<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi everybody,<br>
be aware that with this security patch you override some modifications
made to root files. I just experienced an error after applying the sec
patch with the only plugin that i have installed, the vical1.1 plugin. <br>
So i don´t know if this is an issue with other plugins.<br>
The export .ics file gets printed out within the browser instead of
being putted out as a downloadable vtiger-calendar.zip<br>
Doing a diff between the involved files showed me that these changes
have to be made if you already have the vical plugin installed andf
then apply the sceurity patch.<br>
The changes have to be made to 1 file out of those who come with
vical1.1.zip:<br>
<br>
-----------------------------------------<br>
in index.php (vTiger 5.04 + vical, no sec patch) these lines are not
there anymore in the new index.php after applying the security patch so
these code changes have to be made manually:<br>
<br>
304 + ereg("^iCalExport",$action) ||<br>
331 + ereg("^iCalExport",$action) ||<br>
338 - if(ereg("^downloadfile", $action) ||
ereg("^fieldtypes",$action) || ereg("^mailmergedownloadfile",$action)||
ereg("^get_img",$action))<br>
338 + if(ereg("^iCalExport", $action) || ereg("^downloadfile",
$action) || ereg("^fieldtypes",$action) ||
ereg("^mailmergedownloadfile",$action)|| ereg("^get_img",$action))<br>
<br>
----------------------------------------<br>
<br>
I guess this procedure has to be done with every single plugin that was
added BEFORE the security patch?<br>
<br>
Is there something like a "general" way to apply vTiger ROOT patches
(like this one) without destroying the plugin modifications or is the
only way to apply the patch to do the manual changes on every single
file that was realesed with the sec patch?<br>
<br>
Best Regards<br>
Torsten Zenk<br>
<br>
<br>
<br>
Prasad schrieb:
<blockquote
cite="mid:39d18b250811130738oc01332ei6b33c4ff8d77a5aa@mail.gmail.com"
type="cite">
<pre wrap="">Dear vtigers,
We have released a security patch for 5.0.4 that fixes the following
security issues along with some critical bugs reported by the community.
More details can be found in the release notes [VtigerCRM 5.0.4
SecurityPatch_ReleaseNotes<a class="moz-txt-link-rfc2396E" href="http://www.vtiger.com/products/crm/vtigercrm-504-Security-Patch-Release-Notes.pdf"><http://www.vtiger.com/products/crm/vtigercrm-504-Security-Patch-Release-Notes.pdf></a>
].
Security Issues:-
1. Local File Disclosure
2. Cross-Site Scripting
3. SQL injection Vulnerability
4. Arbitrary File Upload
Trac Tickets:-
#5235 <a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5235"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5235></a>: Patch Apply:
Timeout settings need change
#5255 <a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5255"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5255></a>: Cannot import
more than 500 records
#5307: <a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5307"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5307></a> Campaign
Related info getting lost
#5298 <a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5298"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5298></a>: File attachment
download gets corrupted
#5294 <a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5294"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5294></a>: Organization
image upload issue
# <a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5231"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5231></a>5231<a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5231"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5231></a>:
Webmail qualify issue
# <a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5268"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5268></a>5268<a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5268"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5268></a>:
Homepage dashboard link showing incorrect data in list view
#4847 <a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/4847"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/4847></a>: Problem in
selecting users/groups/profiles from the roles and groups edit view
#5393 <a class="moz-txt-link-rfc2396E" href="http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5393"><http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/5393></a>: Not able to
delete default profiles/roles/users
We thank vtiger community for their support to detect the issues and help us
resolve it. Special thanks to Mark Piper, Fabian Fingerele, and Different
Solutions.
*Patch Download:*
The 5.0.4 Security patch download is available here: [
VtigerCRM5.0.4_SecurityPatch<a class="moz-txt-link-rfc2396E" href="http://downloads.sourceforge.net/vtigercrm/VtigerCRM504_Security_Patch.zip"><http://downloads.sourceforge.net/vtigercrm/VtigerCRM504_Security_Patch.zip></a>
]
*NOTE:* You will need to unpack the zip into your vtiger CRM folder. We
recommend you to take a backup of your directory first before you unpack the
patch.
Regards,
Prasad
vtiger Team
</pre>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
Reach hundreds of potential candidates - <a class="moz-txt-link-freetext" href="http://jobs.vtiger.com">http://jobs.vtiger.com</a> </pre>
</blockquote>
</body>
</html>