Changes in [3857:f3946d839070:3858:ebcc8a63a4e1]

Files:

• CHANGELOG (modified) (1 diff)
• inc/core/class.dc.core.php (modified) (1 diff)
• inc/dbschema/upgrade.php (modified) (1 diff)

CHANGELOG

@@ +1 @@
+Dotclear 2.14.2 - 2018-09-04
+===========================================================
+* 🛡 Security: Authenticated cross-site scripting (XSS) was possible due to the .ahtml (or .bhtml, .chtml, …) file extension being allowed in the media manager. Thank's Josiah Pierce for report (CVE-2018-16358)
+* 🛡 Security: Unregister phar wrapper in order to avoid PHP Phar extension vulerability
+* Fix: Enter key in some input fields were not redirect to the parent form
+* Fix: Unable to save modified theme's files in theme editor, when Codemirror is used
+* Fix: Back to the original global_filters() template function (will be rewritten in the next 2.15)
+
 Dotclear 2.14.1 - 2018-08-17
 ===========================================================

inc/core/class.dc.core.php

@@ -1379 +1379 @@
                 array('lang', 'string', 'en',
                     'Default blog language'),
-                array('media_exclusion', 'string', '/\.(phps?|pht(ml)?|phl|s?html?|js|htaccess)[0-9]*$/i',
+                array('media_exclusion', 'string', '/\.(phps?|pht(ml)?|phl|.?html?|js|htaccess)[0-9]*$/i',
                     'File name exclusion pattern in media manager. (PCRE value)'),
                 array('media_img_m_size', 'integer', 448,

inc/dbschema/upgrade.php

@@ -688 +688 @@
         }
 
+        if (version_compare($version, '2.14.2', '<')) {
+            # Update flie exclusion upload regex
+            $strReq = 'UPDATE ' . $core->prefix . 'setting ' .
+                " SET setting_value = '/\\.(phps?|pht(ml)?|phl|.?html?|js|htaccess)[0-9]*\$/i' " .
+                " WHERE setting_id = 'media_exclusion' " .
+                " AND setting_ns = 'system' " .
+                " AND (setting_value = '/\\.php[0-9]*\$/i' " .
+                "   OR setting_value = '/\\.php\$/i') " .
+                "   OR setting_value = '/\\.(phps?|pht(ml)?|phl)[0-9]*\$/i' " .
+                "   OR setting_value = '/\\.(phps?|pht(ml)?|phl|s?html?|js)[0-9]*\$/i'" .
+                "   OR setting_value = '/\\.(phps?|pht(ml)?|phl|s?html?|js|htaccess)[0-9]*\$/i'";
+            $core->con->execute($strReq);
+        }
+
         if (version_compare($version, '2.15', '<')) {
             # switch from jQuery 1.11.3 to 1.12.4