Forum module security releases (0.6.2 and 0.7.5)

[Ed Linklater]

Hi all,

Users of the silverstripe/forum module are highly recommended to upgrade to 0.7.5 due to major bugs discovered.

SS-2015-017: A number of form actions in the Forum module are directly accessible

Affects: All versions

Fixed in: 0.6.2, 0.7.4

A malicious user (e.g. spammer) can use GET requests to create Members and post to forums, bypassing CSRF and anti-spam measures.

Additionally, a forum moderator could be tricked into clicking a specially crafted URL, resulting in a topic being moved.

Thanks to my colleague Michael Strong for discovering this issue which was the cause of a lot of spam on the SilverStripe.org forums!

Deleting Forum Post deletes Member with correlating ID

Affects: 0.7.0+

Fixed in: 0.7.5

If a forum post with ID 79 (for example) is deleted, Member with ID 79 will also be deleted bypassing the ORM.

Thanks Ollie from Little Giant for reporting and fixing this issue.

--

Ed Linklater | Developer
SilverStripe
http://silverstripe.com/

Phone: 04 978 7330 extn 4455