Geeklog 1.6.0sr1 and 1.5.2sr5
- Thursday, July 30 2009 @ 02:00 pm EDT
- Contributed by: Dirk
- Views: 8,716
Geeklog 1.6.0sr1 and 1.5.2sr5 address the following security issues:
- Gerendi Sandor Attila reported an XSS in the forms to email a user and to email a story to a friend.
- The "Mail Story to a Friend" function didn't check story permissions, so that it was possible to email a story even if you didn't have the permissions to view it on the site.
For Geeklog 1.6.0, we also fixed two bugs (an SQL error when the story submission queue was off and a call to a nonexistent function).
The following files are available:
- a complete tarball of Geeklog 1.6.0sr1
- an upgrade archive from Geeklog 1.6.0
- an upgrade archive from Geeklog 1.5.2sr4
- a combo update from any previous 1.5.2 version