-
Bug
-
Resolution: Invalid
-
Major
-
None
-
3.3.12
-
None
-
None
-
phpBB 3.3.12, Apache 2.4.61, PHP 8.2.20, Unix
Since Apache version 2.4.60 (July 1st) question marks in a URL encoded with %3f produce a 403 error. This affects the Apache default settings.
Various phpBB pages produce an URL in which the question mark is encoded with %3f in the redirect variable. We now get a 403 error there.
This affects the quick moderator tools located at the end of each topic at the bottom of the page. And this affects the login if you are not on the homepage, i.e. you come from a subpage. Maybe other pages that I didn't notice. It always affects the redirect variable.
The Apache change is to deal with: https://www.cve.org/CVERecord?id=CVE-2024-38474
A normal hoster will not change the default settings, so I think this is a bug and it will affect many users soon.