Actions

Difference between revisions of "1.6.4 security alert for layout override files"

From Joomla! Documentation

m
(Add in version)
 
Line 1: Line 1:
 +
{{version|1.6}}
 
In version 1.6.4 a security fix was made to a number of layout files, specifically those for category lists for articles, weblinks, newsfeeds and contacts and the featured contact list.  If you are using layout overrides for these you should ensure that you make the same changes are made in your template (if the same issue is present). Overrides are found in the html folder of your template. You may also wish to check layout files for extensions for the same issue since the core layouts are sometimes used as models.
 
In version 1.6.4 a security fix was made to a number of layout files, specifically those for category lists for articles, weblinks, newsfeeds and contacts and the featured contact list.  If you are using layout overrides for these you should ensure that you make the same changes are made in your template (if the same issue is present). Overrides are found in the html folder of your template. You may also wish to check layout files for extensions for the same issue since the core layouts are sometimes used as models.
  
The change made is to replace JfilterOutput:ampReplace  with htmlspecialchars. The following files should be changed:
+
The change made is to replace JfilterOutput::ampReplace  with htmlspecialchars. The following files should be changed:
  
 
*components/com_contact/views/category/tmpl/default_items.php
 
*components/com_contact/views/category/tmpl/default_items.php

Latest revision as of 13:43, 21 April 2013

In version 1.6.4 a security fix was made to a number of layout files, specifically those for category lists for articles, weblinks, newsfeeds and contacts and the featured contact list. If you are using layout overrides for these you should ensure that you make the same changes are made in your template (if the same issue is present). Overrides are found in the html folder of your template. You may also wish to check layout files for extensions for the same issue since the core layouts are sometimes used as models.

The change made is to replace JfilterOutput::ampReplace with htmlspecialchars. The following files should be changed:

  • components/com_contact/views/category/tmpl/default_items.php
  • components/com_contact/views/featured/tmpl/default_items.php
  • components/com_content/views/category/tmpl/default_articles.php
  • components/com_newsfeeds/views/category/tmpl/default_items.php
  • components/com_weblinks/views/category/tmpl/default_items.php

This change should also be made to the override found in the beez5 template

  • templates/beez5/com_content/category/default_articles.php