Mosets Tree 2.1.6 update available with a security fix

[dknight]

It has come to my attention that Mosets Tree 2.1.5 and below contains a security vulnerability affecting the attachment and image upload feature that allows users to upload and execute arbitrary codes on your website. This affects all Mosets Tree 2.1.x installation that accepts front-end attachments or images submission.

This release addresses the security vulnerability and fixes all bugs that have been reported since 2.1.5's release. Changes:

• Fixed bug in certain custom field when values contains double quote.
• mod_mt_search: Added parent_cat_id to searchword's input field to enable the ability to have 2 or more search modules appearing on the same page.
• Fixed a variable typo that causes no e-mail to be sent to public listing owners when their listings are approved.
• Fixed bug where Add category form is accessible even when disabled.
• Fixed an image upload vulnerability by accepting images with file extension ending with gif, png, jpg or jpeg only. (Reported by Jeff Channell)
• Added a new internal config (banned_attachment_filetypes) to prevent PHP file from being uploaded as attachment.

All users that are running Mosets Tree 2.1 series are advised to upgrade to 2.1.6 immediately.

Downloading the upgrade

The upgrade is available at your account by logging in to http://www.mosets.com/login/ and clicking at Mosets Tree subscription number. Full install and upgrade instructions are also available there.

[dknight]

If you are still running Mosets Tree version 2.0.x, follow these instructions to patch this vulnerability.

FILE: /components/com_mtree/mtree.php

Find these codes near line 3484:

PHP Code:

                        $file_extension = pathinfo($original_image->filename);
                        $file_extension = strtolower($file_extension['extension']); 


and replace with the following:

PHP Code:

                        $file_extension = pathinfo($original_image->filename);
                        $file_extension = strtolower($file_extension['extension']);

                        if( !in_array($file_extension,array('png','gif','jpg','jpeg')) ) {
                            continue;
                        }