Nucleus CMS is een content management systeem wat draait op een omgeving met PHP 4+ en MySQL 3.23.x+. Met dit pakket van scripts kan je op een eenvoudige manier weblogs of journals bijhouden. Het ontwikkelteam heeft sinds kort versie 3.1 uitgebracht waarin een beveilingslek wordt gedicht. De release notes en het changelog zien er als volgt uit:
In response to a reported SQL Injection Vulnerability in Nucleus, we've made Nucleus v3.1 available for download. Next to the fixed vulnerability, some minor fixes to v3.0 and performance enhancements are included.
Changelog:[break]Wie benieuwd is naar het uiterlijk van dit pakket kan hier een aantal screenshots bekijken.
- FIXED: Nucleus v3.01 was missing a fix in backup.php, which could cause fulltext key info not to be backed up correctly
- ADDED: support for patch levels, so plugin API enhancements can be distributed to power users earlier (suggested by TeRanEX)
- FIXED: bug 974090, multiple identical SQL queries were executed when checking if a plugin is available (karma)
- FIXED: Default language wasn't always respected (fushimi)
- CHANGED: new bookmarklet style (TeRanEx / moraes)
- FIXED: After a karma vote, redirection to referer URL failed if register_globals is turned off (karma)
- FIXED: SQL Injection Vulnerability, reported by aCiDBiTS
- FIXED: bug 689468, moved PostAddComment from action.php to COMMENTS.php(admun)
- FIXED: bug 967580, Class variables were not explicitly defined in PHP classes (karma)
- FIXED: IE6 unreadable Admin menu textarea (admun)
- FIXED: Skin exports for skins containing CDATA sections (like the RSS feeds) caused the skinbackup.xml to contain invalid XML. (Import still worked, however) (karma)
- FIXED: German language file wrong translation (admun)
- CHANGED: replaced split by preg_split in the parser class. Should be faster according to PHP docs (karma)
- FIXED: documentation typo (admun)
- FIXED: PHP5: Install script failed to discover install path automatically (karma)
- FIXED: Skin parser no longer parses skinvars when they are inside a non-displayed if-section (karma)
- FIXED: bug 817361, prefix http:// to member's URL if missing (admun)
