Security issue in Shoutbox [Fix included]

[Daniel15]

There is a security issue in the shoutbox that allows guests to post messages, even if it's disabled for guests...
Basically, if guests are not allowed to post in the shoutbox, the textarea is hidden from the template. However, the shoutbox script itself does not check whether guests are allowed to post messages or not. This allows guests to post messages via a properly constructed POST request. If you're encountering spam on your shoutbox, this is probably why!

To fix this, open Sources/TPModules.php, and find:

Code Select Expand


// a shout
if(isset($_POST['tp-shout-url'])){
if(isset($_POST['tp-shout'])){


Add after:

Code Select Expand


// Evil spambot?
if ($context['user']['is_guest'] && !$context['TPortal']['guest_shout'])
die('Hey! You\'re not allowed here!');


This is quite a crude solution, but works nontheless. I suggest that a proper fix be implemented in the next release of TinyPortal, as this is a rather serious issue.

Thanks

[bloc]

Thanks, Daniel. I will look at this asap.

[AleXit]

Hello,

I've a spam problem on my shotbox ( Tp v.0.9.8 ).

This fix did not resolve the problem

Please help me, I don't want to buy viagra and cialis...

[G6Cad]

Close it for guests and ban the ipnumbers from the members that post the crap

[AleXit]

My shoutbox is not visible by guests.

I've banned some IP, but they changed continuosly and so spam return shortly...

[G6Cad]

Ban the iprange or the isp
We cant really help you when you have it open for members only

What you can do is to change the permissions to post based so they have to have atleast 10 posts or more to be able to post in the shoutbox,

[IchBin]

It may be that perhaps you don't have the updated 0.9.8. Its been a long while, but there was an update at one time for shoutbox stuff. It should say 0.9.8.2 at the bottom of your forum if its updated I think.

[AleXit]

Ban the iprange or the isp
We cant really help you when you have it open for members only

What you can do is to change the permissions to post based so they have to have atleast 10 posts or more to be able to post in the shoutbox,

The shouts are not posted by members, but by unregistered people (Bots, I think) !

It may be that perhaps you don't have the updated 0.9.8. Its been a long while, but there was an update at one time for shoutbox stuff. It should say 0.9.8.2 at the bottom of your forum if its updated I think.

Looking at the package, I've the version 0.983

[G6Cad]

Then the only option you have is to make it post count based with your membergroups selection. Change the gropups so the first group you have mucy have atleast 10 posts or more to be able to use the shoutbox. Also make sure your registration for your forum have the captcha turned on.

[AleXit]

It is not the problem.

I explain again: spam messages in shoutbox are not posted by register members, so the group tip don't resolve that.

Spam messages are posted by visitor, unregistered bot (but shoutbox is set NOT visibile by guests).