forum.coppermine-gallery.net

No Support => Announcements => Topic started by: Joachim Müller on June 29, 2007, 10:31:23 am

Title: Maintenance release cpg1.4.11 (security issue) - upgrade mandatory
Post by: Joachim Müller on June 29, 2007, 10:31:23 am
Coppermine 1.4.11 - Security release.

The development team is releasing a security update for Coppermine in order to counter a recently discovered mySQL vulnerability that can lead to disclosure of sensitive information. It is important that all users update to this latest version as soon as possible.

To correct the security issue manually, you can apply a fix to include/functions.inc.php. Please note that applying the manual fix will keep you secure, but it is not a substitute for updating your gallery fully, as there are several other non-security related fixes that went into cpg1.4.11 as well.

To manually fix the vulnerability, edit include/functions.inc.php (using a plain-text editor), find
Code: [Select]
           $aid_str = implode(",",array_keys($alb_pw));and replace with
Code: [Select]
          foreach($alb_pw as $aid => $value) {
            $aid_str .= (int)$aid . ",";
          }

          $aid_str = substr($aid_str, 0, -1);

The following issues have been addressed in this release:
To update any version of Coppermine to version 1.4.11, download (http://prdownloads.sourceforge.net/coppermine/cpg1.4.11.zip?download) the latest version from the download page (http://sourceforge.net/project/showfiles.php?group_id=89658) and follow the upgrade steps in the documentation (http://coppermine-gallery.net/demo/cpg14x/docs/index.htm#upgrade).

If you have problems with this update, please use the Update support board (http://forum.coppermine-gallery.net/index.php?board=59.0). Do not post your issues to this announcement thread - they will be deleted without notice.

Joachim Müller (aka GauGau)
- Coppermine project manager -

tranzndance - update 2007-06-29: changed
Code: [Select]
$aid_str = (int)$aid . ","; to
Code: [Select]
$aid_str .= (int)$aid . ",";
Title: Re: Maintenance release cpg1.4.11 (security issue) - upgrade mandatory
Post by: Makc666 on June 29, 2007, 01:10:16 pm
All old versions/archives were packed this way:
Archive name: cpg1.4.8.zip -> Folder name inside: cpg148
Archive name: cpg1.4.9.zip -> Folder name inside: cpg149
Archive name: cpg1.4.10.zip -> Folder name inside: cpg1410

The new one is packed as:
Archive name: cpg1.4.11.zip -> Folder name inside: cpg1.4.11

I accustomed to old folder name inside.
Title: Re: Maintenance release cpg1.4.11 (security issue) - upgrade mandatory
Post by: luchtzak on June 29, 2007, 11:11:52 pm
Thanks for the update!
Title: Re: Maintenance release cpg1.4.11 (security issue) - upgrade mandatory
Post by: Makc666 on June 30, 2007, 11:41:18 pm
tranzndance - update 2007-06-29: changed
Code: [Select]
$aid_str = (int)$aid . ","; to
Code: [Select]
$aid_str .= (int)$aid . ",";
This was a misprint in GauGau's post?
Or there were also an "error" in 1.4.11 archive and it was updated?
Title: Re: Maintenance release cpg1.4.11 (security issue) - upgrade mandatory
Post by: TranzNDance on July 01, 2007, 12:06:08 am
It wasn't a typo on GauGau's part. It was the code at the time that he posted the message. This was discussed in a dev-only thread and the latter one was the correct version, and is also the one in the archive.
Title: Re: Maintenance release cpg1.4.11 (security issue) - upgrade mandatory
Post by: Nibbler on July 01, 2007, 12:22:07 am
The archive contains the incorrect version since it was released prior to the fix being agreed upon by the dev team. If you have multiple password protected albums in your gallery then you need to fix the code in your copy by making the additional code change in TranzNDance's edit, ie.

Code: [Select]
$aid_str = (int)$aid . ","; to
Code: [Select]
$aid_str .= (int)$aid . ",";
Title: Re: Maintenance release cpg1.4.11 (security issue) - upgrade mandatory
Post by: TranzNDance on July 01, 2007, 12:35:24 am
Oh, sorry for the confusion. I did my upgrade through svn so I had the correct version and figured that was in the archive.
Title: Re: Maintenance release cpg1.4.11 (security issue) - upgrade mandatory
Post by: isajade on July 02, 2007, 05:48:20 pm
Does the archive contain the correct version now? Thank you.
Title: Re: Maintenance release cpg1.4.11 (security issue) - upgrade mandatory
Post by: Joachim Müller on July 02, 2007, 05:55:53 pm
No - once a package is released, the files within the archived don't get changed, even if they contain a bug. I'm currently packaging a new version, please stand by. Locking this thread now.