CMS Made Simple Forums

I notice that the 1.2.2 to 1.2.3 diff doesn't include the full TinyMCE upgrade to 2.2.7.

Is it necessary to upgrade TinyMCE as well as CMSMS to avoid the exploit?

Nullig

The exploit was in TinyMCE afaik.

The Blog announcement says that the 1.2.3 upgrade is to fix the sql injection problem, which I believed was in TinyMCE, but the 1.2.2-1.2.3 diff doesn't include the full TinyMCE update. Was it just missed in the diff file?

Nullig

1.2.3 has whatever was in the TinyMCE trunk at the time, with the exploit fixed.  I'm not sure of what upstream version was in there, only that the patch was put out as fast as possible.