Hosting Zenphoto

1.5.7
 (security release)
5 June - 55MBSecurity

Fixes XSS issue in /page/search/ parameters [acrylian – Thanks to gwen001]

Fixes local file disclosure related to log files on backend pages [acrylian – Thanks to gwen001]

Fixes setup process code injection [acrylian – Thanks to gwen001]

Fixes authenticated SQL injection in postAlbumSort() on backend pages [acrylian – Thanks to gwen001]

Editing executional theme files via the basic theme editor now requires full admin rights. Theme rights are not sufficient anymore. This is only suitable for quick simple edits so you should use a proper editor on a local test server anyway [acrylian – Thanks to the SEC Consult Vulnerability Lab]

Fixes upload of arbitrary files in elFinder plugin. Details below.

Fixes possible XSS issue in the html_encodeTagged() function used e.g. for printing album, image descriptions or page and news article content. [acrylian – Thanks to JPCERT/CC]

Removes very old third PCLZIP fallback library not being able to filter supported file formats contained wiithin archives, which would potentially allow to sneak in unwanted and executional files. This library had no updates since 2009. Therefore the native PHP ZipArchive extension now required for extracting zips. Setup now checks for this [acrylian – Thanks to JPCERT/CC]



General

Fix placeholder page not loading properly if the site_upgrade plugin is used to close the site. Also add default placeholder page within the root index.php in case the site_updated placeholder files are not generated properly or the site is closed via the config file directly [acrylian]

Fixes broken sortdirection for images in dynamic albums/search if sorted by title [acrylian]

Fix unnecessary exceeding of the server side max_input_vars limit if saving image sortorder for large albums. Add a form post truncation warning if using a bulk action and exceeding its limit. Consolidate messages and update post truncation message to tell about the actual issue [acrylian - Thanks to adraw]

New function printLangAttribute() function that prints a "lang" attribute with a locale. It for example can (and should) be added to your theme as