JoomCCK 6.4.2

Security update, everyone using JoomCCK should update to the latest version.

Download Extended Version:

https://www.joomcoder.com/joomla-extensions/9-components/24-joomcck

Changes in Free version

• Security - Fixed a critical unauthenticated remote code execution in the front-end template.save task: the target path, file extension and file content were taken straight from the request with no login, CSRF token or file-type check, letting an anonymous attacker write an executable
  .php file into a web-served directory. The task now requires a Super User plus a CSRF token, restricts the extension to php/xml/css/js, and confines the write to the template directory
• Security - The generic field dispatchers (field.call, ajax.field_call, and the elements field layout) let an anonymous request invoke any method of any field class; the record save/delete lifecycle hooks are now blocked from these public entry points (via a new
  CFormField::isDispatchable() policy), closing a second unauthenticated file-write and an arbitrary file-delete path
• Security - The image field now validates the upload extension against the field's allowed image formats before writing, and its delete action is confined to the upload directory (no path traversal)
• Security - templates.save and the template install/copy/rename/uninstall actions now require a Super User plus a CSRF token, with path and parameter validation
• Security - records.delete (which unlinks the record's uploaded files) and pack.build now enforce a CSRF token and authorization checks
• Security - Template and config output directories ship .htaccess / web.config rules that block direct execution of any file placed there

Changes in Extended version

• Security - The same field-dispatcher hardening protects all extended (Pro) field types; the signature field's file cleanup is now confined to its own directory, preventing arbitrary file deletion

---

Reported by EQSTLab via coordinated disclosure (GitHub Security Advisory GHSA-whf2-8p4w-v6xv).