Tag: security
Siteframe 3.2.3
This is a maintenance release of Siteframe 3.2. It includes security features such as a CAPTCHA function to prevent automated spammers from registering on the site.
Enabling the CAPTCHA
From the Control Panel > Extended Properties page, enter a word or phrase (a relatively simple word is recommended) for the REGISTER_CAPTCHA setting. This word is displayed on the registration page in...
0 comment(s)
/ glen
/ Downloads
/ on December 9, 2006 at 14:39
XSS Vulnerability in Siteframe 5.0.1
In search.php, an unmodified $_GET variable is assigned to a Smarty variable, where it can be displayed on a page. A malicious intruder could insert evil Javascript into the query string and execute it from the page.
IMMEDIATE FIX
On line 64 of search.php, wrap the $_GET['q'] in the htmlentities() function:
$PAGE->assign('search_string',...
1 comment(s)
/ glen
/ Security
/ on February 11, 2006 at 15:38
Siteframe Beaumont (5.x) features
Siteframe Beaumont is the 5.0 release of Siteframe. It is a complete rewrite of the underlying Siteframe codebase, and includes a number of innovative features. Here are some of the more notable ones:
Simplified registration/invitation interface. If an existing user invites a new user to join a Siteframe website, registration is streamlined because the new user's e-mail address has...
0 comment(s)
/ glen
/ General Info
/ on November 26, 2005 at 23:27
Siteframe 3: Cross-Site Scripting (XSS) Vulnerability
Siteframe has, unfortunately, been shown to be vulnerable to
cross-site scripting attacks. In this case, an attacker from a remote
site can use a security hole in Siteframe to access files on the
attacked computer. There is a fix; you need to edit the file web/siteframe.php and change this line (which appears near line 20 at the top of the file): if ($LOCAL_PATH ==...
0 comment(s)
/ glen
/ Security
/ on November 26, 2005 at 22:40
Siteframe 3.2.2
Siteframe 3.2.2 is the most current stable release of the v3 series of Siteframe. It contains all known security fixes.
0 comment(s)
/ glen
/ Older Versions
/ on November 26, 2005 at 22:38
Deleting Content
Siteframe is designed to give site members control over their
content. Therefore, when something is deleted, it is gone from the
site's database and filesystem permanently (note: if regular backups
are made of the site's database and files, then it's possible to
restore accidentally-deleted data, though there is no direct function
provided for that by Siteframe). Typically, all related...
0 comment(s)
/ glen
/ User Help
/ on April 22, 2005 at 23:31
Administrators
A registered site member can optionally be flagged as an administrator
account. Administrators are the gods of a Siteframe website; they have
unlimited control over all site objects, and can edit or delete any
object as needed, including other members. When the site is first
created, an initial administrator account is created; this account
cannot be deleted, though it could be edited...
0 comment(s)
/ glen
/ User Help
/ on April 22, 2005 at 23:27
About Pages, Folders, and Files
NOTE: RECENT REVISIONS TO SITEFRAME HAVE RENDERED THIS DISCUSSION OBSOLETE. STAY TUNED FOR FURTHER UPDATES.
The three most common types of objects used on a Siteframe website are Pages, Folders, and Files. This page describes what each of these objects are, how they are used, and what some of the restrictions are.
A Page is just what you expect: a single page on the website. Each page...
0 comment(s)
/ glen
/ User Help
/ on April 22, 2005 at 23:07
