[FIX] v1.3.5 XSS Exploits Found

[Merlinpa1969]

yes, the updates forum.

[IHaveADotCom]

Ah.... You mean the big blue link that says "Click here to subscribe to these announcements."?

Thanks!

[sadie]

If we are running 2.6, should we apply these fixes?

[DrByte]

Okay ... Yes ... I'll go on record as saying ... yes ... everyone should apply these fixes.

The line numbers may be different, and the content slightly different too. But the concept of the fix is the same.

[DrByte]

If we are running 2.6, should we apply these fixes?

As for people running v1.2.6, you really should at least upgrade to v1.2.7 due to important security bugfixes applied to 1.2.7. That's in addition to this suggested fix, which is very minor in comparison to the fixes for 1.2.7

[MBSJEWELRY]

Ah.... You mean the big blue link that says "Click here to subscribe to these announcements."?

wait.. what? where is that??d:

[ideasgirl]

Look for the Patch in SourceForge.

[DrByte]

These fixes are all built-in to v1.3.6

[henrygoh]

Dr Byte,

Does it mean that my recently installed 1.3.5 and patched as suggested earlier is basically up-to-date exceot for the new stylesheets?

Thanks.

henry

[DrByte]

Dr Byte,

Does it mean that my recently installed 1.3.5 and patched as suggested earlier is basically up-to-date exceot for the new stylesheets?

Thanks.

henry

No. There were a LOT of fixes and feature improvements build in 1.3.6, especially address-form related fixes.
But, as far as XSS security issues, yes, you are up-to-date on known security issues if you've applied both posted patches for 1.3.5.
You still should be upgrading to 1.3.6 for the address-form benefits though.