{"id":51,"date":"2006-10-19T19:41:33","date_gmt":"2006-10-20T01:41:33","guid":{"rendered":"http:\/\/www.directorycritic.com\/blog\/phpld-2x-security-problem\/"},"modified":"2006-10-19T19:41:33","modified_gmt":"2006-10-20T01:41:33","slug":"phpld-2x-security-problem","status":"publish","type":"post","link":"https:\/\/www.directorycritic.com\/blog\/phpld-2x-security-problem\/","title":{"rendered":"PHPLD 2.x Security Problem"},"content":{"rendered":"

I received an email this morning about a serious security flaw in phpLD 2.x. The flaw allows webmasters to submit html tags in the description and name fields. The problem is easily fixed using php’s strip_tags() function. Here is the fix, courtesy of After 5 Web Design<\/a>:<\/p>\n

    \n
  1. Open:<\/span>
    \nsubmit.php<\/li>\n
  2. Find:<\/span>
    \n$data[‘LAST_CHECKED’] = gmdate(‘Y-m-d H:i:s’);
    \n$data[‘DATE_ADDED’] = gmdate(‘Y-m-d H:i:s’);
    \n$data[‘DATE_MODIFIED’] = gmdate(‘Y-m-d H:i:s’);<\/li>\n
  3. Add:<\/span>
    \n$data[‘DESCRIPTION’] = strip_tags($data[‘DESCRIPTION’]);
    \n$data[‘TITLE’] = strip_tags($data[‘TITLE’]);
    \n$data[‘OWNER_NAME’] = strip_tags($data[‘OWNER_NAME’]);<\/li>\n<\/ol>\n

    Simple. Now that this is out in the open, you should expect spammers to try and expolit it. So I suggest you patch this up as soon as possible. I know Tim from After 5 Web Design<\/a> has notified the phpLD team, and a patch should be out soon.<\/p>\n","protected":false},"excerpt":{"rendered":"

    I received an email this morning about a serious security flaw in phpLD 2.x. The flaw allows webmasters to submit html tags in the description and name fields. The problem is easily fixed using php’s strip_tags() function. Here is the fix, courtesy of After 5 Web Design: Open: submit.php Find: $data[‘LAST_CHECKED’] = gmdate(‘Y-m-d H:i:s’); $data[‘DATE_ADDED’] […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1,6],"tags":[],"_links":{"self":[{"href":"https:\/\/www.directorycritic.com\/blog\/wp-json\/wp\/v2\/posts\/51"}],"collection":[{"href":"https:\/\/www.directorycritic.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.directorycritic.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.directorycritic.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.directorycritic.com\/blog\/wp-json\/wp\/v2\/comments?post=51"}],"version-history":[{"count":0,"href":"https:\/\/www.directorycritic.com\/blog\/wp-json\/wp\/v2\/posts\/51\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.directorycritic.com\/blog\/wp-json\/wp\/v2\/media?parent=51"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.directorycritic.com\/blog\/wp-json\/wp\/v2\/categories?post=51"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.directorycritic.com\/blog\/wp-json\/wp\/v2\/tags?post=51"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}