Проблема: Недостаточная фильтрация входящих данных.

Ошибка в версии: все версии

Степень опасности: Средняя

Ручное исправление:

Откройте файл: engine/classes/parse.class.php

найдите:

        $find= array(
                    '/about:/si',
                    '/vbscript:/si',
                    "'\[quote\]'si",
                    "'\[quote=(.+?)\]'si",
                    "'\[/quote\]'si",
                    );

        $replace=array(
                      "about<b></b>:",
                      "vbscript<b></b>:",
                      "<!--QuoteBegin--><div class=\"quote\"><!--QuoteEBegin-->",
                      "<!--QuoteBegin \\1 --><div class=\"title_quote\">{$lang['i_quote']} \\1</div><div class=\"quote\"><!--QuoteEBegin-->",
                      "<!--QuoteEnd--></div><!--QuoteEEnd-->",
                      );

замените на:

        $find= array(
                    '/about:/i','/vbscript:/i','/onclick/i','/onload/i','/onunload/i','/onabort/i',
                    '/onerror/i','/onblur/i','/onchange/i','/onfocus/i','/onreset/i','/onsubmit/i',
                    '/ondblclick/i','/onkeydown/i','/onkeypress/i','/onkeyup/i','/onmousedown/i',
                    '/onmouseup/i','/onmouseover/i','/onmouseout/i','/onselect/i','/javascript/i',
                    "'\[quote\]'si",
                    "'\[quote=(.+?)\]'si",
                    "'\[/quote\]'si",
                    );

        $replace=array(
                      "about:","vbscript<b></b>:","onclick","onload","onunload",
                      "onabort","onerror","onblur","onchange","onfocus",
                      "onreset","onsubmit","ondblclick","onkeydown","onkeypress",
                      "onkeyup","onmousedown","onmouseup","onmouseover",
                      "onmouseout","onselect","javascript",
                      "<!--QuoteBegin--><div class=\"quote\"><!--QuoteEBegin-->",
                      "<!--QuoteBegin \\1 --><div class=\"title_quote\">{$lang['i_quote']} \\1</div><div class=\"quote\"><!--QuoteEBegin-->",
                      "<!--QuoteEnd--></div><!--QuoteEEnd-->",
                      );

Дистрибутив версии 7.3 обновлен.