Phorum 3.2.10 Released / Further Security Issues

Phorum 3.2.10 Released / Further Security Issues Joao Gouveia has brought to our attention another security issue that can allow the Phorum Master Password to be changed for installations that do not take the recommended step of adding server-level password protection to their admin area. When combined with another exploit, this can be used to execute arbitrary code on the server under the userid Phorum is running as. Apart from the security issue, this release fixes some outstanding bugs: - Fix problem some users were having getting into the admin area in 3.2.9 - Fix bug that caused the value of thread not to be set correctly in the _bodies table for users running MySQL - Added config_suffix to the upgrade scripts for users of extremely early versions in the 3.1 tree Unified diffs are available for upgrade to 3.2.10 from the following points: - Phorum 3.2.6: http://phorum.org/downloads/diffs/phorum-3_2_6-3_2_10.diff - Phorum 3.2.7: http://phorum.org/downloads/diffs/phorum-3_2_7-3_2_10.diff - Phorum 3.2.8: http://phorum.org/downloads/diffs/phorum-3_2_8-3_2_10.diff - Phorum 3.2.9: http://phorum.org/downloads/diffs/phorum-3_2_9-3_2_10.diff - Phorum 3.2.10 Pre-Release: http://phorum.org/downloads/diffs/phorum-3_2_10pr-3_2_10.diff Make sure that you add any new files that have been added since your version. For earlier versions there are necessary table changes, so you will need to download the entire package and perform an upgrade. A history of recent changes can be found in the Change Log (http://phorum.org/changelog.txt). Jason Birch ------------------------------------------------------------------------- Phorum Dev Team - http://phorum.org/ Making better forums with PHP -------------------------------------------------------------------------