Artur, sorry about that.
The package to sync from sid to natty is mahara 1.2.7-1:
mahara (1.2.7-1) unstable; urgency=high
* New upstream security release:
- CVE-2011-0439 (XSS in select boxes)
- CVE-2011-0440 (CSRF when deleting blogs)
* Add Italian debconf translation (closes: #606378)
* Add Danish debconf translation (closes: #597766)
* Bump debhelper compatibility to 8
** CVE added: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2011-0439
--
You received this bug notification because you are a member of Mahara
Committers, which is subscribed to Mahara.
https://bugs.launchpad.net/bugs/676336
Title:
Blogs get deleted without sesskey check
Status in Mahara ePortfolio:
Fix Released
Status in Mahara 1.3 series:
Fix Released
Status in “mahara” package in Ubuntu:
New
Status in “mahara” source package in Lucid:
New
Status in “mahara” source package in Maverick:
New
Status in “mahara” source package in Natty:
New
Bug description:
Permissions are checked but the sesskey is neither passed nor checked
e.g. artefact/blog/index.php?delete=123
_______________________________________________
Mailing list: https://launchpad.net/~mahara-core
Post to : [email protected]
Unsubscribe : https://launchpad.net/~mahara-core
More help : https://help.launchpad.net/ListHelp
