB4: There are patch files for 4.2.2 only.
If you have an earlier version our recommendation is to upgrade.
If you do not wish to do so, we have provided manual patching instructions.

[toon79]

I don't get it, can't we just have patch files to overwrite the old files? The patch files in the member area are not these files are have <?php

define('FILE_VERSION_VBULLETIN', '4.2.1 Patch Level 1');

?>

Shouldn't there be a patch level 2? Am I missing something?

[Mark.B]

There should only be one copy of that file, and that folder. If you have two, you need to review what's on your server - compare the folder structure with that of the download package.

[vbsm]

includes/functions.php is located in two places. Should both be changed?

[BirdOPrey5]

The following are instructions for manually patching all versions of VB 4.x.x for the patch released March 13, 2014.

Verify you have PHP 5.2.0 or higher before you make these changes. If you don't you will break the site by making these changes.

The version of PHP on your server is visible in the Admin CP in the table near the top of the page, under thew news.



If your PHP version is not at least 5.2.0 see the announcement thread for more options.

Important - Some of the code boxes have a horizontal scroll bar, you will need to scroll to the right to see the entire line of code in these cases.

In includes/functions.php

Find the code:

         $postvars = construct_post_vars_html();
         if ($vbulletin->GPC['postvars'])
         {
            $_postvars = @unserialize(verify_client_string($vbulletin->GPC['postvars']));

Replace the line:

            $_postvars = @unserialize(verify_client_string($vbulletin->GPC['postvars']));

With:

            $_postvars = array();
            $client_string = verify_client_string($vbulletin->GPC['postvars']);
            if ($client_string)
            {
                $_postvars = @json_decode($client_string, true);
            }

In includes/functions_login.php

Find the code:

             }
             if ($vbulletin->GPC['postvars'])
             {
                $postvars = @unserialize(verify_client_string($vbulletin->GPC['postvars']));

Replace the line:

                $postvars = @unserialize(verify_client_string($vbulletin->GPC['postvars']));

With:

                $postvars = array();
                $client_string = verify_client_string($vbulletin->GPC['postvars']);
                if ($client_string)
                {
                    $postvars = @json_decode($client_string, true);
                }

Finf the code:

                     $postvars['securitytoken'] = $vbulletin->userinfo['securitytoken'];
                 }
 
                $vbulletin->GPC['postvars'] = sign_client_string(serialize($postvars));

Replace the line:

                $vbulletin->GPC['postvars'] = sign_client_string(serialize($postvars));

With:

        $vbulletin->GPC['postvars'] = sign_client_string(json_encode($postvars));

In includes/functions_misc.php

Find the code:

     }
     else if ($vbulletin->superglobal_size['_POST'] > 0)
     {
        return '<input type="hidden" name="postvars" value="' . htmlspecialchars_uni(sign_client_string(serialize($_POST))) . '" />' . "\n";

Replace the line:

        return '<input type="hidden" name="postvars" value="' . htmlspecialchars_uni(sign_client_string(serialize($_POST))) . '" />' . "\n";

With:

        $string = json_encode($_POST);
        return '<input type="hidden" name="postvars" value="' . htmlspecialchars_uni(sign_client_string($string)) . '" />' . "\n";

Find the code:

    $temp = unserialize($serializedarr);

Replace with:

    $temp = json_decode($serializedarr, true);

In forumdisplay.php

Find the code:

         {
             if (($check = verify_client_string($vbulletin->GPC['postvars'])) !== false)
             {
                $temp = unserialize($check);

Replace the line:

                $temp = unserialize($check);

With:

                $temp = json_decode($check, true);

In login.php (note- in some versions of 4.x this code does not exist, in that case ignore this step)

Find the code:

     exec_unstrike_user($vbulletin->GPC['vb_login_username']);
 
    $_postvars = @unserialize(verify_client_string($vbulletin->GPC['postvars']));

Replace the line:

    $_postvars = @unserialize(verify_client_string($vbulletin->GPC['postvars']));

With:

    $_postvars = array();
    $client_string = verify_client_string($vbulletin->GPC['postvars']);
    if ($client_string)
    {
        $_postvars = @json_decode($client_string, true);
    }

After editing each file upload it back to your server. Keep a backup of the old file just in case. If you ever need a backup of the original file you can re-download your version of VB 4.x from the Member's Area. Only vBulletin 4.2.2 will be officially patched in the Member's Area.

If you are on Windows use a dedicated code editor like Notepad2 or Notepad++ (both are free) to edit your .php files, do not use Windows Notepad.