Alkacon Software launches OpenCms 7.5.4

Version 7.5.4 of OpenCms is now ready and available for download.

Alkacon and OpenCms logo

OpenCms is one of the most popular Open Source Content Management Solutions.

This new version was developed by Alkacon Software GmbH with the support of the international OpenCms developer community.

OpenCms 7.5.4 is a maintenance release that fixes a number of issues that persisted in the 7.5.3 version. Some new features have been added as well.

Main fixed issues and improvements in OpenCms 7.5.4

  • Fixed issue 1717: DB deadlock if OpenCms hits db.pool.default.maxActive when db.pool.default.whenExhaustedAction=block
  • Fixed issue 1900: Performance Patch for OpenCms
  • Fixed issue 1901: Workplace login page security issue
  • Fixed issue 1909: Internet Explorer crashes after saving structured XML content with image added from gallery into HTML field
  • Fixed issue 1942: Publish scheduled jobs are missing after server restart
  • Fixed issue 1945: Avoid reflected XSS on some authenticated resources (provided by Michele Orru)
  • Fixed issue 1949: Database size does not decrease after (completely) deleting resources
  • Fixed issue when creating a new user or editing an existing user using an Oracle database
  • Fixed issue using delete and lock resource when called without path parameter
  • Fixed issue in galleries: Broken layout with long item file names or titles
  • Fixed premature publish thread interruption within CmsShell
  • FCKEditor compatible with Internet Explorer 9 and Firefox 4
  • Added new optional CmsShell start parameter to load additional commands

 Please check out the release notes for further details of the changes in this release.

Patch for SMF 1.1 is out

Bryan's picture
Submitted by Bryan on

As I mentioned on my forum, a patch for the forum web application, SMF, has been released. Earlier this month, we talked about SMF 1.1 Final being out and how easy it is to upgrade SMF. Installing the patch was even easier with not only SMF's ability to install the package easily but can also the ability to self-download the patches as well through the browser. No FTP or Linux shell required! Something I would like to see in all my favorite content management systems.

The SMF 1.1.1 patch is mostly a bug fixer, but there is a security improvement for a cross-scripting vulnerability found for Internet Explorer users. The changes from SMF 1.1 to 1.1.1 include:

  • Fixed potential XSS vulnerability for users of Internet Explorer.
  • Changed the way SMF logs IP addresses to make it harder for someone to bypass banning.
  • Fixed bug in BBC parsing that could cause an error for people with special characters in their username on certain versions of PHP.
  • Fixed apostrophes in smiley location path causing a database error.
  • Fixed usage of an array before it was declared causing issues for bridges.
  • Fixed Personal Message labels not being properly restricted to the current member.
  • Fixed search sometimes returning no results when it should have done.
  • The sticky checkbox in prune boards would alternate when it shouldn't have done.
  • Send announcements out in slightly smaller chunks.

The complete announcement for the for SMF patch can be found at the Simple Machines forum. The announcement also contains a tarred and gzipped patch for those that need or prefer to upgrade the "old fashion" way.

s9y.org: Serendipity 1.0.2 and 1.1-beta5 released

Bryan's picture
Submitted by Bryan on

The folks at Serendipity have released version 1.0.2 to address cross-site scripting (XSS) vulnerabilities "on the admin backend which could happen if registered authors can be tricked into following a specially crafted URL." The 1.1 Beta 5 also contains this fix along with the following new changes since Beta 1:

  1. Themes can now support custom amounts and positions of any number of sidebars (top, bottom, left, right etc.) (more)
  2. Usergroups can now configure which plugins/events a group is allowed to execute (more)
  3. Added the options to use HTTP-Authentication for your login, which enables you to use secured RSS-Feeds with login credentials
  4. Some permalinks oddities when using % in URLs and some other minor fixes.

You can read more details about this release at Serendipity.