Edit Profile vulnerability patch

editprofile.php

Line 165
added this line:

above this line:

---

fusion_core/update_profile.php

From Line 46:
Replace:

if (!preg_match("/^[0-9A-Z]+$/i", $_POST['user_newpassword'])) {

     $error .= LAN_444."\n";

}

with:

if ($_POST['user_hash'] == $userdata['user_password']) {

     if (!preg_match("/^[0-9A-Z]+$/i", $_POST['user_newpassword'])) {

          $error .= LAN_444."
\n";

     }

} else {

     $error .= LAN_450."
\n";

}

---

editprofile.php language file
define("LAN_450", "Warning:</b> unexpected script execution.");