Currently is someone is able to hack into one your of moderator accounts they could use it to launch a XSS assack since they could select the option to use HTML in announcements.
To fix this open modcp/announcement.php
Change
to
All you are doing is commenting it out. You will need to do this each time you upload a new version of vbulletin.
To fix this open modcp/announcement.php
Change
PHP:
print_yes_no_row($vbphrase['allow_html'], 'announcementoptions[allowhtml]', ($announcement['announcementoptions'] & $vbulletin->bf_misc_announcementoptions['allowhtml'] ? 1 : 0));to
PHP:
//print_yes_no_row($vbphrase['allow_html'], 'announcementoptions[allowhtml]', ($announcement['announcementoptions'] & $vbulletin->bf_misc_announcementoptions['allowhtml'] ? 1 : 0));All you are doing is commenting it out. You will need to do this each time you upload a new version of vbulletin.
![[OzzModz] Display Visitor Name ( [you] Mod)](/data/resource_icons/0/342.jpg?1709004947){kind=icon}
![[CSCN] Roman Numeral Chord BB Code Support](/data/resource_icons/0/341.jpg?1624724061){kind=icon}
![[ShikiSuen] CSCN Anniversary theme (for AdminCP Only)](/data/resource_icons/0/340.jpg?1624032501){kind=icon}
![[OzzModz] Login By Country Log](/data/resource_icons/0/339.jpg?1623080236){kind=icon}
![[OzzModz] Nag Guests To Register](/data/resource_icons/0/338.jpg?1623079745){kind=icon}
![[OzzModz] Anti Bump](/data/resource_icons/0/337.jpg?1623079305){kind=icon}