Contents of shoutbox can be accessed without logging in

[hauntedrows]

It appears that the shoutbox.php URI is not secured by a check to ensure that the user is logged in.

By editing the URL, any user can bring up the current contents of the tracker's shoutbox in a browser window.

This would appear to be a serious security hole.

[xiaomlove]

Fixed, see here