Version 1.5.3 Is Released

[David]

Version 1.5.3 contains a fix to a security risk to those servers with magic_quotes_gpc turned off.  It currently is not publicized on any security sites and was found internally by Christian Land.  Even though this vulnerability does not effect every server we reccomend you treat it as a required upgrade.  Due to how small of a fix this is, all mods for 1.5.2 should work with it.

If you are upgrading from 1.5.2 please use the update package or mod.

All files can be found here on SourceForge.
https://sourceforge.net/project/showfiles.php?group_id=57105&release_id=160574

And a YaBBpak version of this update can be found at:
http://www.yabbse.org/packages/bugs

[acf [delete me]!]

pluging holes again or you keeping us busy  

good job!

[klumy]

Good job.

Thanks to everyone who works on it

[luisr]

Once again, I just install the latest version and a new one comes out.  

Could you post an upgrade package containing just the modified modules to be installed over the existing installation?  Fortunately my installation is still untouched because I just installed 1.5.2 today and I have not yet transferred the old live board to this one.

[Daniel D.]

Didn't you look at the download page ? There is a BoardMod update for example...

[David]

Could you post an upgrade package containing just the modified modules to be installed over the existing installation?  Fortunately my installation is still untouched because I just installed 1.5.2 today and I have not yet transferred the old live board to this one.

As Daniel pointed out, you can either use the Boardmod file or the update package.  The mod file only edits the two files, the update package only contains the two new files.

[luisr]

I don't see a 1.5.3 update package in the download page.

[Spaceman-Spiff]

I don't see a 1.5.3 update package in the download page.

check the link in the first post

[Ben_S]

http://prdownloads.sourceforge.net/yabbse/yabbse_1-5-3_update.mod?download

[luisr]

Thanks

[I, Brian]

On the one hand, it's disappointing that there's *yet another* security fix for YaBB SE.

On the other hand, it's very gratifying to know that YaBB SE are so on the ball with regards to possible secuity issues.

Because I know what being hacked is like - and the damage it can cause - I am very grateful for security fixes.

[Jeff Lewis]

The majority of the holes we have been fixing lately are ones that are also exploitable on other forum packages as well (and you'll see that in security sites).

Someone finds it on one and tries it on them all. Least we can do is keep on the ball for the users

[old dan]

good work folks. One tiny quibble, in the boardmod file it says, "fixes one last security hole". Not putting you down or complaing as you do a great job keeping on top of things but saying that is kinda like the scout that told Custer, "there aren't any Indians for a hundred miles". Whenever you allow anonymous access to your web server you open yourself up to security issues.

good to see you're on top of things.

[Thomas]

Hi

I cant download the mod. I get 404 error on every mirror site.

/MR.T

[skoen]

It's in fact easier to download the zip file of the update and upload the two files to your YaBBSE directory. That way, you won't lose any of your existing mods or settings. I've done this now, both with the updates pre-1.5.1 final and until now. Will in fact do the same when 1.6.0 arrives. My host only allowed me to install YSE1.4.1 and upgrade to now 1.5.3.