Security Updates


Fixing the PDF button in Joomla PDF Print E-mail
Written by Administrator   
Wednesday, 27 August 2008 17:42

An annoying bug with Joomla 1.5 (and I think other versions too), is that the PDF icon presented at the top of articles in your Joomla V1.5 website doesn't work for IE users. I believe this issue mainly effects IE7, however, I also believe IE8 and IE6. This problem doesn't appear in Firefox or Opera browsers (I believe).

 

The fault is that when a visitor to your site, who is using IE7, clicks on the PDF icon at the top of your articles, they are presented with a blank screen that pops up. This popup should contain a PDF version of the article they are looking at.

 

Fortunately Harald Hope, Website: http://TechPatterns.com/ has posted a solution to this problem. Thanks Harald.

 

To read the original document visit the Joomla Documents Site at http://docs.joomla.org/PDF_Display_Fix_in_IE7

 

I have also taken the liberty to post a copy of this original document here. However, we should not take the credit that Harald deserves.

 

PDF Display Fix in IE7

Jump to: navigation, search

This solves the PDF problem in Joomla! 1.5 where any PDF file fails to display correctly in IE7. The usual symptom is that the pop-up window is empty.

There are 2 steps:

  1. Creata a new file called browser_detection.php and upload it to your Joomla! site.
  2. Edit icon.php in 2 places and upload it to your Joomla! site.

STEP 1

Create a php file called browser_detection.php. You can do this in any text editor or Dreamweaver. Copy, paste and save the following in to your new file:

<?php
 
/*
Script Name: Simple 'if' PHP Browser detection
Author: Harald Hope, Website: http://TechPatterns.com/
Script Source URI: http://TechPatterns.com/downloads/php_browser_detection.php
Version 2.0.2
Copyright (C) 29 June 2007
 
Modified 22 April 2008 by Jon Czerwinski
Added IE 7 version detection
 
This program is free software; you can redistribute it and/or modify it under 
the terms of the GNU General Public License as published by the Free Software
Foundation; either version 3 of the License, or (at your option) any later version.
 
This program is distributed in the hope that it will be useful, but WITHOUT 
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
 
Get the full text of the GPL here: http://www.gnu.org/licenses/gpl.txt
 
Coding conventions:
http://cvs.sourceforge.net/viewcvs.py/phpbb/phpBB2/docs/codingstandards.htm?rev=1.3
*/
 
/*
the order is important, because opera must be tested first, and ie4 tested for before ie general
same for konqueror, then safari, then gecko, since safari navigator user agent id's with 'gecko' in string.
note that $dom_browser is set for all  modern dom browsers, this gives you a default to use, unfortunately we
haven't figured out a way to do this with actual method testing, which would be much better and reliable.
 
Please note: you have to call the function in order to get access to the variables, you call it by this:
 
browser_detection('browser');
 
then put you code that you want to use the variables with after that.
 
*/
 
function browser_detection( $which_test ) {
 
	// initialize the variables
	$browser = '';
	$dom_browser = '';
 
	// set to lower case to avoid errors, check to see if http_user_agent is set
	$navigator_user_agent = ( isset( $_SERVER['HTTP_USER_AGENT'] ) ) ? strtolower( $_SERVER['HTTP_USER_AGENT'] ) : '';
 
	// run through the main browser possibilities, assign them to the main $browser variable
	if (stristr($navigator_user_agent, "opera")) 
	{
		$browser = 'opera';
		$dom_browser = true;
	}
 
/*
Test for IE 7 added
April 22, 2008
Jon Czerwinski
*/
	elseif (stristr($navigator_user_agent, "msie 7")) 
	{
		$browser = 'msie7'; 
		$dom_browser = false;
	}
 
	elseif (stristr($navigator_user_agent, "msie 4")) 
	{
		$browser = 'msie4'; 
		$dom_browser = false;
	}
 
	elseif (stristr($navigator_user_agent, "msie")) 
	{
		$browser = 'msie'; 
		$dom_browser = true;
	}
 
	elseif ((stristr($navigator_user_agent, "konqueror")) || (stristr($navigator_user_agent, "safari"))) 
	{
		$browser = 'safari'; 
		$dom_browser = true;
	}
 
	elseif (stristr($navigator_user_agent, "gecko")) 
	{
		$browser = 'mozilla';
		$dom_browser = true;
	}
 
	elseif (stristr($navigator_user_agent, "mozilla/4")) 
	{
		$browser = 'ns4';
		$dom_browser = false;
	}
 
	else 
	{
		$dom_browser = false;
		$browser = false;
	}
 
	// return the test result you want
	if ( $which_test == 'browser' )
	{
		return $browser;
	}
	elseif ( $which_test == 'dom' )
	{
		return $dom_browser;
		//  note: $dom_browser is a boolean value, true/false, so you can just test if
		// it's true or not.
	}
}
 
/*
you would call it like this:
 
$user_browser = browser_detection('browser');
 
if ( $user_browser == 'opera' )
{
	do something;
}
 
or like this:
 
if ( browser_detection('dom') )
{
	execute the code for dom browsers
}
else
{
	execute the code for non DOM browsers
}
 
and so on.......
 
 
*/
?>


Upload browser_detection.php to the folder libraries/joomla/utilities/ on your site.


STEP 2

  • Find the file icon.php in the folder components/com_content/helpers/. Note: Make a copy of this file so you can restore it if needed.
  • Under the <?php tag on line 1 create a space and copy and paste this code:
require_once("libraries/joomla/utilities/browser_detection.php");

 

  • Replace this line of code on line 58
$attribs['onclick'] = "window.open(this.href,'win2','".$status."'); return false;";
with the following code:
$user_browser = browser_detection('browser');
          if ($user_browser == 'msie7') {
             $attribs['target'] = '_blank';
          } else {                     
             $attribs['onclick'] =
    "window.open(this.href,'win2','".$status."'); return
    false;";
          }
Save and upload the file to components/com_content/helpers/.

Note: Your browser's cache may need to be cleaned before you can see the PDF working.

Last Updated ( Wednesday, 27 August 2008 19:52 )
 
Joomla V1.5.5 Security Update PDF Print E-mail
Written by Administrator   
Friday, 15 August 2008 00:06

[20080801] - Core - Password Remind Functionality

 

Project: Joomla!
SubProject: com_user
Severity: Critical
Versions: 1.5.5 and all previous 1.5 releases
Exploit type: Password Reset Forgery
Reported Date: 2008-August-12
Fixed Date: 2008-August-12

 

Description A flaw in the reset token validation mechanism allows for non-validating tokens to be forged. This will allow an unauthenticated, unauthorized user to reset the password of the first enabled user (lowest id). Typically, this is an administrator user. Note, that changing the first users username may lessen the impact of this exploit (since the person who changed the password does not know the login associated with the new password). However, the only way to completely rectify the issue is to upgrade to 1.5.6 (or patch the /components/com_user/models/reset.php file).

 

Affected Installs All 1.5.x installs prior to and including 1.5.5 are affected.

 

Solution Upgrade to latest Joomla! version (1.5.6 or newer), or patch /components/com_user/models/reset.php with the code below:

 

After global $mainframe; on line 113 of reset.php, add:

 

if(strlen($token) != 32) {
$this->setError(JText::_('INVALID_TOKEN'));
return false;
}

 

For More Information, Visit Joomla's site at http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html

 

Last Updated ( Friday, 15 August 2008 00:15 )
 


Banner

PowerHost provides reliable Australian Website Hosting. They offer shared Linux and Windows Hosting, as well a Domain Name registration and SSL certificates.

Fault Ticket System

To lodge a Fault Ticket, you must first be registered and logged into this site. Then, you will see an Option in the Help Menu Above, or Click Here