LA 1.2.2 Released

For more info check the change log: http://www.gameogre.com/forums/living-avatars/18212-download-1-2-2-a.html

 

Correct, this update is only for those with the free version. I have not seen the LA pro files so assuming it is very similar to the current 1.2 then the security fix is within includes/mysql.php
Within the query() function there is the following code:

Code:

$query_string = preg_replace("#{([^}]\S+)}#", PRGM_TABLE_PREFIX . "$1", $query_string);

That has been replaced with

Code:

$find = array(
			'/FROM {(.*?)}/',
			'/INTO {(.*?)}/',
			'/JOIN {(.*?)}/',
			'/UPDATE {(.*?)}/',
			'/CREATE TABLE {(.*?)}/',
			'/SHOW TABLES LIKE \'{(.*?)}\'/',
			'/LEFT JOIN {(.*?)}/'
		);
$replace = array(
			'FROM '.PRGM_TABLE_PREFIX.'$1',
			'INTO '.PRGM_TABLE_PREFIX.'$1',
			'JOIN '.PRGM_TABLE_PREFIX.'$1',
			'UPDATE '.PRGM_TABLE_PREFIX.'$1',
			'CREATE TABLE '.PRGM_TABLE_PREFIX.'$1',
			'SHOW TABLES LIKE \''.PRGM_TABLE_PREFIX.'$1\'',
			'LEFT JOIN '.PRGM_TABLE_PREFIX.'$1'
		);
$query_string = preg_replace($find, $replace, $query_string);

This eliminates a potential SQL injection

Insydius, to make this work I had to change some of the queries to use LEFT JOIN so it may not be that easy to apply in the Pro version yourself

Edit: It appears I actually forgot to include this fix in the zip uploaded, so could you all please redowload it, sorry

 

Ditto

Sorry I have been inactive for the past few weeks. Had exam results, just got into University so been sorting that all out. Should be back to developing very soon. I am still looking for someone with vb 4.1.5 to test the next version which uses vb's built in user functions etc