Version 0.6.6 – Finally! a security release


By Dmitry Baranovskiy - http://www.flickr.com/photos/dmitry-baranovskiy/

Cross Site Scripting -> XSS

We would like to thank Joshua Hansen and Scott Caveza for their help in identifying and helping us debug two XSS vulnerabilities that had the potential to effect users using internet explorer browser with versions lower than 8, or when xss protection was explicitly off. We avoided the urge to call this version 0.6.6.6 and resumed the regular naming policies. Those vulnerabilities don’t pose any risk to webmasters or hosters using Transposh, but to users that might trust scripts from these sites by using the sneaky XSS method.

This release also bundles two other changes that were already committed and would have probably waited for a later release otherwise, the first being a small improvement to the parser, enabling support for some more html “breaker entities” such as ’ which were created by software trying to outsmart the user, we would like to thank archon810 on his help in this bug report.

Last but not least is a change in the support for Google Sitemaps XML generator, the patch has one letter removed in order to have proper support for php5.3, and on other good news, the coming version 4 of this plugin has support already built in, this version also helps in breaking the 50k url limits that some users had. So we would to thank Arne Brachhold on his great work on this project.

So everybody, go and upgrade! just because finding an image to match this post was such a difficult fit.

, , , ,

  1. #1 by Anphicle on November 12, 2010 - 2:05 am

    Great, keep up the good work!

  2. #2 by Peter on November 12, 2010 - 10:04 am

    Good day

    What does the message:
    “Google Sitemaps XML Generator, the patch ”
    I : Sitemap Version 3.2.4 and Transposh version 0.6.6

    But there are no language in the xml generated pages.

    Regards
    Peter

    • #3 by ofer on November 12, 2010 - 10:33 am

      Hello,

      Make sure you have the latest patch, eg. remove the & from the previous patch, I have updated the changelog, and now the FAQ with this new patch, if you still have problems I’ll send you the patched file.

      Good luck

  3. #4 by Timo Ligi on November 12, 2010 - 8:59 pm

    Tere päevast

    Kui ma panen tööle “Google Sitemaps XML Generator” ja Transposh version 0.6.6 siis saan Google sitemaps XML-is vastuseks “XML Parsing Error: no element found, Line Number 1, Column 1:” Samas kui võtan maha Transposh version 0.6.6, siis Google sitemaps töötab.

    Timo

  4. #6 by Elmar on November 12, 2010 - 10:24 pm

    Same problem as in earlier versions since 0.6.3: After upgrade I see “Okt_Oktober_abbreviation” instead of “OKT” in my blog. Same with any short form of month when German name is different from English name. So 0.66 deleted again and version 0.61 again – it works. And proofes the plugin makes something wrong. And I don’t want to use a plugin that I have to work with by myself editing PHP… So any upgrade in the future will not fix it?

    • #7 by ofer on November 12, 2010 - 10:38 pm

      First, please create a ticket in the trac (trac.transposh.org)
      Second, please try to provide more details regarding your system (which WP you use, etc)
      Third, you can disable the gettext integration, should probably solve your issue better than downgrading to 0.6.1

      And good luck…

      • #8 by Elmar on November 13, 2010 - 12:04 am

        I did create a ticket…

        • #9 by Elmar on November 13, 2010 - 12:37 am

          Quick and successful help – I don’t need to edit PHP, only to change one option in the options. Great! Now it works perfect again! Thank you so much!

  5. #10 by nvr on November 13, 2010 - 12:26 am

    it is possible to permanent disable e-mail adresses from translation? (both strings and urls)

    I mean the built-in function, not every time the use of no_translate class.

    • #11 by ofer on November 13, 2010 - 12:55 am

      As far as I know, at least urls (ones that are properly marked as ones) will not be translated, checking for every word in every phrase if it might be a url or email might create some substantial overhead.

  6. #12 by Ivo Minchev on December 17, 2010 - 8:05 pm

    I have a Backup problem. I get the following “500 – Couldn’t resolve host ‘svc.transposh.org’” when I click the “Do Backup Now” button.

    • #13 by ofer on December 17, 2010 - 11:48 pm

      Thanks for reporting,

      I guess that would be yet another problem with cloudflare dns, I will fix this in the coming day.

(will not be published)


Current ye@r *