TOPIC: Files affected by fixes

Hi Daniel, in continuation with my PM, here are some of the fixes made in version 4.1.7.
If it's possible, I would appreciate if you could please write below each of them
which files exactly were changed (since version 4.1.4) for each of these fixes:

# updated com_content plugin

# fixed wrong SEF urls with sef components

# some fixes for php 5.3 compatability

# Fixed persistent XSS vulnerability

# Fixed reflective XSS vulnerabitlity

# Fixed LFI vulnerability

# Fixed CSRF vulnerability

# Fixed frontend XSS vulnerability

# Fixed backend XSS vulnerabitlity


This way I could compare the changes in the files and verify what I can replace "manually" without affecting my own changes.

Thanks!
Owen

# updated com_content plugin
- when you see something with a plugin, then it can be 99% found in:
administrator/components/com_comment/plugin (search for com_content there)

# fixed wrong SEF urls with sef components
- this is also in the above plugin - the plugins create the links

# some fixes for php 5.3 compatability
- this was something in the backend - a fatal error was shown with 5.3 because we used an outdated version of a function or so. I'm not sure anymore in which file you can find this

# Fixed persistent XSS vulnerability
# Fixed reflective XSS vulnerabitlity
# Fixed frontend XSS vulnerability
- those are all in components/com_comment/classes/joscomment/josc_ubbcode.php

# Fixed backend XSS vulnerabitlity
- I think the fixes were in administrator/components/com_comment/views/comment/tmpl/default.php

# Fixed LFI vulnerability
# Fixed CSRF vulnerability
for those 2 you will have to search a lot.
components/com_comment/comment.php
components/com_comment/classes/joscomment/josc_post.php
components/com_comment/classes/joscomment/josc_visual.php
components/com_comment/classes/joscomment/josc_board.php

In generally about the above 2 fixes - in the past we were using our own method in josc_utils to fetch data send to the server.
Now we use JRequest and we explicitly specify what type the data have to be and where it is coming from GET/POST.
Cheers,
Daniel

Thank you, Daniel. That helped me greatly.
I'm using sh404sef but I'm not sure if I noticed the problem with the SEF URLs.
Can you please give an example how a wrong URL looked before and how it's supposed to look now?

Thanks

the problems was that my sef component was creating duplicate links, because the com_content sef function was adding some query strings to the query and the component was thinking that it is a different url.
Now the only string appended to the url is the anchor with comment and that doesn't trigger a duplicate url.
Cheers,
Daniel