DataLife Engine Support » DataLife Engine » Bug Fix

[9.0] Fix double id="dle-ajax-comments" in full news

Author: admin;
Views: 3620;
Comments: 6;
Date: 17 October 2010;

We have one error in DLE 9.0 version.
In fullstory.tpl specify the place to display comments ({comments}). In this case, when viewing the full news will be displayed two tags with identical id="dle-ajax-comments", which can lead to some confusion with the use of JS in the template. Yes, and this affects the validity. If you use the withdrawal comments, indicating their place of output (and only in this case), then you must open engine/classes/comments.class.php and find

Read more to see...

Fix method post name xfieldsform

Author: admin;
Views: 2604;
Comments: 3;
Date: 10 October 2010;

Fix " method="post" name="xfieldsform">

Insufficient filtering of incoming data for DLE 9.0

Author: admin;
Views: 1414;
Comments: 3;
Date: 2 October 2010;

Problem: Lack of filtering incoming data.

Error in: All versions

The degree of danger: High

Insufficient filtering of incoming data for DLE 8.5

Author: admin;
Views: 1794;
Comments: 2;
Date: 9 June 2010;

Problem: User is allowed to upload files to server (no pictures), may go beyond the permitted download folder, and if he has the administrator account, then interrogate the script.

Error in version: All Versions

The degree of danger: Medium (High if the administrator account are online)

Distribution version 8.5 has been updated.

-0
1
2
3
4
5

Fix bug cross-site scripting (XSS) attacks

Author: admin;
Views: 1481;
Comments: 3;
Date: 6 June 2010;

Problem: Under certain conditions, your site can be attacked XSS. Attacker can steal cookies; browser if administrator use outdated browser. So he can access to authorized area.
View more about XSS : http://en.wikipedia.org/wiki/Cross-site_scripting

Affected version: 7.x - 8.5

The degree of danger: Low

Download the patch and copy to your own server patch: dle7_85_path.zip

This patch applies to all versions: 7.x - 8.5