cpg1.5.20 Security release - upgrade mandatory!

[Αndré]

The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.18 or older update to this latest version as soon as possible.

How to update:
Users running versions prior to 1.5.20 should update immediately by downloading the latest version from the download page and following the upgrade steps in the documentation.

Support:
If you have problems with this update, please use the Update support board. Do not post your issues to this announcement thread - your post will be deleted without notice.

Why was cpg1.5.20 released?
The release covers several path disclosure vulnerabilities. If unpatched, it's possible to generate an error that will reveal the full path of the script. A remote user can determine the full path to the web root directory and other potentially sensitive information.
Furthermore, the release covers a recently discovered XSS vulnerability that allows (if unpatched) a malevolent visitor to include own script routines under certain conditions.

Additionally, cpg1.5.20 includes fixes for the following non-security related issues:

• Disabled possibility to move albums to root level of user category (thread)
• Fixed broken IP address lookup (thread)
• Fixed email validation for registration process (thread)
• Updated Serbian language file (user contribution)
• Changed status in credits section to 'retired'
• Updated Italian language file (user contribution)
• Re-added 'search by owner name' checkbox to search form (thread, thread)
• New feature: display only the uploaded files from the last queue after flash upload (thread)
• Fixed behavior of "Show first level album thumbnails in categories" setting (thread)
• Added plugin hook 'theme_album_params'
• Fixed quota bar in user manager for secondary group memberships (thread)
• Display default groups "Administrators" and "Registered" on modify user page (thread)
• Moved code from usermgr.php to function 'cpg_get_groups'
• Added Opera compatibility for rounded corners to theme 'curve' (thread)
• Fixed error message at "Edit file information" form (thread)
• Updated EXIF library (thread)
• Fixed clickable keywords in file information box at intermediate view (thread)
• Fixed search results when searching for specific characters (thread)
• Fixed error message when activating more than one user in the user manager (thread)
• Fixed different gallery behavior for register_globals on/off setting (thread)

Thanks to Janek Vind for discovering the vulnerability.


The Coppermine Team

[PLEG54]

Hello André,

there is a mistake into the file /include/picmgmt.inc.php at line 18 :
not "iif (!defined('IN_COPPERMINE')) die('Not in Coppermine...');"
but "if (!defined('IN_COPPERMINE')) die('Not in Coppermine...');"

Best regards,
PLEG54

[Αndré]

What an annoying typo I'll fix it and update the package accordingly. Package updated.

Thanks for the report.