Register Members List Search Today's Posts Mark Forums Read

Reply
 
Mod Options
Remove ability for mods to use HTML in announcements Details »
Remove ability for mods to use HTML in announcements
Mod Version: 1.00, by AndrewSimm (Coder/Designer) AndrewSimm is offline
Developer Last Online: Jan 2020 I like it Show Printable Version Email this Page

vB Version: 4.2.x Rating: (3 votes - 5.00 average) Installs: 12
Released: 16 Nov 2013 Last Update: Never Downloads: 0
Supported Re-usable Code  

Currently if someone is able to hack into one your of moderator accounts they could use it to launch a XSS attack since they could select the option to use HTML in announcements.

To fix this open modcp/announcement.php

Change


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

to


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

All you are doing is commenting it out. You will need to do this each time you upload a new version of vbulletin.

Download Now

Only licensed members can download files, Click Here for more information.

Show Your Support

  • To receive notifications regarding updates -> Click to Mark as Installed.
  • This modification may not be copied, reproduced or published elsewhere without author's permission.
Comments
  #2  
Old 16 Nov 2013, 00:46
ozzy47's Avatar
ozzy47 ozzy47 is offline
 
Join Date: Aug 2009
Real name: Chris
Thanks for posting this, but it is really not a add-on, it's a file edit.
__________________
You can get access to my 180 mods for vB 3.6 - 4.x at The Admin Zone as well as the professional support you are used to. New vBulletin Spider Definitions, vBulletin Spiders List Hits 1000 Spiders! ​ OzzModz down. Site has had a data breach, checking how the intrusion happened. Change your PW if you use the same one on my site and others.
Reply With Quote
  #3  
Old 16 Nov 2013, 06:30
AndrewSimm's Avatar
AndrewSimm AndrewSimm is offline
 
Join Date: Sep 2006
Originally Posted by ozzy47 View Post
Thanks for posting this, but it is really not a add-on, it's a file edit.
I understand, but I didn't see where I could post it other than the forums where it would get lost. There are no hooks in the file for me to turn it into a mod
Reply With Quote
  #4  
Old 27 Nov 2013, 19:15
djbaxter djbaxter is offline
 
Join Date: Aug 2006
Location: Ottawa, Canada
A better solution is not to give moderators permissions to post any announcements or notices.
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Mod Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 10:15.

Layout Options | Width: Wide Color: