Skip to:
Content
Pages
Categories
Search
Top
Bottom

Re: SECURITY WARNING: stop using Private Messaging plugin

Hi Citizenkeith, I just saw this now… you’d put the hack at the end of pm_new_message. So my function now looks like this:

function pm_new_message( $id_receiver, $id_sender, $pmtitle, $message ){
global $bbdb, $bb_table_prefix;

$created_on = bb_current_time('mysql');
$id_receiver = intval($id_receiver);
$id_sender = intval($id_sender);

$pmtitle=substr(strip_tags($pmtitle),0,64);
remove_filter('pre_post', 'post_regulation');
$message=substr($message,0,2048);
$message=force_balance_tags($message);
$message=apply_filters('pre_post',$message,0,0);
$message=apply_filters('post_text',$message,0);

$bbdb->query("INSERT INTO ".$bb_table_prefix."privatemessages
(id_sender, id_receiver, pmtitle, message, created_on)
VALUES
('$id_sender', '$id_receiver', '$pmtitle', '$message','$created_on')");

$to = bb_get_user_email($id_receiver);
$pm_link = bb_get_option('uri') . 'message.php?id=' . $bbdb->insert_id;
$message = __("You have a new private message: %1$s nFrom: %2$s nn%3$s ");
mail( $to, bb_get_option('name') . ':' . __('Private Message'),
sprintf( $message, $pmtitle, get_user_name($id_sender), $pm_link ),
'From: ' . bb_get_option('from_email')
);

}

Skip to toolbar