I notice that the 1.2.2 to 1.2.3 diff doesn't include the full TinyMCE upgrade to 2.2.7.
Is it necessary to upgrade TinyMCE as well as CMSMS to avoid the exploit?
Nullig
CMSMS 1.2.3 Upgrade and TinyMCE
-
calguy1000
- Support Guru
- Posts: 8169
- Joined: Tue Oct 19, 2004 6:44 pm
Re: CMSMS 1.2.3 Upgrade and TinyMCE
The exploit was in TinyMCE afaik.
Follow me on twitter
Please post system information from "Extensions >> System Information" (there is a bbcode option) on all posts asking for assistance.
--------------------
If you can't bother explaining your problem well, you shouldn't expect much in the way of assistance.
Please post system information from "Extensions >> System Information" (there is a bbcode option) on all posts asking for assistance.
--------------------
If you can't bother explaining your problem well, you shouldn't expect much in the way of assistance.
Re: CMSMS 1.2.3 Upgrade and TinyMCE
The Blog announcement says that the 1.2.3 upgrade is to fix the sql injection problem, which I believed was in TinyMCE, but the 1.2.2-1.2.3 diff doesn't include the full TinyMCE update. Was it just missed in the diff file?
Nullig
Nullig
Re: CMSMS 1.2.3 Upgrade and TinyMCE
1.2.3 has whatever was in the TinyMCE trunk at the time, with the exploit fixed. I'm not sure of what upstream version was in there, only that the patch was put out as fast as possible.
