MyBB Community Forums

Hello Guys,
In this version of MyBB is present a problem with HTML on User Title, ok, enjoy this mini tutorial for easy fix that.

Go to your FTP and go to "inc/functions_post.php" edit that and go to line 269

The line 269 present that:

$post['usertitle'] = htmlspecialchars_uni($post['usertitle']);  

Replace that with:

// $post['usertitle'] = htmlspecialchars_uni($post['usertitle']);   

Now go to ACP and on Title of User make an HTML and in postbit is present an image and star!

PS: Thanks to Dvdxseo for help me on italian forum!
PS2: Don't allow the user to change a User Title is a vulnerable for XSS

Bye!

so users can now insert any HTML they want to?

(2014-11-14, 03:58 PM)Omar G. Wrote: [ -> ]so users can now insert any HTML they want to?

Yes, in postbit and profile view a result of html code.

And this is called a XSS vulnerability.. You're basically advising other people to make their forum less secure.

(2014-11-14, 04:41 PM)Destroy666 Wrote: [ -> ]And this is called a XSS vulnerability.. You're basically advising other people to make their forum less secure.

But i use that for this:

Not for get another forum less secure.
If you allow a user to change a user title the vulnerability is here but if you don't allow user to change user title the vulnerability is nothing.

I see, so users shouldn't be allowed to change their titles if you do implement this modification. You should probable have mentioned that.

Yes i have say:
user allow to change user title? XSS.
user don't allow? Nothing

???

why not use User Stars or Group Image for this?

(2014-11-15, 03:20 AM)martec Wrote: [ -> ]???

why not use User Stars or Group Image for this?

You with this can stay with star and user title, but i make a graphic title
The user change a graphic title or title for the message write on forum.

(2014-11-14, 02:47 PM)Vinny Wrote: [ -> ]Now go to ACP and on Title of User make an HTML and in postbit is present an image and star!

where i find this? can you explain this?

admin control panel - configuration - and what?