SMF 2.0
SMF 2.0.18 to SMF 2.0.19
SMF 2.0.17 to SMF 2.0.18
SMF 2.0.16 to SMF 2.0.17
SMF 2.0.15 to SMF 2.0.16
SMF 2.0.14 to SMF 2.0.15
SMF 2.0.13 to SMF 2.0.14
SMF 2.0.12 to SMF 2.0.13
SMF 2.0.11 to SMF 2.0.12
SMF 2.0.10 to SMF 2.0.11
SMF 2.0.9 to SMF 2.0.10
SMF 2.0.8 to SMF 2.0.9
SMF 2.0.7 to SMF 2.0.8
SMF 2.0.6 to SMF 2.0.7
SMF 2.0.5 to SMF 2.0.6
SMF 2.0.4 to SMF 2.0.5
SMF 2.0.3 to SMF 2.0.4
SMF 2.0.2 to SMF 2.0.3
SMF 2.0.1 to SMF 2.0.2
SMF 2.0 to SMF 2.0.1
SMF 2.0 RC4 to SMF 2.0 RC4 Security Patch
SMF 2.0 RC1-1 to SMF 2.0 RC1.2
SMF 2.0 RC1 to SMF 2.0 RC1-1
SMF 2.0 Beta 3 to SMF 2.0 Beta 3.1 Public

Update to SMF 2.0.13 - Installation Instructions for 2.0.12

Update to SMF 2.0.13

Readme

This patch will provide important security and bug fixes to your 2.0.12 forum.

Changelog
=========
index.php
- Updated version to 2.0.13

Sources/Calendar.php
- Updated version to 2.0.12

Sources/ManagePosts.php
- Updated version to 2.0.12

Sources/Display.php
- Updated version to 2.0.12

Sources/Subscriptions-PayPal.php
- Updated version to 2.0.12

Sources/Themes.php
- Updated version to 2.0.13
- Added session check.

Sources/LogInOut.php
- Updated version to 2.0.13
- Added sanitization to $_REQUEST['u']

Sources/Reminder.php
- Updated version to 2.0.13
- Check and sinitization for $_POST['user']
- Isset $_REQUEST['uid'] if ! then $_REQUEST['uid'] = 0

Sources/PackageGet.php (Special thanks to Q)
- Updated version to 2.0.13
- Added sanitization of package site
- Added session check

Sources/Subs-Post.php
- Updated version to 2.0.13
- Rollback of 2.0.12 empty BBC

Sources/Subs.php
- Updated version to 2.0.13
- Remove some limits in safe_unserialize()

Special Thanks
- Q

File Edits ALT + Click to collapse all the operations

./index.php

Find: Select
* @version 2.0.12
Replace With: Select
* @version 2.0.13
Find: Select
$forum_version = 'SMF 2.0.12';
Replace With: Select
$forum_version = 'SMF 2.0.13';

./Sources/Calendar.php

Find: Select
@version 2.0.11
Replace With: Select
@version 2.0.12

./Sources/ManagePosts.php

Find: Select
@version 2.0
Replace With: Select
@version 2.0.12

./Sources/Display.php

Find: Select
@version 2.0.11
Replace With: Select
@version 2.0.12

./Sources/Subscriptions-PayPal.php

This operation isn't vital to the installation of this mod.
Find: Select
@version 2.0.10
Replace With: Select
@version 2.0.12

./Sources/Themes.php

Find: Select
@version 2.0.12
Replace With: Select
@version 2.0.13
Find: Select
$context[$context['admin_menu_name']]['current_subsection'] = 'edit';
Replace With: Select
checkSession();

$context[$context['admin_menu_name']]['current_subsection'] = 'edit';

./Sources/LogInOut.php

Find: Select
@version 2.0.12
Replace With: Select
@version 2.0.13
Find: Select
global $txt, $context, $scripturl;
Replace With: Select
global $txt, $context, $scripturl, $smcFunc;
Find: Select
$context['default_username'] = &$_REQUEST['u'];
Replace With: Select
$context['default_username'] = isset($_REQUEST['u']) ? preg_replace('~&#(\\d{1,7}|x[0-9a-fA-F]{1,6});~', '&#\\1;', $smcFunc['htmlspecialchars']($_REQUEST['u'])) : '';

./Sources/Reminder.php

Find: Select
@version 2.0.4
Replace With: Select
@version 2.0.13
Find: Select
// Coming with a known ID?
Replace With: Select
$_POST['user'] = isset($_POST['user']) ? $smcFunc['htmlspecialchars']($_POST['user']) : '';
$_REQUEST['uid'] = (int) isset($_REQUEST['uid']) ? $_REQUEST['uid'] : 0;

// Coming with a known ID?

./Sources/PackageGet.php

Find: Select
@version 2.0.9
Replace With: Select
@version 2.0.13
Find: Select
$authorhompage = $thisPackage->fetch('website');
Replace With: Select
$authorhompage = $smcFunc['htmlspecialchars']($thisPackage->fetch('website'));
Find: Select
// Setup the correct template, even though I'll admit we ain't downloading ;)
Replace With: Select
checkSession();

// Setup the correct template, even though I'll admit we ain't downloading ;)

./Sources/Subs-Post.php

This operation isn't vital to the installation of this mod.
Find: Select
@version 2.0.12
Replace With: Select
@version 2.0.13
Find: Select

$message = preg_replace_callback('~\[nobbc\](.+?)\[/nobbc\]~is', 'nobbc__preg_callback', $message);

// Remove empty bbc.
$message = preg_replace('~\[([^\]=\s]+)[^\]]*\](?' . '>\s|(?R))*?\[/\1\]\s?~i', '', $message);
Replace With: Select

$message = preg_replace_callback('~\[nobbc\](.+?)\[/nobbc\]~is', 'nobbc__preg_callback', $message);

./Sources/Subs.php

This operation isn't vital to the installation of this mod.
Find: Select
@version 2.0.12
Replace With: Select
@version 2.0.13
This operation isn't vital to the installation of this mod.
Find: Select
// Input exceeds 4096.
if(strlen($str) > 4096)
return false;

// Input is not a string.
Replace With: Select
// Input is not a string.
This operation isn't vital to the installation of this mod.
Find: Select
case 3: // In array, expecting value or another array.
if($type == 'a')
{
// Array nesting exceeds 3.
if(count($stack) >= 3)
return false;
Replace With: Select
case 3: // In array, expecting value or another array.
if($type == 'a')
{
This operation isn't vital to the installation of this mod.
Find: Select
case 0:
if($type == 'a')
{
// Array nesting exceeds 3.
if(count($stack) >= 3)
return false;
Replace With: Select
case 0:
if($type == 'a')
{
This operation isn't vital to the installation of this mod.
Find: Select
if($type == 'i' || $type == 's')
{
// Array size exceeds 256.
if(count($list) >= 256)
return false;

// Array size exceeds expected length.
Replace With: Select
if($type == 'i' || $type == 's')
{
// Array size exceeds expected length.

Code

auto_1.php

This file should not be able to execute standalone.You may have to run the following queries manually.
Query: Select
<?php
global $boarddir, $modSettings;
require_once($boarddir . '/SSI.php');

if (!empty($modSettings['cal_maxyear']) && (int) $modSettings['cal_maxyear'] < 2030)
updateSettings(array('cal_maxyear' => 2030));
Advertisement: