Exploits

27-Jul-2001

After discovering this, we've built a new security system in both front and back ends of Mambo which we hope will keep out the nasties from your sites. This is a major upgrade and requires a re-install of Mambo 3.0.6. We have taken the opportunity to add encryption back into the database and some other nice features. The install kit has a script which will update your database so that you don't have to re-key all your data. Please be sure to read all the relevant README files to ensure a smooth transition.

Because the new version of Mambo has significantly changed to improve security, there have been several changes to the structure of the database.

A major change that would affect your database is the fact that all passwords are now stored encrypted in the database. Therefore, any existing users you have set up in your database currently will no longer be able to login using the current passwords.

We've included a script with this package, that will get all of your current user records, encrypt the exisiting passwords and place them back into the database. This script will also update the session table, adding two new fields and changing the datatype of one of the existing fields.

It's recommended before you run this update script that you take a back-up copy of your original database structure and records so that if anything goes wrong during the update, you can always revert back to your original structure and data.

To run this update, open the "UpdateDBUsers.php" file in your browser window. Thats it! Its recommended that after you've run this script, you delete the file from your server so that no-body can run the script again without your verification.

Version 3.0.6

20-Jul-2001

Version 3.0.6 has been released and is ready for download. The main implementations in this version are the incorporation of the security provisions, database updates to allow for sessions and password encryption, small bug-fixes with the Poll etc.

We have also added the Upload PDF feature from our commercial version to the Image Gallery. This works like the images feature by giving the you the html "a href" code for the link to the uploaded pdf to copy & paste.

The following errors were fixed:

• Poll votes were not incrementing
• When unpublishing a poll on the same page as another poll, the remaining published poll was not always displaying.
• Also sometimes the unpublished poll was also displaying.
• Surveys/Polls title was not reading from the database
• When viewing poll results, and changing to "Show All Months" a did not execute query error was showing problem where by there were no sub-menus being displayed for the "Statistics".
• As you moved the poll to the left side of the page and try and view results, a did not execute query occurred.
• This was due to the variable $pollID was being cleared before it reached the query.
• Problem whereby changing the user menu to appear on the left hand side rather than the right, will not show any of the user submission forms.
• Also there was a lot of files changed to implement new security procedures.

See "security_release.dat" for more details