Literal "localhost" or "127.0.0.1" in URL settings for avatars and attachments modules

[yuliu]

Literal "localhost" or "127.0.0.1" in URL settings for avatars and attachments modules will prevent themselves from running. Hosts in URLs should be checked for such subjects, rather than in arbitrary path strings.

• avatars:
  

  merge-system/resources/modules/avatars.php

  Line 149 in d453ec2

  if(strpos($mybb->input['avatarspath'], "localhost") !== false)

  
  

  merge-system/resources/modules/avatars.php

  Line 155 in d453ec2

  if(strpos($mybb->input['avatarspath'], "127.0.0.1") !== false)

• attachments:
  

  merge-system/resources/modules/attachments.php

  Line 192 in d453ec2

  if(strpos($mybb->input['uploadspath'], "localhost") !== false)

  
  

  merge-system/resources/modules/attachments.php

  Line 198 in d453ec2

  if(strpos($mybb->input['uploadspath'], "127.0.0.1") !== false)