Only
apply this fix if you downloaded
the software before 12-21-05.
Under certain conditions it is possible
for hackers to do a sql injection
exploit. By changing the following
code the problem should be fixed.
Make sure you back the following
file before you make the following
change:
File
to make change: omnisupport.php
Search
for:
/*
recover from register_globals=off
*/
if(!ini_get('register_globals'))
{
and
replace with:
/*
emulate magic_quotes_gpc behaviour
when it's off */
if(!get_magic_quotes_gpc()) {
function addslashes_deep($value)
{
$value = is_array($value) ?
array_map('addslashes_deep', $value)
:
addslashes($value);
return
$value;
}
$_POST
= array_map('addslashes_deep', $_POST);
$_GET = array_map('addslashes_deep',
$_GET);
$_COOKIE = array_map('addslashes_deep',
$_COOKIE);
}
/*
recover from register_globals=off;
* also override globals when magic_quotes_gpc=off
*- this wil sanitise input */
if(!ini_get('register_globals')
|| !get_magic_quotes_gpc()) {
