Thanks to Kamil 'K3' Sienicki for reporting this via e-mail. The possible exploit is describe on this URL: http://k3.int.pl/security/openfaq.txt
A previous annoncement has been made about other errors, but no new release came as promised. I will probably rewrite the whole thing using PHP5 and the filebase SQLite database interface.
As anyone who have tried to install and use OpenFAQ 0.4.0 has probably noticed, it won't work after editing the configuration in the admin section.
This will be fixed in OpenFAQ 0.5 which will be released later this week. One key feature is a simple installation script that makes sure everything works out of the box and creates and inputs the needed database information.
I have now released seperate packages with language files for each language available, and when someone sends me translations to other languages I will add packages for them as well.
Please send an e-mail to stian.hole@gmail.com if you wish to translate or proofread a translation for this project.
OpenFAQ 0.4.0 is now out, some cleanup, some new features and other things.
Version 0.3 of OpenFAQ is now released. Here is the changelog for this release:
* Fixed "major" flaw in admin/edit.php, language file now loads
* Added several new strings to the language files.
* Added TODO file with information on planned/wanted features.
* Added post- and prehtml values, for easy incoorporation to current website through two fields in admin area.
* Visitors can submit questions and recieve email when answered.
* Admin can edit/publish/delete submitted questions.
* Admin can enter e-mail address in configuration, which will be set as sender in all outgoing mail.
* Admin can set the URL of the FAQ in configuration area. This will be used in outgoing mails.... read more
I am ashamed to announce this bug, since I should have spotted it before I released version 0.2. The bug is in admin/edit.php and renders the editing function completely useless.
To fix it, fire up your favourite editor and load admin/edit.php and on line 25, replace the following:
require_once("lang/$config[lang].php");
with this:
require_once("../lang/$config[lang].php");... read more
Go over to the Files section to download v. 0.2.0 of OpenFAQ. It features the following changes since last time:
* Fixed silly typo in admin/auth.php
* Added CHANGELOG
* Added configuration editing in admin area
* Added menu to admin area
* Added admin/common.php for keeping common variables/functions
* Added confirmation when deleting entries
* Added i18n support through simple language files
Erhm, it's been over a year, and the typo in admin/auth.php hasn't even been fixed and re-released. However, this weekend I looked at the code, and made some changes (first time coding past six months), and I will release OpenFAQ 0.2.0 this coming weekend.
However, you shouldn't expect too much, I have only fixed the typo and added a configuration area to the admin section. If you would like to suggest features for OpenFAQ 0.2.0, or a future release, you can do so here: https://sourceforge.net/tracker/?func=add&group_id=99813&atid=625402... read more
OK, so this is the first newsposting to announce the first release of OpenFAQ. I hope it will develop nicely and become useful to all the site administrators out there.
We don't have a website yet, so http://sourceforge.net/projects/openfaq is the place to get the latest news and files for a while.
If you have any questions, bugs, feature request direct them through the forums on our project page.
Stian H