Come avrete notato, da ieri non sono più attivati i tag HTML sul forum. Questa scelta è dovuta ad una vulnerabilità di phpBB2.x uscita il 25 Novembre 2002 su bugtraq@securityfocus.com.
La riporto qua per completezza:
> Application: phpBB2
> Vendor : http://www.phpbb.com
> Problem : Insufficient filtering of user input
> Usability : Easy
> Severity : Medium
> Report by : Pete Foster, Sec-Tec Ltd (http://www.sec-tec.com)
>
> Details:
> There exists a problem with the filtering of content from user posts.
> It is possible to configure phpBB2 to allow the use of certain html
> tags for text formatting. These tags can contain further script code that
> can be executed on the client side. Such scripts could be used to steal
> cookie information amongst other things.
>
> Suggested fix:
> Disable the ability to post messages containing html and force
> users to use
> BBCode instead.
>
> Vendors response:
> The solution is as stated ... disable HTML, BBCode should be more
> than adaquate for many users needs (don't forget additional
> controls exist in the form of Mods).
Come suggerito dal vendor, in attesa della patch ufficiale del prodotto o di una nostra soluzione a questo problema, abbiamo optato per la disabilitazione temporanea dei tag.
ByeBye
_________________
--
DonZa
Azzurra IRC Network Staff
Webmaster of Azzurra Web Site
La riporto qua per completezza:
> Application: phpBB2
> Vendor : http://www.phpbb.com
> Problem : Insufficient filtering of user input
> Usability : Easy
> Severity : Medium
> Report by : Pete Foster, Sec-Tec Ltd (http://www.sec-tec.com)
>
> Details:
> There exists a problem with the filtering of content from user posts.
> It is possible to configure phpBB2 to allow the use of certain html
> tags for text formatting. These tags can contain further script code that
> can be executed on the client side. Such scripts could be used to steal
> cookie information amongst other things.
>
> Suggested fix:
> Disable the ability to post messages containing html and force
> users to use
> BBCode instead.
>
> Vendors response:
> The solution is as stated ... disable HTML, BBCode should be more
> than adaquate for many users needs (don't forget additional
> controls exist in the form of Mods).
Come suggerito dal vendor, in attesa della patch ufficiale del prodotto o di una nostra soluzione a questo problema, abbiamo optato per la disabilitazione temporanea dei tag.
ByeBye
_________________
--
DonZa
Azzurra IRC Network Staff
Webmaster of Azzurra Web Site