diff --git a/phpBB/docs/CHANGELOG.html b/phpBB/docs/CHANGELOG.html index 875dbf1400..1ba713b1b9 100644 --- a/phpBB/docs/CHANGELOG.html +++ b/phpBB/docs/CHANGELOG.html @@ -186,6 +186,7 @@
  • [Fix] Do not try to create thumbnails for images we cannot open properly. (Bug #48695)
  • [Fix] Apply locale-independent basename() to attachment filenames. New function added: utf8_basename(). (Bug #43335 - Patch by ocean=Yohsuke)
  • [Fix] Adjust build_url() to not prepend $phpbb_root_path if path returned from redirect() is an URL. This fixes redirect issues with some installations and bridges. (Bug #47535)
  • +
  • [Fix] Fix general error while registration, through undefined variable $config in validate_referer (Bug #49035 - Patch by wjvriend)
  • [Change] Change the data format of the default file ACM to be more secure from tampering and have better performance.
  • [Change] Add index on log_time to the log table to prevent slowdown on boards with many log entries. (Bug #44665 - Patch by bantu)
  • [Change] Template engine now permits to a limited extent variable includes.
  • diff --git a/phpBB/includes/session.php b/phpBB/includes/session.php index a49716a8db..b4d817daf9 100644 --- a/phpBB/includes/session.php +++ b/phpBB/includes/session.php @@ -1364,6 +1364,8 @@ class session */ function validate_referer($check_script_path = false) { + global $config; + // no referer - nothing to validate, user's fault for turning it off (we only check on POST; so meta can't be the reason) if (empty($this->referer) || empty($this->host)) { @@ -1373,7 +1375,7 @@ class session $host = htmlspecialchars($this->host); $ref = substr($this->referer, strpos($this->referer, '://') + 3); - if (!(stripos($ref, $host) === 0) && (!$config['force_server'] || !(stripos($ref, $config['server_name']) === 0))) + if (!(stripos($ref, $host) === 0) && (!$config['force_server_vars'] || !(stripos($ref, $config['server_name']) === 0))) { return false; }