mahara-packaging team mailing list archive

[François Marier <francois@xxxxxxxxxx>]

Artur, sorry about that.

The package to sync from sid to natty is mahara 1.2.7-1:

mahara (1.2.7-1) unstable; urgency=high

  * New upstream security release:
    - CVE-2011-0439 (XSS in select boxes)
    - CVE-2011-0440 (CSRF when deleting blogs)

  * Add Italian debconf translation (closes: #606378)
  * Add Danish debconf translation (closes: #597766)
  * Bump debhelper compatibility to 8


** CVE added: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2011-0439

-- 
You received this bug notification because you are a member of Mahara
Packaging, which is subscribed to mahara in Ubuntu.
https://bugs.launchpad.net/bugs/676336

Title:
  Blogs get deleted without sesskey check

Status in Mahara ePortfolio:
  Fix Released
Status in Mahara 1.3 series:
  Fix Released
Status in “mahara” package in Ubuntu:
  New
Status in “mahara” source package in Lucid:
  New
Status in “mahara” source package in Maverick:
  New
Status in “mahara” source package in Natty:
  New

Bug description:
  Permissions are checked but the sesskey is neither passed nor checked
  e.g. artefact/blog/index.php?delete=123