Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix ACP Settings management RCE
  • Loading branch information
dvz committed Mar 9, 2022
1 parent 89ba6fd commit 92012b9
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions admin/modules/config/settings.php
Expand Up @@ -293,8 +293,8 @@
}

// do some type filtering
$mybb->input['type'] = str_replace("\n", "", $mybb->input['type']);
if(strtolower(substr($mybb->input['type'], 0, 3)) == "php")
$mybb->input['type'] = $mybb->get_input('type');
if(!ctype_alnum($mybb->input['type']) || strtolower($mybb->input['type']) == "php")
{
$mybb->input['type'] = "";
}
Expand Down Expand Up @@ -496,8 +496,8 @@
}

// do some type filtering
$mybb->input['type'] = str_replace("\n", "", $mybb->input['type']);
if(strtolower(substr($mybb->input['type'], 0, 3)) == "php")
$mybb->input['type'] = $mybb->get_input('type');
if(!ctype_alnum($mybb->input['type']) || strtolower($mybb->input['type']) == "php")
{
$mybb->input['type'] = "";
}
Expand Down

0 comments on commit 92012b9

Please sign in to comment.