Open search
Chris
Offline
Post Count: 112
6 Oct 2017 11:26
Hi Kcpau, thanks for reporting these problems!
We've issued a patch release that includes fixes for all of this. As it's a security vulnerability, we've also gone back and issued patches for older versions.
You can find a patch for the version you're using on GitHub here: github.com/TribalSystems/Zenario/releases/tag/7.1.6
You must confirm your screen name on your profile in order to comment.
Please Login if you wish to add a comment.
I recently had a couple of crashes because the user enters a document name (and later on an extract) with a single quote. On my version the first one seems to because of validateAdminBox.php not running sqlEscape before putting the filename in the SQL statement. This appears to have been fixed in 7.7. The second one is the same issue with filename and extract in upload_replacement_doc.php. This was not fixed in 7.7 (lines 133 and 112). I do not know whether there are other places with similar problems. May I suggest you add those in a future release.
Thank you.