possible DoS when displaying large threads

[cturcich]

Pretty considerable bug one of my users discovered today.

On large threads, it's possible to bring the server to it's knees by modifying a URL to display all replies on one page.

Example:

Thread has > 2,000 replies
user crafts a URL to show all 2,000 replies per page, or more, depending on size of thread

http://www.forumname.net/showthread....perpage=######

server processes the request and will be brought down due to high loads

[George L]

that's fixed in vB 2.2.7 so best to upgrade

i noticed your vB copyright text at http://www.hosthome.net/1400smith/ is not properly showing (masked by background colour) as required by vB licensing requirements ... best to fix that up when you finish upgrading

[cturcich]

do you know where the exact fix is? i don't have time to do a full upgrade to 2.2.7 becuase of the changes they made.

[Scott MacVicar]

showthread.php

if ($perpage < 1) { 
    if ($bbuserinfo[maxposts]!=-1 and $bbuserinfo[maxposts]!=0)        { 
        $perpage = $bbuserinfo[maxposts]; 
    } else {
        $perpage = $maxposts;
    }
} 

becomes

$umaxposts = explode(',', $usermaxposts . ",$maxposts");
$newmaxposts = max($umaxposts);
if ($perpage < 1 or $perpage > $newmaxposts) {
    if ($bbuserinfo['maxposts']!=-1 and $bbuserinfo['maxposts']!=0 and $bbuserinfo['maxposts'] <= $newmaxposts)    {
        $perpage = $bbuserinfo['maxposts'];
    } else {
        $perpage = $maxposts;
    }
} 

[cturcich]

muchos gracias