Uploaded image for project: 'phpBB3'
  1. phpBB3
  2. PHPBB3-14457

Malicious user can force "infinite" wait time for everyone else in viewtopic.php

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Blocker
    • Resolution: Fixed
    • 3.2.0-b1
    • None
    • Posting, Template Engine
    • None

    Description

      If a malicious user wants to force a page to take seemingly infinite time to load (making the bulletin board for that content unusable) he can now force it by typing:

      __SCRIPTS_PLACEHOLDER__

      Multiple times in his post

      Attachments

        Issue Links

          was caused by solution of

          Bug - A problem which impairs or prevents the functions of the product. PHPBB3-13717 INCLUDECSS behaves undesirable compared to INCLUDEJS

          • Major - Major loss of function.
          • Closed

          Activity

            People

              Unassigned Unassigned
              brunoais brunoais
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: