fplanque wrote:

Yes, almost all PHP blog tools are affected.

Please download the fix:
http://b2evolution.net/news/2005/07/05/fix_for_xml_rpc_vulnerability

Hello,

Thank you for the kind and fast support.
Mine is 0.9.0.1.1. following suggested patches.

After the Patch files attempted then in surface it has no error
but during the New Post try to Pinging I've got errors ... likely;
-----
Ping to b2evolution.net
Remote error: XML error: not well-formed (invalid token) at line 15 (104)
-----
Ping to technorati.com
Remote error: Application failed during request deserialization: not well-formed (invalid token) at line 6, column 21, byte 117 at /usr/local/lib/perl5/site_perl/5.8.6/i686-linux/XML/Parser.pm line 187 (-1)
-----

I have backup for the Patch Files, so I'm forced to return the 2 files to
older ones. How can I edit ... or any suggestion to make new replace
files to work?

Thanks,
Fougino, Osaka, Japan

I might go so far as to suggest that failed pingbacks are not nearly as serious a problem as someone owning your server. Consider putting the patch back into place and suffer the broken pingbacks until that issue is fixed.

gloin wrote:

I might go so far as to suggest that failed pingbacks are not nearly as serious a problem as someone owning your server. Consider putting the patch back into place and suffer the broken pingbacks until that issue is fixed.

Oh, yes. Thanks for suggestion.
I replaced two patch files back.

Awaiting a good news for the new patch files for 0.9.0.1.1.

Thanks,
Fougino, Osaka, Japan

I'd just upgrade to 0.9.0.12. It took me half an hour with a heavily hacked installation. A standard install can be upgraded in as little as five minutes.

Let me confess that my own blog is running 0.9.0.11 and not .12 but has all the security patches... and guess what: it pings without a problem.

So I'd say the problem is somewhere else...

fplanque wrote:

Let me confess that my own blog is running 0.9.0.11 and not .12 but has all the security patches... and guess what: it pings without a problem.

So I'd say the problem is somewhere else...

Thank you for the valuable information.
Now I remember I have made some hacking around pinging to adapt
ping-o-matic with which I can PING 12 centres at once. Then, to avoid
SPAM via httpd I've also touched the codes.

I will look around by myself.
Thanks again,
Fougino, Osaka, Japan

fougino wrote:

fplanque wrote:

Let me confess that my own blog is running 0.9.0.11 and not .12 but has all the security patches... and guess what: it pings without a problem.

So I'd say the problem is somewhere else...

Thank you for the valuable information.
Now I remember I have made some hacking around pinging to adapt
ping-o-matic with which I can PING 12 centres at once. Then, to avoid
SPAM via httpd I've also touched the codes.

I will look around by myself.
Thanks again,
Fougino, Osaka, Japan

Still working around these...
And...I have found these posts mentioning BlogTitle not_in_English.

http://forums.b2evolution.net/viewtopic.php?t=3142

http://forums.b2evolution.net/viewtopic.php?t=3879

I am wondering why it did not happen before the patch attempted
even I use Japanese UTF-8 Blog Titles and now it becomes such
"XML error: not well-formed (invalid token)" error.

Does anyone who use Language other than English have any idea?
Or, possibly any solution for this issue.

Thanks,
Fougino, Osaka, Japan

To find out, I've downloaded and installed 0.9.0.12 default install,
it means no hacks and code changes by myself, to different location.

After checking the size of 2 Patch files, I've replaced two patch files.

I made a new post in Japanese language to Blog B which is English
Title of b2evo defaults and also made a post to Blog A whose title
is changed into Japanese language for test purpose.

Both post failed to PING to Weblogs.com saying that...

Reply: [1]
"Can't accept the ping because the URL must begin with http://."

So, I changed language to submit into English(US) and posted.
I made these test via IE6_JP and Firefox1.0.4JP and the results
are same.

Are there any possibility the part of performing XML array for
pinging posts having error?

Thanks,
Fougino, Osaka, Japan

In before the Patch files attemption, in my environment,
the BlogTitle in Japanese worked without fail when pinging.

Now it returns error that the XML is not performed well.

It seems that is the same issue reported by following articles;

http://forums.b2evolution.net/viewtopic.php?t=3142
http://forums.b2evolution.net/viewtopic.php?t=3879

When I tried to change the BlogTitle into English then no error.
(except b2evolution returned error, may be it seeks also each
blog posting title which remains in Japanese chars, and others
such as technorati and also pingomatic accepts my ping).

Since it had been working well, I would like to make it back
to my BlogTitle in Japanese. Could it be possible to touch codes
to make BlogTitle in users home language? It would be nice not
only for me but who would like to use German Umlauts.

Can someone be a help for this issue?
At least, where is the code to be touched?
With my skill, I could not figure out where it is.

Thanks,
fougino, Osaka, Japan