Open yuliu opened 3 years ago
Literal "localhost" or "127.0.0.1" in URL settings for avatars and attachments modules will prevent themselves from running. Hosts in URLs should be checked for such subjects, rather than in arbitrary path strings.
avatars: https://github.com/mybb/merge-system/blob/d453ec2b922a088cfa41a81753c37b7f038ecb77/resources/modules/avatars.php#L149 https://github.com/mybb/merge-system/blob/d453ec2b922a088cfa41a81753c37b7f038ecb77/resources/modules/avatars.php#L155
attachments: https://github.com/mybb/merge-system/blob/d453ec2b922a088cfa41a81753c37b7f038ecb77/resources/modules/attachments.php#L192 https://github.com/mybb/merge-system/blob/d453ec2b922a088cfa41a81753c37b7f038ecb77/resources/modules/attachments.php#L198
Literal "localhost" or "127.0.0.1" in URL settings for avatars and attachments modules will prevent themselves from running. Hosts in URLs should be checked for such subjects, rather than in arbitrary path strings.
avatars: https://github.com/mybb/merge-system/blob/d453ec2b922a088cfa41a81753c37b7f038ecb77/resources/modules/avatars.php#L149 https://github.com/mybb/merge-system/blob/d453ec2b922a088cfa41a81753c37b7f038ecb77/resources/modules/avatars.php#L155
attachments: https://github.com/mybb/merge-system/blob/d453ec2b922a088cfa41a81753c37b7f038ecb77/resources/modules/attachments.php#L192 https://github.com/mybb/merge-system/blob/d453ec2b922a088cfa41a81753c37b7f038ecb77/resources/modules/attachments.php#L198