[AN-net]

Ok this update will fix a possible Sql injection problem and all are encouraged to upgrade!!

To fix this flaw without overwriting find this line in journal.php:

PHP Code:

                $DB_site->query("UPDATE ".TABLE_PREFIX."journals 
                SET lastentry='".$lastentry['entrytitle']."', entrycount=entrycount-1, lastentry_date='".$lastentry['entrydate']."', 
                lastentry_id='".$lastentry['entry_id']."' 
                WHERE journal_id='".$j."'
                "); 


replace that with:

PHP Code:

                $DB_site->query("UPDATE ".TABLE_PREFIX."journals 
                SET lastentry='".addslashes($lastentry['entrytitle'])."', entrycount=entrycount-1, lastentry_date='".$lastentry['entrydate']."', 
                lastentry_id='".$lastentry['entry_id']."' 
                WHERE journal_id='".$j."'
                "); 


I will update the zip shortly. I have also attached an updated journal.php