UlinkSeo

khalid

Download






create .htaccess

and add

1. <Files ~ "^\.(htaccess|htpasswd)[        DISCUZ_CODE_0        ]quot;>
   
2. deny from all
   
3. </Files>
   
4. 
   
5. RewriteEngine On
   
6. RewriteBase /discuz
   
7. 
   
8. RewriteCond %{QUERY_STRING} ^(.*)$
   
9. RewriteRule ^forum-(.*)-(\w+)-([0-9]+)\.html$ forum.php?mod=forumdisplay&fid=$2&page=$3&%1
   
10. RewriteCond %{QUERY_STRING} ^(.*)$
    
11. RewriteRule ^post-(.*)-([0-9]+)-([0-9]+)-([0-9]+)\.html$ forum.php?mod=viewthread&tid=$2&extra=page\%3D$4&page=$3&%1

Copy the Code

if you use root



change RewriteBase /discuz



and remove discuz





if you use other name change it

vot

Check please for the next titles:
'العربية'
'Español'
'Français'
'한국어'
'zdążyłeś'
'Русский'
'ภาษาไทย'
'Türkçe'
'Tiếng Việt'

What the resulting URL will created?

khalid

Yes

Tested in Arabia lang

vot

Show URLs for the above titles!

khalid

vot

I see...
Resulting URL is not encoded...

But what about vulnerabilities?
Is there any URL verification/cleaning/filtering inside the plugin code?

khalid

vot 2013-7-16 14:20
I see...
Resulting URL is not encoded...

I can't understand what you want !

vot

Web standards requires all the URLs to hhtp-servers must be encoded with the "URL Encode" algorith.
In other words there must be only English/digits/special_chars in the url.
But for the above plugin we see all the URLs are NON encoded.
But in most cases this is not critical, because of a browser encodes URL by itself.

But I afraid about such type URL can contain a special prepared hacking code,
and it can give an access to your server for a hackers...

khalid

vot 2013-7-16 18:25
Web standards requires all the URLs to hhtp-servers must be encoded with the "URL Encode" algorith.
...

I see this in wordpress !!

how it do ?

vot

We just need to check/test the code...