Joomlaboard 1.1 security issue

[progster]

Affected: All versions of simpleboard and joomlaboard < 1.1.2
Severity: critical

A bug was found in post.php that would allow anyone to post on your forum, a security release (joomlaboard 1.1.2) will be released shortly. Since we've seen a spamboit using this bug I've posted a quick fix on my blog, all you need to do is replace the current post.php (you'll find it under joomlaroot/components/com_joomlaboard) with the one posted my site.

[kper]

Will this replacement post.php file work for Simpleboard 1.1.0 Stable under Mambo?

[progster]

no, I believe it will when you replace all occurences of com_joomlaboard with com_simpleboard in the file... but I can't garantee you anything. Let me know if it works .

[kper]

Hmm.

You basically seem to have replaced a few blocks of conditional code with a function hasPostPermission

I'll have to set up a test site offline, I suppose, but I can't do that just now.

Are there specific conditions under which the bug can be exploited (ie. config settings)?
The existing blocks check for public write permission and thread locking.

Is there, instead, a straightforward code fix, rather than a rewite, for the existing (sb_1.1.0) post.php file?

[progster]

We didn't check for permission on the actual 'post', adding a check there should fix the issue.

[kper]

Thanks progster, I'll have a proper look as soon as I get chance.

There must be lots of people running 1.1.0 who would like to just add a little code snippet they know will work, rather than replace the whole file, particularly if they have made some modifications to post.php (eg. for convenience, I had previously added a link to com_login onto the error message which says you need to be logged in to post, along with some other small refinements).