v4.6.0 - IMPORTANT

[Matt Quackenbush]

Thank you, Marc Esher, for identifying an issue and testing a solution!!!!!!!!!!

http://www.quackfuzed.com/index.cfm/2011/9/11/cfUniForm-v460--IMPORTANT-PrettyComments-XSS-Vulnerability-Fix-Release

[George Murphy]

Hi Matt and Marc,

Thanks for letting us know about this.

I am using this to handle things globally.
               <cfscript>
                 config = structNew();
                 config.loadjQuery = true;
                 config.loadDateUI = true;
                 config.loadTimeUI = false;
                 config.loadTextareaResize = true;
                 config.dateSetup = structNew();
                 config.dateSetup['yearRange'] = "'#year(now())#:#year(dateAdd('yyyy', 1, now()))#'";
                 config.dateSetup['showWeeks'] = "true";
                 config.textareaSetup = structNew();
                 config.textareaSetup['maxHeight'] = 800;
                 config.textareaSetup['animate'] = true;
                 config.textareaSetup['animationSpeed'] = "'slow'";
                </cfscript>
Should I just remove this?
               <cfscript>
                 config = structNew();
                 config.loadjQuery = true;
                 config.loadDateUI = true;
                 config.loadTimeUI = false;
                 config.dateSetup = structNew();
                 config.dateSetup['yearRange'] = "'#year(now())#:#year(dateAdd('yyyy', 1, now()))#'";
                 config.dateSetup['showWeeks'] = "true";
                </cfscript>
Thanks,

George Murphy

On Sun, Sep 11, 2011 at 5:06 PM, Matt Quackenbush <quack...@gmail.com> wrote:

Thank you, Marc Esher, for identifying an issue and testing a solution!!!!!!!!!!

http://www.quackfuzed.com/index.cfm/2011/9/11/cfUniForm-v460--IMPORTANT-PrettyComments-XSS-Vulnerability-Fix-Release

--
You received this message because you are subscribed to the Google Groups "cfUniForm-users" group.
To post to this group, send email to cfunifo...@googlegroups.com.
To unsubscribe from this group, send email to cfuniform-use...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/cfuniform-users?hl=en.

--
George Murphy
President
DeSign By George, Inc.
http://www.websbygeorge.com
703-867-1934

[Matt Quackenbush]

George,

The only thing there that will no longer have any effect after the upgrade is the `textareaSetup` key.  Everything else is still completely valid and in effect.  :-)


Matt