A few sites have been encountering problems with logging in following the recent login vulnerability patch. I've identified that the preg_match line is producing false results causing valid logins to fail. This line has been dropped but the stripinput function should be ample enough to prevent any problems.
So the three lines in fusion_core.php directly after:
if (isset($_POST['login'])) {
Are now as follows:
$user_name = stripinput($_POST['user_name']);
$user_pass = md5($_POST['user_pass']);
$result = dbquery("SELECT * FROM ".$fusion_prefix."users WHERE user_name='$user_name' and user_password='$user_pass'");
I've updated the service pack and sourceforge package to include this alteration. Thanks.
