Version 0.6.6 – Finally! a security release

By Dmitry Baranovskiy -
Cross Site Scripting -> XSS

We would like to thank Joshua Hansen and Scott Caveza for their help in identifying and helping us debug two XSS vulnerabilities that had the potential to effect users using internet explorer browser with versions lower than 8, or when xss protection was explicitly off. We avoided the urge to call this version and resumed the regular naming policies. Those vulnerabilities don’t pose any risk to webmasters or hosters using Transposh, but to users that might trust scripts from these sites by using the sneaky XSS method.

This release also bundles two other changes that were already committed and would have probably waited for a later release otherwise, the first being a small improvement to the parser, enabling support for some more html “breaker entities” such as ’ which were created by software trying to outsmart the user, we would like to thank archon810 on his help in this bug report.

Last but not least is a change in the support for Google Sitemaps XML generator, the patch has one letter removed in order to have proper support for php5.3, and on other good news, the coming version 4 of this plugin has support already built in, this version also helps in breaking the 50k url limits that some users had. So we would to thank Arne Brachhold on his great work on this project.

So everybody, go and upgrade! just because finding an image to match this post was such a difficult fit.


  1. says

    Good day

    What does the message:
    Google Sitemaps XML Generator, the patch ”
    I : Sitemap Version 3.2.4 and Transposh version 0.6.6

    But there are no language in the xml generated pages.


    • says


      Make sure you have the latest patch, eg. remove the & from the previous patch, I have updated the changelog, and now the FAQ with this new patch, if you still have problems I’ll send you the patched file.

      Good luck

  2. says

    Tere päevast

    Kui ma panen tööle “Google Sitemaps XML Generator” ja Transposh version 0.6.6 siis saan Google sitemaps XML-is vastuseks “XML Parsing Error: no element found, Line Number 1, Column 1:” Samas kui võtan maha Transposh version 0.6.6, siis Google sitemaps töötab.


  3. says

    Same problem as in earlier versions since 0.6.3: After upgrade I see “Okt_Oktober_abbreviation” instead of “OKT” in my blog. Same with any short form of month when German name is different from English name. So 0.66 deleted again and version 0.61 again – it works. And proofes the plugin makes something wrong. And I don’t want to use a plugin that I have to work with by myself editing PHP… So any upgrade in the future will not fix it?

    • says

      First, please create a ticket in the trac (
      Second, please try to provide more details regarding your system (which WP you use, etc)
      Third, you can disable the gettext integration, should probably solve your issue better than downgrading to 0.6.1

      And good luck…

  4. nvr says

    it is possible to permanent disable e-mail adresses from translation? (both strings and urls)

    I mean the built-in function, not every time the use of no_translate class.

    • says

      As far as I know, at least urls (ones that are properly marked as ones) will not be translated, checking for every word in every phrase if it might be a url or email might create some substantial overhead.

Leave a Reply

Your email address will not be published. Required fields are marked *