MyBB Community Forums

Someone hacked my MYBB forum through the avatar and upload folder.

I would like it so that I can have an avatar and others can't upload anything.


I tried the 666 settings like suggested in the docs, but it will not display my avatar for some reason for everyone.

I tried just uploading it and setting both folders to 555 and that seems to work. I just want to make sure the 555 is secure and that nobody can upload to those folders. Should I add a .htaccess file?

I tried the remote avatar with my same avatar that works and nothing happens.

Any help would be appreciated.

This security loophole was fixed in a recent version. As with all software exposed to the internet, MyBB should regularly be updated to the latest version for optimal security and stability. I recommend that you update your forum to MyBB 1.2.12 immediatly to prevent re-occurrences of this. This way, you can continue offering the avatar service to all your users without the risk of being hacked again.

Mike

You can disable avatar uploads in Admin CP --> Users and Groups --> Manage Groups --> Registered Usergroup. Change the "Can Upload Avatars" permission to "No"

Join the mybb mailing list so you can be notified of new updates as well.

Thanks for the information. It's a good thing that I had a backup of the database.

labrocca Wrote:Join the mybb mailing list so you can be notified of new updates as well.

I find it easier to subscribe my RSS reader to the "Announcements" forum's RSS feed, faster than waiting for the email.

Ok - I upgraded to the latest 1.2.12 and for some reason whenever a registered user or myself (admin) logs off I get this message:

Your user ID could not be verified to log you out. This may have been because a malicious Javascript was attempting to log you out automatically. If you intended to logout, please click the Logout button at the top menu.


Do you know what could be the problem?

Look for the logout problem sticky in the support forum.

labrocca Wrote:Look for the logout problem sticky in the support forum.

Thanks!

Worked perfect...

Thanks for the great support.