Textpattern Forum

You are not logged in. Register | Login | Help

#11 2006-09-01 02:31:54

net-carver
Admin
From: UK
Registered: 2006-03-08
Posts: 1,648

Re: [plugin] [ORPHAN] sed_anon_file_upload

FYI, I intend releasing v0.8 shortly after the release of TxP 4.0.4.

0.8 will also patch a potential security risk. However, you can patch it manually in your v0.7 installations as follows…

  1. Edit the plugin.
  2. Scroll down until you see the start of the _get_afu_state_data() routine…
  3. Look for these lines in that function…
    <pre>// —— Data from the form…
    $d[‘permissions’] = 0755;</pre>
  4. Change 0755 to 0644. This removes execution privileges from uploaded files.
  5. Make sure you save the change.

I became aware of this after switching to linux on my desktop and then spotting this post by Ruud in the testing forum…


Steve
Textile | My plugins on GitHub | @netcarver

Offline

#12 2006-10-25 02:40:30

soulship
Member
From: Always Sunny Charleston
Registered: 2004-04-30
Posts: 669
Website

Re: [plugin] [ORPHAN] sed_anon_file_upload

Does 4.0.4 require any other code adjustments for security on this Steve? I made the other changes when you posted the info.

Thanks!

Offline

#13 2006-10-27 06:22:45

net-carver
Admin
From: UK
Registered: 2006-03-08
Posts: 1,648

Re: [plugin] [ORPHAN] sed_anon_file_upload

soulship

There are no other updates re security that I am aware of for 4.0.4. There are a few other things pending for 4.0.4 but not in that area.

I hope to release the 4.0.4 ready version very soon.


Steve
Textile | My plugins on GitHub | @netcarver

Offline

#14 2007-01-10 02:15:35

tjnuckolls
Member
From: Los Angeles, CA
Registered: 2005-03-23
Posts: 23
Website

Re: [plugin] [ORPHAN] sed_anon_file_upload

Just checkin’ in on the progress of sed_anon_file_upload for Textpattern 4.0.4. It seems as though there’s something up with mem_moderation as far as 4.0.4 goes as well, but being pretty much a non-coder, I have no idea. I did take the liberty of leaving a quick post on that forum just to cover my bases.

Offline

#15 2007-01-10 07:50:57

net-carver
Admin
From: UK
Registered: 2006-03-08
Posts: 1,648

Re: [plugin] [ORPHAN] sed_anon_file_upload

TJ

you have mail!


Steve
Textile | My plugins on GitHub | @netcarver

Offline

#16 2007-01-10 08:18:47

tjnuckolls
Member
From: Los Angeles, CA
Registered: 2005-03-23
Posts: 23
Website

Re: [plugin] [ORPHAN] sed_anon_file_upload

YOU ARE THE MAN!

This is such a great plugin. Thanks for all of your work! You’re a great asset to the community.

Best Regards,
TJ

Offline

#17 2007-04-15 13:49:54

masa
Member
From: Reykjavik, Iceland
Registered: 2005-11-25
Posts: 1,079

Re: [plugin] [ORPHAN] sed_anon_file_upload

Is this plugin available now? I couldn’t find a link.

Cheers Martin

Offline

#18 2007-04-15 15:51:56

colak
Admin
From: Cyprus
Registered: 2004-11-20
Posts: 4,970
Website

Re: [plugin] [ORPHAN] sed_anon_file_upload

masa wrote:

Is this plugin available now? I couldn’t find a link.

Hi Martin
You have to write to steve directly. Check this page

Last edited by colak (2007-04-15 15:52:16)


Yiannis
——————————
neme.org | neme-imca.org | hblack.net | LABS

Online

#19 2007-04-15 22:53:54

masa
Member
From: Reykjavik, Iceland
Registered: 2005-11-25
Posts: 1,079

Re: [plugin] [ORPHAN] sed_anon_file_upload

colak wrote:
You have to write to steve directly.

OK, thanks muchly!

Offline

#20 2007-04-18 09:34:18

net-carver
Admin
From: UK
Registered: 2006-03-08
Posts: 1,648

Re: [plugin] [ORPHAN] sed_anon_file_upload

masa

you have mail.


Steve
Textile | My plugins on GitHub | @netcarver

Offline

Board footer

Powered by FluxBB