Security Release: vBShop v2.2.4

[Fillip H.]

Hey all,

We've recently been alerted to a security flaw in vBShop (thanks to loaep), which has resulted in the release of v2.2.4.

The nature of the flaw is a potential XSS in the "Username Style" and "Usertitle Style" items.

dbtech/vbshop/clientscript/vbshop.js
Find:

				configOptions[inputName] = val;

Replace with:

				configOptions[inputName] = val
					.replace(/&/g, "&")
					.replace(/</g, "<")
					.replace(/>/g, ">")
					.replace(/"/g, """)
					.replace(/'/g, "'")
				;

dbtech/vbshop/items/usernamestyle.php
dbtech/vbshop/items/usertitlestyle.php
Find:

		$this->config['purchasetemplate'] = 'dbtech_vbshop_configure_style';

Add Below:

		// HTML safe
		$this->config['configuration']['color'] = htmlspecialchars_uni($this->config['configuration']['color']);
		$this->config['configuration']['glow'] = htmlspecialchars_uni($this->config['configuration']['glow']);
		$this->config['configuration']['shadow'] = htmlspecialchars_uni($this->config['configuration']['shadow']);

The v2.2.3 download has also been updated with these changes, as well as the new v2.2.4 download.


Thank you for your continued support

Discuss this news here.