[Blootix]

Originally Posted by AN-net

Ok this update will fix a possible Sql injection problem and all are encouraged to upgrade!!

To fix this flaw without overwriting find this line in journal.php:

PHP Code:

                $DB_site->query("UPDATE ".TABLE_PREFIX."journals 
                SET lastentry='".$lastentry['entrytitle']."', entrycount=entrycount-1, lastentry_date='".$lastentry['entrydate']."', 
                lastentry_id='".$lastentry['entry_id']."' 
                WHERE journal_id='".$j."'
                "); 


replace that with:

PHP Code:

                $DB_site->query("UPDATE ".TABLE_PREFIX."journals 
                SET lastentry='".addslashes($lastentry['entrytitle'])."', entrycount=entrycount-1, lastentry_date='".$lastentry['entrydate']."', 
                lastentry_id='".$lastentry['entry_id']."' 
                WHERE journal_id='".$j."'
                "); 


I will update the zip shortly. I have also attached an updated journal.php

Hey!

Very nice hack. I'm going to sign up at your website just to show support in addtion to posting here.

There is a problem with the installer. It does not add the phrase "can_report_entries". Also, I had to "rebuild" all languages in able to see the phrases used in the ACP. Just to let you know if these hasn't been reported before.