TimThumb security issue

12 posts from 5 voices

• Started 1 year ago by robdobson
• Latest reply from Chris Beard
• This topic is not a support question

Tags:

No tags yet.

1. 

   robdobson
   Member

   I see someone mentioned about this in the Avisio forum but I have two sites using the Levitation theme.

   Firstly, if Auto Scaling is off in the Theme Options is it safe to delete the script completely and save any further problems? Or maybe just empty the file as you suggested in the Avisio forum but keep the file in place.

   But if Auto Scaling is on how do I go about updating the script for the Levitation theme? I tried to replace the code in timthumb.php with the new version of this script but it didn't work.

   Thanks in advance.

   Posted 1 year ago #
2. 

   Dude
   Dude

   Hey,
   Kriesi already works on updates. There's no need to panic though because hacker can find better targets than private or small business sites.

   Posted 1 year ago #
3. 

   robdobson
   Member

   Hi, in the version.rtf file of 1.3.2 it says...
   "file: framework/includes/timthumb.php : updated file for security reasons to latest version"

   But I don't understand what this means. There is no files in levitation/includes when I extract the zip.
   'includes' is just an empty folder that wasn't there in the previous version of the theme.
   And levitation/timthumb.php is exactly the same as before.

   I don't understand what's been updated. Can you explain it please.

   Thanks.

   Posted 1 year ago #
4. 

   Dude
   Dude

   Yes - I checked my levitation copy and Kriesi forgot to update the script. I'll notify him to release an updated version asap.

   Posted 1 year ago #
5. 

   robdobson
   Member

   Thank you. Could you post here please when it is available at ThemeForest.

   Posted 1 year ago #
6. 

   Dude
   Dude

   Yes - I'll post a notification here :)

   Posted 1 year ago #
7. 

   breakpoint
   Member

   Dude, has the Timthumb issue been corrected for the Levitation theme? I'd like to purchase it ASAP, but will wait until the fix is in place.

   Posted 1 year ago #
8. 

   Chris Beard
   

   You can edit the timthumb.php file to be likethis, this should solve the security issue though I'm uncertain if any other adjustments need to be made to function correctly with the Levitation theme.
   I'll check with Kriesi.

   Posted 1 year ago #
9. 

   breakpoint
   Member

   Is Kriesi on holiday? :)

   Posted 1 year ago #
10. 

    Kriesi
    Key Master

    Hey!

    Hey! yes the theme was updated a while ago with the latest version of timthumb ;)

    Regards,
    Kriesi

    Posted 1 year ago #
11. 

    robdobson
    Member

    No it wasn't. And still isn't. I quote from above...

    "Yes - I checked my levitation copy and Kriesi forgot to update the script. I'll notify him to release an updated version asap."

    Posted 1 year ago #
12. 

    Chris Beard
    

    The current version of the theme doesn't bring up any issues regarding the timthumb integration. If it does for you, could you specify what the problem is exactly?

    Posted 1 year ago #

RSS feed for this topic

Reply

You must log in to post.