IP.Board 3.0.x / 3.1.x Security Patch Released

[[R] NuclearGeneral]

A security issue has been discovered within the personal conversations system that could allow exposure of the message content if the personal conversation ID is known.

 

We have released a simple patch for this issue. To apply, simply download the correct zip file and upload the file(s) over the ones on your server. There is no need to rebuild or reset any templates or language packs. Customers with active support are welcome to ask technical support for assistance if required.

 

IP.Board 3.0.x

http://community.invisionpower.com/public/style_extra/mime_types/zip.gif 30xPatch.zip (6.89K)

Number of downloads: 102 (Updated 13:47 EST)

 

IP.Board 3.1.x

http://www.invisionpower.com/files/313Update.zip

 

This 3.1.3 update also resolves a few other issues:

- Warning when using JSON when the PHP JSON extension isn't available

- Twitter log in issue

- Hovercard Opera positioning issue

- Missing dashboard notifications in the Admin CP

- Members may access password only forums without complete authorization

 

The main download zips have been updated at the time of this post so if you have downloaded after the date of this message you do not need to apply this patch.

 

View the full article at IPS