This week's book giveaway is in the Other Languages forum. We're giving away four copies of Functional Reactive Programming and have Stephen Blackheath and Anthony Jones on-line! See this thread for details.
Just a note to everyone that there is a minor security issue in the handling of IP addresses.
function public String getRemoteAddr() in src/net/jforum/context/web/WebRequestContext will try and get an IP address from the x-forwarded-for HTTP header. It is possible to send a fake header and therefore fake the IP address. A fake IP address can be targeted to any other user on the site, and by posting illegal content, they might be able to trick a mod into banning an IP address, and therefore banning an innocent user.
You can fix this by changing the content of this function to just:
but this will return proxy server IP addresses instead of specific IP addresses, which could lead to innocent users getting blocked as well. It is probably marginally safer to use this option though as it prevents deliberate targeting of established innocent users and it prevents users from setting up unblockable abusive accounts.
Thanks again for the great forum software! I have not found any other security issues whilst auditing it so far [originally posted on jforum.net by legoburner]