So... about this security vulnerability...

Any chance of a blog post for those who don't check their emails/aren't subscribed?

BoonEx Certified Host: Zarconia.net - Fully Supported Shared and Dedicated for Dolphin
Quote · 26 Jul 2012

I AM subscribed and I didn't get any email... is it something new to 7.1? I tried to google it and see if it had hit all the "security" sites yet but all I could find was an article on 

 

"Female reproductive success in bottlenose dolphins"

 

while informative it didn't really help me any new vulnerabilities..  

BoonEx Certified Host: Zarconia.net - Fully Supported Shared and Dedicated for Dolphin
Quote · 26 Jul 2012

Here's the relevant portion of the email:

 

Dolphin 7.0.9 Security Update  

The current stable version - Dolphin 7.0.9 (and likely older versions, too) has been reported to have a security issue which may affect your site in some very special circumstances. Although odds of the attack are relatively low we recommend a prompt update of your site code to fix the vulnurability. Dolphin 7.1 has this vulnerability fixed, but since it isn't released yet we decided to publish this temporary workaround.

Instructions:

Step 1. Find file: /inc/classes/BxDolFilesModule.php 
locate code (near line 315): 
$sCaption = _t('_' . $this->_oConfig->getMainPrefix() . '_browse_by_' . $sParamName, process_pass_data($sParamValue)); 
replace with:
$sCaption = _t('_' . $this->_oConfig->getMainPrefix() . '_browse_by_' . $sParamName, htmlspecialchars_adv(process_pass_data($sParamValue)));

Step 2. Find file: /modules/boonex/files/classes/BxFilesModule.php 
locate code (near line 150): 
$sCaption = _t('_' . $this->_oConfig->getMainPrefix() . '_browse_by_' . $sParamName, process_pass_data($sParamValue)); 
replace with:
$sCaption = _t('_' . $this->_oConfig->getMainPrefix() . '_browse_by_' . $sParamName, htmlspecialchars_adv(process_pass_data($sParamValue)));

Step 3. Find file: /modules/boonex/map_profiles/classes/BxMapModule.php
locate code (near line 842): 
'text' => $r['address'] ? $r['address'] : _t('_bx_map_the_same_address'),
replace with:
'text' => $r['address'] ? htmlspecialchars_adv($r['address']) : _t('_bx_map_the_same_address'), 

Save changes and rock on!

BoonEx Certified Host: Zarconia.net - Fully Supported Shared and Dedicated for Dolphin
Quote · 26 Jul 2012

Cool, thanks!

BoonEx Certified Host: Zarconia.net - Fully Supported Shared and Dedicated for Dolphin
Quote · 26 Jul 2012

Made a blog post in the mean time.

BoonEx Certified Host: Zarconia.net - Fully Supported Shared and Dedicated for Dolphin
Quote · 26 Jul 2012
 
 
Below is the legacy version of the Boonex site, maintained for Dolphin.Pro 7.x support.
The new Dolphin solution is powered by UNA Community Management System.