Changes in [3375:f3f69bda3bd0:3380:36bd6b2f5e57]

Files:

• .hgtags (modified) (1 diff)
• CHANGELOG (modified) (1 diff)
• admin/auth.php (modified) (3 diffs)

.hgtags

@@ -31 +31 @@
 d23a41b088d94d55829a1644eedcc16f626d03ce 2.10.1
 e8ad524d494dfbff909875b953db9f945a0f999c 2.10.2
+e4744a9b44d89e52cd5038da93f8453f62a62a4f 2.10.3

CHANGELOG

@@ +1 @@
+Dotclear 2.10.3 - 2016-11-01
+===========================================================
+* Security: Fix CVE-2016-7903: Password Reset Address Spoof — Thank's Hongkun Zeng for report
+* Security: Fix CVE-2016-7902: Media Manager, unrestricted File Upload — Thank's Hongkun Zeng for report
+* CSP: Cope with external sources used in editor's iframe to preview public external content
+* Fix: Cope with post.post_position field during flat import
+* Fix: Prevents precondition failed during currently activated theme update
+* Fix: Remove unecessary header (cope by dotclear) in page plugin
+* Fix: Let some proxies playing with standard http and https ports
+* Fix: Let SSL runs through a proxy, it may be ok, sometimes
+* 🐛 → Various bugs and typos fixed
+
 Dotclear 2.10.2 - 2016-08-17
 ===========================================================

admin/auth.php

@@ -88 +88 @@
           $recover_key = $core->auth->setRecoverKey($user_id,$user_email);
 
-          $subject = mail::B64Header('DotClear '.__('Password reset'));
+          $subject = mail::B64Header('Dotclear '.__('Password reset'));
           $message =
           __('Someone has requested to reset the password for the following site and username.')."\n\n".
@@ -113 +113 @@
           $recover_res = $core->auth->recoverUserPassword($akey);
 
-          $subject = mb_encode_mimeheader('DotClear '.__('Your new password'),'UTF-8','B');
+          $subject = mb_encode_mimeheader('Dotclear '.__('Your new password'),'UTF-8','B');
           $message =
           __('Username:').' '.$recover_res['user_id']."\n".
@@ -119 +119 @@
           preg_replace('/\?(.*)$/','',$page_url);
 
-          $headers[] = 'From: dotclear@'.$_SERVER['HTTP_HOST'];
+          $headers[] = 'From: '.(defined('DC_ADMIN_MAILFROM') && DC_ADMIN_MAILFROM ? DC_ADMIN_MAILFROM : 'dotclear@local');
           $headers[] = 'Content-Type: text/plain; charset=UTF-8;';