Security Fix -- Please Read

[Andrew Darby]

Hi all,

It was pointed out to us that there is a possible SQL Injection issue in the "forgot password" functionality.  Please replace these two files with ones from the master branch on GitHub:

a) forgot password page
https://github.com/subjectsplus/SubjectsPlus/blob/master/control/forgotpassword.php

b) staff class

https://github.com/subjectsplus/SubjectsPlus/blob/master/lib/SubjectsPlus/Control/Staff.php

It is unlikely that you have localized either file, but if you are running a version earlier than 4, I can't promise it will work--you might just want to remove that forgot password page altogether.

Thanks to Talha for pointing this out!

Andrew