here's how to solve the "path disclosure" bug in bbPress
There is a security bulletin being circulated this week about a “path disclosure” bug in bbPress 1.0.3 – it actually affects all versions.
It’s not a super-serious security bug in itself but it can be used to gain leverage.
Basically someone can discover the real path your files are in by causing a PHP error by trying to access a template file directly, where there is an error in the template because bbPress is not loaded at that time.
Here is a simple workaround for users on Apache (vast majority of users).
Make a file called
.htaccess(note the dot at the start)
in it, put this line
php_flag display_errors off
Then upload that file to
The reason why we don’t put that in the master
.htaccessfile for all of bbPress is because you may need to see any regular errors in the future. However for the template subdirectories, there is no need because those files are never (supposed to be) loaded directly by the browser.
- You must be logged in to reply to this topic.