27-Jul-2001Thanks to the all the hard-working people for distributing out to the world the exact exploits to hack Mambo and the code to do it.
After discovering this, we've built a new security system in both front and back ends of Mambo which we hope will keep out the nasties from your sites. This is a major upgrade and requires a re-install of Mambo 3.0.6. We have taken the opportunity to add encryption back into the database and some other nice features. The install kit has a script which will update your database so that you don't have to re-key all your data. Please be sure to read all the relevant README files to ensure a smooth transition.
Because the new version of Mambo has significantly changed to improve security, there have been several changes to the structure of the database.
A major change that would affect your database is the fact that all passwords are now stored encrypted in the database. Therefore, any existing users you have set up in your database currently will no longer be able to login using the current passwords.
We've included a script with this package, that will get all of your current user records, encrypt the exisiting passwords and place them back into the database. This script will also update the session table, adding two new fields and changing the datatype of one of the existing fields.
It's recommended before you run this update script that you take a back-up copy of your original database structure and records so that if anything goes wrong during the update, you can always revert back to your original structure and data.
To run this update, open the "UpdateDBUsers.php" file in your browser window. Thats it! Its recommended that after you've run this script, you delete the file from your server so that no-body can run the script again without your verification.
Version 3.0.6 has been released and is ready for download. The main implementations in this version are the incorporation of the security provisions, database updates to allow for sessions and password encryption, small bug-fixes with the Poll etc.
We have also added the Upload PDF feature from our commercial version to the Image Gallery. This works like the images feature by giving the you the html "a href" code for the link to the uploaded pdf to copy & paste.
The following errors were fixed:
See "security_release.dat" for more details