v1.11.42

[ywarnier]

Chamilo 1.11.42 is a security and bugfix release on top of 1.11.40. For any significant change, please check the 1.11.30 release notes. Please read the "Possibly breaking changes" section before upgrading: users whose login or password contains leading/trailing spaces or invisible characters will no longer be able to log in until an administrator updates their account.

---

This discussion was created from the release v1.11.42.

[ywarnier]

Hi all, 1.11.42 is a maintenance release that we put out for security reasons, only for owners of Chamilo 1.11.* platforms.

At least 35 vulnerabilities have been fixed in this version, including 2 critical ones, so please update your Chamilo 1.11 to this version as soon as possible, to avoid safety issues. We will publish the corresponding advisories in about 2 weeks, which will then grant the reporters to publish detailed versions of each vulnerability and how to exploit it, making it much easier for ill-intentioned hackers to use those on your Chamilo portal.

[ywarnier]

An error was introduced in 1.11.42 that makes any user logging in get redirected to a "my_files" directory, showing apparently the first image in your user's directory.

This can be fixed very easily by:

• opening .htaccess
• locating line 89
• removing ,B= ?,BNP from the end of the line.

So this:

RewriteRule ^app/upload/users/([^/]+)/([^/]+)/my_files/(.*)$ main/social/download_my_files.php?user_id=$2&file=$3 "[QSA,L,B= ?,BNP]"

becomes this

RewriteRule ^app/upload/users/([^/]+)/([^/]+)/my_files/(.*)$ main/social/download_my_files.php?user_id=$2&file=$3 "[QSA,L]"

We're looking into what caused this and we're probably going to release a version 1.11.44 soon.
Sorry about the inconvenience.

[ywarnier]

This is not widespread. Some systems work perfectly fine with it, so only apply if you get the redirection issue.

[lauraguirao]

In our case, we identified the issue in a Chamilo installation running PHP 7.4 and Apache 2.4.41.
Simply editing the line was not enough; we had to leave it commented out, because while it worked correctly in Chrome, the redirection persisted in Firefox.

[dauzeine]

The upgrade seems to work well without this change on PHP 8.3.36 and Apache 2.4.58.