Vanilla 1.0.3 Released
Mark
Dec 4th 2006
Security, Release, Vanilla
Yet another location for the register_globals attack has been discovered in the Vanilla core. If you are upgrading from the Vanilla 1.0.2 release, you don't need to download the new package to apply the patch. Just add the following code to the second line of your conf/extensions.php file:
if (!defined('IN_VANILLA')) exit();
I am also putting all extension authors on alert: If any of your extensions include external files, you need to add the line above to your extension files. I will be contacting all of the extension authors by email later today with more detailed instructions.
Thanks go out to Dinoboff for locating the additional security holes.
11 comments
Jump to LatestAm I miss understanding the post, do I need to download and apply the patch first?
If you are upgrading from some other release, then you'll need to do a full upgrade - instructions are included in the package.
The reason a grep doesn't show any changes is because Vanilla doesn't include your conf/*.php files by default. It creates them automatically when you do your install. If, however, you already have Vanilla installed, you will have to add the line manually.
If it were a perfect world, I'd have time to finish Swell, Fix up the addons site so it also has comments and RSS feeds, AND get all of the Vanilla changes and updates into place.
But sadly, this is reality.
Any idea why?