Announcing CMS Made Simple 1.1.4.1 - Critical Update
Oct 7, 2007 by Ted Kulp
The ChangeLog looks a little something like this:
Version 1.1.4.1 "Taga" -- October 07 2007
-----------------
- Fix one issue in adodb_lite that cropped up after release
Version 1.1.4 "Taga" -- October 07 2007
-----------------
- Fixes an XSS issue in the anchor tag
- Fixes an XSS issue in listtags
- Adds a permission check to adduser.php
- More fixes for potential security issues with adodb_lite
- Added a permission check to view the admin log
Sorry for everyone that got 1.1.4. Sometimes we jump the gun a little bit when there is pressure to get a security release out into everyone's hands. It's best that it was on a Sunday (and a holiday in some areas of the world), so hopefully not too many people were affected. If you were, I apologize.
Thanks!
Ted
© Copyright 2007 by CMSMS™ and the posts author(s). All rights reserved.
11 Responses to "Announcing CMS Made Simple 1.1.4.1 - Critical Update"
http://pcs-alaska.com
On: Oct 8, 2007, Tim Jordan said:
Ted,
Love your project. Can't thank you enough for making a great way to manage web sites!
TJ
http://zaytsev.net
On: Oct 9, 2007, Yury V. Zaytsev said:
Well, as far as I can remember, it was the same thing with all the past 3 releases. I think that you do not need to rush the releases out, so you can hang out for a minute, take a deep breath and make sure you won't hate roll out an 1.x.x.1 in a few minutes.
http://zaytsev.net
On: Oct 9, 2007, Yury V. Zaytsev said:
Sorry, /hate/have to/s.
http://www.idevlop.com
On: Oct 9, 2007, Patrick said:
I love your project too.
But I really think you should stick to a maximum of 4 updates a year, whatever happens !
http://www.feuerwehrsuhr.ch
On: Oct 9, 2007, David said:
I Think it is a good thing to fix bugs as soon as possible. The longer you wait, the more time you give potential abusers time to compromise the security of your website and your webserver. Good job and great project!
http://techcom.dyndns.org
On: Oct 10, 2007, Robert Campbell said:
Patrick: When somebody finds a security issue would you rather us wait for the next quarter to fix it? Probably not. We jump as fast as possible on security issues, and sometimes we jump too fast and little problems sneak in.
With the upgrade process being as easy as it is (especially if you keep up on the upgrades), I think it's a better thing to release often, than release rarely.
http://...
On: Oct 10, 2007, Angelo said:
Crap! I just updated everything from 1.08 to 1.1.3.1. Guess here goes another round of updates.
Any idea if we'll ever see a way to "share" a codebase so that when I have to update 8-10 CMS installs, I only have to do it once?
Great product... still. And I've been a user since the "early" days (Remember, Ted, me and you working to get it working on IIS like 3 years ago?)
http://www.cubix.co.nz
On: Oct 10, 2007, Matt said:
I agree Robert, the sooner security related issues are resolved the better.
Keep up the great work!
On: Oct 11, 2007, draak said:
Guys, this might not be the right place for ideas, but as you are fixing insecurities, how about preventing them.
Synopsis:
preventing insecure logins if https is not available
Solution:
javascript based md5
http://pajhome.org.uk/crypt/md5/auth.html
http://zaytsev.net
On: Oct 11, 2007, Yury V. Zaytsev said:
I wonder why my comments are still avaiting moderation. Did I say anything offensive or what?
On: Oct 14, 2007, Michael Erb said:
Thank you for releasing these security updates as quickly as you do.
Anyone who thinks the security updates come too often obviously has never been the victim of a security vulnerability that has been exploited.
