Wedge

I assume it's to do with the code tags and similar where smileys shouldn't be parsed. Notice that it expressly doesn't do every line but every other line in the file.

Honestly, my gut reaction to this is 'dear god, no'.

When I find that their site is so freaking slow that it is actively sluggish to scroll up and down on an iPad (even on just the front page, not logged in) not to mention sluggish on my much-more-powerful desktop, I can't help but think they've got something very drastically wrong - and if this is an example of the sort of coding they're going to turn out, I don't want to look it.

I really hope that's sarcasm.

Any sufficiently complex piece of software has bugs, some of which are possibly security related. This particular one is because technology moved on and applications haven't caught up yet. Interestingly this particular vulnerability probably applies to other forums and other applications.

IIRC, mb_ overloading isn't going to be controlled by SMF, but by php.ini. Mind you, I haven't seen a server that has it set up because of the performance overhead it would naturally cause.Only if you use the old format, e.g. $var{0} which is deprecated in 5.3.

Yup, I spent a couple of hours going through the specifications and trying to make sense of how big - exactly - the vulnerability is.

In this case, it's more that SMF and Wedge are potentially vulnerable because of a specification that came out after them, and more than that, it's one where the specification itself relies on the *browser* implementing security measures. We haven't heard the last of it, I'm sure.

I suspect the patch has not been applied here, even if it's been patched for some time in Wedge itself.

Amazing what fresh eyes will do. The path was actually set wrong even though I swear I'd set it right, but then I found a bunch of other issues that prevented it from working, like some things I didn't realise that libxml (which underpins SimpleXML) does, like implicitly attempt to validate XML files given to it, and I don't have a complete DTD yet with which to set out such.

(Not that I really want to write the DTD, because I know it's going to be a pain in the arse to write, but still, it will have to be done sometime.)

That's what I mean, I don't like anything that essentially allows you to compromise your account, even in a minor way.