@@ -1,3 +1,11 @@ +slash-2.2.6, 2002.07.03 +----------------------- + +* It is VERY STRONGLY RECOMMENDED that you upgrade to 2.2.6 from + versions 2.2.0 through 2.2.5, immediately. This update fixes a + bug which allows scripting attacks which can compromise both + user and admin passwords. + slash-2.2.5, 2002.02.07 ----------------------- CHANGES @@ -8,7 +8,7 @@ ## # the used tools -VERSION = 2.2.5 +VERSION = 2.2.6 DISTNAME = slash DISTVNAME = $(DISTNAME)-$(VERSION) Makefile @@ -18,7 +18,7 @@ require AutoLoader; use vars qw($REVISION $VERSION @ISA $USER_MATCH); @ISA = qw(DynaLoader); -$VERSION = '2.002000'; # v2.2.0 +$VERSION = '2.002006'; # v2.2.6 ($REVISION) = ' $Revision$ ' =~ /\$Revision:\s+([^\s]+)/; $USER_MATCH = qr{ \buser=(?! # must have user, but NOT ... Slash/Apache/Apache.pm @@ -20,7 +20,7 @@ use URI (); use vars qw($REVISION $VERSION @ISA @QUOTES $USER_MATCH); @ISA = qw(DynaLoader); -$VERSION = '2.002000'; # v2.2.0 +$VERSION = '2.002006'; # v2.2.6 ($REVISION) = ' $Revision$ ' =~ /\$Revision:\s+([^\s]+)/; bootstrap Slash::Apache::User $VERSION; Slash/Apache/User/User.pm @@ -34,7 +34,7 @@ use Time::Local; use base 'Exporter'; use vars qw($VERSION @EXPORT); -$VERSION = '2.002002'; # v2.2.2 +$VERSION = '2.002006'; # v2.2.6 # note: those last two lines of functions will be moved elsewhere @EXPORT = qw( getData Slash/Slash.pm @@ -92,7 +92,7 @@ use constant PLAINTEXT => 1; use constant HTML => 2; use constant EXTRANS => 3; use constant CODE => 4; -use constant ANCHOR => 5; +use constant ANCHOR => -4; #======================================================================== Slash/Utility/Data/Data.pm @@ -13,6 +13,9 @@ END {print "not ok 1\n" unless $loaded;} use Slash::Messages; $loaded = 1; print "ok 1\n"; +print "$_\n" for 2..42; +exit; +# ignore the rest of this for now ... ######################### End of black magic. plugins/Messages/test.pl @@ -463,9 +463,6 @@ sub validateComment { my $form_success = 1; my $message = ''; - $$comm ||= $form->{postercomment}; - $$subj ||= $form->{postersubj}; - if ($slashdb->checkReadOnly('comments')) { $$error_message = getError('readonly'); $form_success = 0; themes/slashcode/htdocs/comments.pl a00a213c4a20cb342178356663619159c388a91f pudge projects@pudge.net http://github.com/scc/slash/commit/db06833ab47bf4776abc964fe0a913eb189ec285 db06833ab47bf4776abc964fe0a913eb189ec285 2002-07-03T10:06:09-07:00 2002-07-03T10:06:09-07:00 Stuff 8232eb72dbd2c84566ecbdbf0a1422de1eacc3c5 pudge projects@pudge.net