diff -aruN --binary joomla.1.5.23//administrator/includes/framework.php joomla.1.5.24//administrator/includes/framework.php
--- joomla.1.5.23//administrator/includes/framework.php 2011-04-05 00:01:17.000000000 +0200
+++ joomla.1.5.24//administrator/includes/framework.php 2011-10-16 17:50:00.000000000 +0200
@@ -1,6 +1,6 @@
Removed
! -> Note
+-------------------- 1.5.24 Stable Release [17-October-2011] ------------------
+
+30-Sept-2011 Jean-Marie Simonet
+ +$ Adding ka-GE installation language
+
+19-Apri-2011 Andrew Eddie
+ # Fixed [#21622] 303 redirections cause page subresources to be reloaded on WebKit browsers (Nicholas Dionysopoulos).
+
-------------------- 1.5.23 Stable Release [04-March-2011] ------------------
04-Apr-2011 Mark Dexter
@@ -48,7 +56,7 @@
# [#23746] Add a system plugin event called onBeforeCompileHead
# [#25090] Improve .htaccess rewrite efficency
# [#21676] Article Manager - Select Author
- # [#20423] Warning: realpath() [function.realpath]: Unable to access .../path.php
+ # [#20423] Warning: realpath() [function.realpath]: Unable to access .../path.php
# [#16605] PHP notice when selecting a menu type
# [#20536] Category Blog Layout - View Article - Editing Article - Click Images - 500 Layout "blog" not found
@@ -70,7 +78,7 @@
02-Nov-2010 Jean-Marie Simonet
^ [#22961] Installation language modifications: aa-AA et-EE
^ [#23098] Credits.php update
-
+
20-Oct-2010 Ian MacLennan
# [#21489] CHANGELOG.php - segment twice exists
# [#21769] toolbar.content.html.php allow direct access
@@ -92,7 +100,7 @@
14-July-2010 Ian MacLennan
+ [#21404] New installation language bs-BA
- + [#20984] New installation language ta-IN
+ + [#20984] New installation language ta-IN
14-July-2010 Louis Landry
+ [#21416] Mootools 1.2.4 Upgrade Plugin
diff -aruN --binary joomla.1.5.23//CREDITS.php joomla.1.5.24//CREDITS.php
--- joomla.1.5.23//CREDITS.php 2011-01-25 18:42:22.000000000 +0100
+++ joomla.1.5.24//CREDITS.php 2011-09-30 07:59:51.000000000 +0200
@@ -1,6 +1,6 @@
toString(Array('scheme', 'user', 'pass', 'host', 'port'));
- if($url[0] == '/') {
+
+ if ($url[0] == '/') {
// we just need the prefix since we have a path relative to the root
$url = $prefix . $url;
- } else {
+ }
+ else {
// its relative to where we are now, so lets add that
$parts = explode('/', $uri->toString(Array('path')));
array_pop($parts);
@@ -307,8 +309,7 @@
}
// Persist messages if they exist
- if (count($this->_messageQueue))
- {
+ if (count($this->_messageQueue)) {
$session =& JFactory::getSession();
$session->set('application.queue', $this->_messageQueue);
}
@@ -317,10 +318,19 @@
// so we will output a javascript redirect statement.
if (headers_sent()) {
echo "\n";
- } else {
- header($moved ? 'HTTP/1.1 301 Moved Permanently' : 'HTTP/1.1 303 See other');
- header('Location: '.$url);
}
+ else {
+ if (!$moved && strstr(strtolower($_SERVER['HTTP_USER_AGENT']), 'webkit') !== false) {
+ // WebKit browser - Do not use 303, as it causes subresources reload (https://bugs.webkit.org/show_bug.cgi?id=38690)
+ echo '';
+ }
+ else {
+ // All other browsers, use the more efficient HTTP header method
+ header($moved ? 'HTTP/1.1 301 Moved Permanently' : 'HTTP/1.1 303 See other');
+ header('Location: '.$url);
+ }
+ }
+
$this->close();
}
@@ -534,7 +544,7 @@
// we fork the session to prevent session fixation issues
$session->fork();
$this->_createSession($session->getId());
-
+
// Import the user plugin group
JPluginHelper::importPlugin('user');
@@ -557,13 +567,16 @@
jimport('joomla.utilities.simplecrypt');
jimport('joomla.utilities.utility');
- //Create the encryption key, apply extra hardening using the user agent string
- $key = JUtility::getHash(@$_SERVER['HTTP_USER_AGENT']);
-
- $crypt = new JSimpleCrypt($key);
- $rcookie = $crypt->encrypt(serialize($credentials));
- $lifetime = time() + 365*24*60*60;
- setcookie( JUtility::getHash('JLOGIN_REMEMBER'), $rcookie, $lifetime, '/' );
+ // Create the encryption key, apply extra hardening using the user agent string
+ $agent = @$_SERVER['HTTP_USER_AGENT'];
+ // Ignore empty and crackish user agents
+ if ($agent != '' && $agent != 'JLOGIN_REMEMBER') {
+ $key = JUtility::getHash($agent);
+ $crypt = new JSimpleCrypt($key);
+ $rcookie = $crypt->encrypt(serialize($credentials));
+ $lifetime = time() + 365*24*60*60;
+ setcookie(JUtility::getHash('JLOGIN_REMEMBER'), $rcookie, $lifetime, '/');
+ }
}
return true;
}
diff -aruN --binary joomla.1.5.23//libraries/joomla/version.php joomla.1.5.24//libraries/joomla/version.php
--- joomla.1.5.23//libraries/joomla/version.php 2011-04-05 00:01:17.000000000 +0200
+++ joomla.1.5.24//libraries/joomla/version.php 2011-10-16 17:50:00.000000000 +0200
@@ -1,6 +1,6 @@
decrypt($str);
+ $crypt = new JSimpleCrypt($key);
+ $str = $crypt->decrypt($str);
+ $cookieData = @unserialize($str);
+ // Deserialized cookie could be any object structure, so make sure the
+ // credentials are well structured and only have user and password.
+ $credentials = array();
+ if (!is_array($credentials)) {
+ return;
+ }
+ if (!isset($cookieData['username']) || !is_string($cookieData['username'])) {
+ return;
+ }
+ $credentials['username'] = JFilterInput::clean($cookieData['username'], 'username');
+ if (!isset($cookieData['password']) || !is_string($cookieData['password'])) {
+ return;
+ }
+ $credentials['password'] = JFilterInput::clean($cookieData['password'], 'string');
- $options = array();
- $options['silent'] = true;
- if (!$mainframe->login(@unserialize($str), $options)) {
+ if (!$mainframe->login($credentials, array('silent' => true))) {
// Clear the remember me cookie
setcookie( JUtility::getHash('JLOGIN_REMEMBER'), false, time() - 86400, '/' );
}