Posted by: Joe Brinkman
6/17/2010 10:37 AM 

I am pleased to announce the release of DotNetNuke 5.4.3.  This month’s maintenance release focused on resolving major issues with page management and with the Telerik HTML Editor Provider.  The page management fixes should resolve all major outstanding issues in this area.  The HTML Editor Provider fixes addressed some of the larger issues with the provider, although we recognize there are still several fixes and enhancements that remain for this particular item which we hope to address in the upcoming 5.5 release.  The 5.4.3 release also includes a number of security fixes.  As always our community continues to work with the security team to identify potential security issues and to help test the subsequent security fixes. As an Open Source project, the DotNetNuke platform and the community benefit tremendously from this collaborative relationship that allows us to discover security issue in a timely manner and quickly work to resolve them.  Finally, I want to thank those community members who provided bug fixes for this months release.  Their efforts help to create a better product for all of us.  Below are the highlights from this months release.  As usual, you can see a full list of changes in the changelog.

Major Highlights

• Fixed issue where page level and TabPath were not properly updated for descendents
• Implemented LinkClick functionality in Telerik editor.
• Fixed issue with displaying a module on all pages.
• Fixed issue with page management not working correctly.
• Fixed issue where messaging was using incorrect logic to notify users.
• Fixed issue with PurgeExpiredItems when the portal's home folder may not have been mapped correctly.
• Fixed issue when hitting Enter while in the Tag edit text box.
• Fixed issue where bulk updates did not properly repair existing modules.
• Fixed a bunch of minor HTML formatting issues.
• Fixed issue with sending Event Viewer exception messages when using Secure SMTP.
• Fixed issue with module caching being ignored for non-browser user agents.
• Improved performance by only loading HTML Module menu when user is allowed to see it.
• Fixed issue where the DNNCountryEditControl does not return a value in the PropertyEditor
• Fixed issue with using external URL Rewriters causing error in initWidgets.js
• Fixed the issue with the ToolsFile property of the Telerik Editor to set the appropriate property on the underlying RadEditor.
• protection was added to ensure that a hacker who had a valid login to a site could not use viewstate details to perform a cross-site request forgery to public functions.
• alter log files extension so their existance or contents cannot be useful to potential hackers
• an additional filter was added to the existing core blacklist filter to catch an invalid tag that could lead to a cross-site scripting issue
• at present profile properties automatically strip dangerous XSS characters from data. In addition they support regular expressions to allow sites to configure the allowable characters. We've added an additonal html encoding to ensure dangerous html cannot be passed
• due to a logical error in the profile property provider, it's possible for member only profile properties to be displayed to non-members. Code was added to protect against misconfiguration revealing sensitive data.
• added additional encoding to sitelog to follow security best practices.
• Improved security by HTML Encoding taxonomy tags.

Security Fixes

• Logfiles contents after exception may lead to information leakage (Bulletin 37)
• Cross-site request forgery possible against other users of a site (Bulletin 38)
• Update inputfilter for invalid tag that could allow XSS attack (Bulletin 39)
• Mail function can result in unauthorized email access (Bulletin 40)
• Fix issue where member only profile properties could be exposed publically under certain conditions (Bulletin 41)
• Profile properties not htmlencoding data (Bulletin 42)

Updated Modules/Providers

The following modules and providers have been updated in the 5.4.3 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• none

Providers

• none

Trackback Print

Tags: DotNetNuke , Release

Categories: DotNetNuke Corporation

Location: Blogs Joe Brinkman