#821 - Hack-attack error if privileged Comcode already in system

Identifier #821
Issue type Minor issue (breaks specific functionality)
Title Hack-attack error if privileged Comcode already in system
Status Completed
Handling member Chris Graham
Version 8.1.4
Addon General / Uncategorised
Description A hack-attack error can be generated if privileged Comcode has been added within content (Javascript or "data:" URLs) but privileges have since been lost by the original submitter.

Hack-attacks should only be shown to the originator of the content, when it is getting added (or a close approximation to that situation). In other situations a filter should occur.
Steps to reproduce

Funded? No
Hotfixes

hotfix-821, 2012-09-12 12pm.tar

Only apply these hotfixes if you absolutely need them and cannot wait until the next release of Composr (releases are more reliable and strictly tested). We provide no guarantee that hotfixes will work; they may even break your site especially if a hotfix depends on another hotfix. Always make a site backup if you attempt to apply a hotfix.

As of Composr version 11, the recommended way to apply a hotfix is by following the same steps as an upgrade:

  1. Download the hotfix into the data_custom folder of your Composr installation directory
  2. Back up your site
  3. Go to yourbaseurl/upgrader.php
  4. When you get to the 'Transfer across new/updated files' step, use the hotfix that you downloaded.
  5. The upgrader will automatically apply hotfix files, skipping any files belonging to addons that you do not have installed, and also skipping hotfix files that are older than the files on disk
  6. Run a database upgrade if prompted
  7. You may wish to run a file integrity scan and resolve issues.

For Composr version 10, manually extract the files (e.g., using 7-Zip) and overwrite files in your Composr installation that are older than the ones in the hotfix (check the file modification date/time). Skip hotfix files that do not exist in your installation.

Commits

f0b75b4

The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".

Rating

Unrated