MyBB Community Forums

Hey guys I just noticed that There was this maintenance tool to check templates for potential security issues. It found 3 originally but I found the fix for one by just googling around. I don't suppose anyone could point me in the right direction for also fixing these 2?

The following errors were encountered:
The templates below matched known security issues. Please review them.

<html>
<head>
	<title>{$mybb->settings['bbname']} - {$lang->calendar}</title>
	{$headerinclude}
</head>
<body>
	{$header}
<table border="0" cellspacing="0" cellpadding="0">
<tr>
<td width="100%">
	<table border="0" cellspacing="{$theme['borderwidth']}" cellpadding="{$theme['tablespace']}" class="tborder">
		<thead>
			<tr>
				<td class="thead" colspan="2">
					<div class="float_right">
						<a href="{$prev_link}">&laquo; {$lang->previous_week}</a> | <a href="{$next_link}">{$lang->next_week} &raquo;</a>
					</div>
					<div><strong>{$lang->weekly_overview} {$friendly_week_from} - {$friendly_week_to}</strong></div>
				</td>
			</tr>
		</thead>
		<tbody>
			{$weekday_bits}
		</tbody>
	</table>
</td>
<td style="padding-left: 10px; vertical-align: top;">{$mini_calendars}</td>
</tr>
</table>
	<br />
	<form action="calendar.php" method="post">
		<table border="0" cellspacing="{$theme['borderwidth']}" cellpadding="{$theme['tablespace']}" class="tborder">
			<tr>
				<td class="trow1">
					<table width="100%" cellspacing="0" cellpadding="0" border="0">
						<tr>
						<td class="trow1" valign="top">{$addevent}</td>
							<td class="trow1" align="right">
							<span class="smalltext"><strong>{$lang->jump_month}</strong></span>
							<select name="month">
								<option value="{$week_from[1]}">{$monthnames[$week_from[1]]}</option>
								<option value="{$week_from[1]}">----------</option>
								<option value="1">{$lang->alt_month_1}</option>
								<option value="2">{$lang->alt_month_2}</option>
								<option value="3">{$lang->alt_month_3}</option>
								<option value="4">{$lang->alt_month_4}</option>
								<option value="5">{$lang->alt_month_5}</option>
								<option value="6">{$lang->alt_month_6}</option>
								<option value="7">{$lang->alt_month_7}</option>
								<option value="8">{$lang->alt_month_8}</option>
								<option value="9">{$lang->alt_month_9}</option>
								<option value="10">{$lang->alt_month_10}</option>
								<option value="11">{$lang->alt_month_11}</option>
								<option value="12">{$lang->alt_month_12}</option>
							</select>
							<select name="year">
								<option value="{$week_from[2]}">{$week_from[2]}</option>
								<option value="{$week_from[2]}">----------</option>
								{$yearsel}
							</select>
							{$gobutton}
							<br /><br />
							<span class="smalltext"><strong>{$lang->jump_to_calendar}</strong></span>
							{$calendar_jump}
							{$gobutton}
							</td>
						</tr>
					</table>
				</td>
			</tr>
		</table>
	</form>
{$footer}
</body>
</html>

And

					<dt><label style="display: block;"><input type="radio" name="type" value="{$type['tid']}" {$type_checked[$type['tid']]} class="types_check" onclick="checkType();" style="vertical-align: middle;" /> <strong>{$type['title']}</strong> $points</label></dt>
					<dd style="margin-top: 4px;" id="type_{$type['tid']}" class="types">
						<div class="smalltext">{$lang->new_warning_level}</div>
						<div class="tborder" style="width: 150px; float: left; margin: 0; padding: 1px;">
							<div class="trow1" style="width: {$current_level}%; float: left; ">&nbsp;</div>
							<div class="trow2" style="width: {$level_diff}%; float: left;">&nbsp;</div>
						</div>
						<div style="padding-left: 10px; font-weight: bold; float: left;">{$new_warning_level}%</div><br style="clear: left;" />
						{$result}
					</dd>

In the calendar try changing

  <option value="{$week_from[1]}">{$monthnames[$week_from[1]]}</option>

to

  <option value="{$week_from[1]}">{$monthnames[$week_from[1]}</option>

and in the other the $points needs to be in curly braces.

(2012-08-23, 10:13 AM)Leefish Wrote: [ -> ]In the calendar try changing
  <option value="{$week_from[1]}">{$monthnames[$week_from[1]]}</option>

to

  <option value="{$week_from[1]}">{$monthnames[$week_from[1]}</option>
and in the other the $points needs to be in curly braces.

Neither change worked, but I just reverted them to their default and no more security flaws were found.

I don't remember the specific changes in Calendar week but the change in Warn was

{$type_checked[$type['tid']]}

to

{$checked}

Thank you though Leefish, don't know why I didn't just revert them to default to begin with.

Redtah

Leefish

Redtah