XenForo Media Gallery Security Patch (1.0.1a)

  1. DungHoa

    DungHoa - Jan 8, 2015 Moderator Staff Member

    Credit
    Point
    xfgm_101a

    Brivium (Jan. 8, 2015) - XenForo has recently become aware of a security issue relating to a third-party library included with XenForo Media Gallery and has released a patch to resolve this issue. The issue is a cross site scripting (XSS) flaw that could allow an attacker to steal cookies or force a user to take actions without their consent or knowledge (possibly including administrative actions). XenForo staffs recommend all XenForo Media Gallery customers use one of the methods described below to resolve this issue and improve their security.

    Method 1: Install the Patch

    Download the patch zip file attached to the end of this message. It contains 3 files:
    • js/xengallery/media_share.js
    • js/xengallery/ZeroClipboard.swf
    • js/xengallery/min/media_share.js
    These 3 files should be uploaded to your server, overwriting the existing files of the same names.

    You can confirm that the patch has been applied properly by viewing a media item and looking at the "Share This Media" block. There should be no "copy" buttons next to the text-based sharing options. (Please note that you may have to hard refresh your browser to ensure that cached JS files are not used.)

    Method 2: Download XFMG 1.0.1a and upload all files

    The version of XenForo Media Gallery has been updated in the customer area to 1.0.1a to indicate that the patch has been applied to the original version of 1.0.1. (Please note that the version number listed in the XenForo control panel will not change. You can confirm that you have downloaded 1.0.1a by looking at the file name of the zip containing the XFMG files.)

    The patch can be applied by downloading 1.0.1a from the customer area and acting as if you are upgrading XFMG as normal.

    You can confirm that the patch has been applied properly by viewing a media item and looking at the "Share This Media" block. There should be no "copy" buttons next to the text-based sharing options. (Please note that you may have to hard refresh your browser to ensure that cached JS files are not used.)

    __________
    * Source: XenForo Community
     

    Attached Files:

    Last edited by a moderator: Jan 8, 2015
    Loading...
  2. joey_tbf

    joey_tbf - Jan 8, 2015 Active Member VIP Member

    Credit
    Point
    Thank you. I have installed the Patch.

    I also hear rumors about "Credits Media Gallery Integration" :D I am excited about this rumor. :p
     
    DungHoa and Brivium like this.
    #2
  3. DungHoa

    DungHoa - Jan 9, 2015 Moderator Staff Member

    Credit
    Point
    Thank you! :D
     
    #3