The Patched files add a number of protections to stop this. First, the Downloads query variable has been patched. Second, known exploits using document . cookie have been blocked. As well, the code that this seeks to exploit is no longer in the Patched files (FB used an older Patched files version in 8.0)
However, the main point seems to be an injection using _SERVER.
We can block the usage of _SERVER by adding a block into the code like
(Spaces have been added to allow this to post correctly)
Code:
in mainfile.php
FIND
(stristr($postString,'document . location')) OR (stristr($postString_64,'document . location'))
AFTER, ADD
OR (stristr($postString,'_SERVER=')) OR (stristr($postString_64,'_SERVER='))
_________________ Evaders99 Webmaster Administrator Fighting is terrible, but not as terrible as losing the will to fight.
- SW:Rebellion Network - Evaders Squadron Coding -
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
![Welcome to Evaders Squadron Coding [ESC]](themes/Onset/images/logo.gif){kind=logo}
