Update Feed

CMS Made Simple 1.12

13 April 2015

CMS Made Simple version 1.12 is now available (major release).

Upgrading to CMS Made Simple 1.12

CMS Made Simple 1.12 can be upgraded to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply CMS Made Simple updates as new versions are released, or use Installatron's Clone feature to duplicate an existing CMS Made Simple install to test the 1.12 upgrade prior to applying it live. Get started managing your CMS Made Simple installations with Installatron

What's New in CMS Made Simple 1.12

This release can be called a 'security and stability' release where we primarily made changes related to security, but also attempted to resolve or improve a number of outstanding issues.

The biggest changes in this release are related to security. First, we now require, and enforce that register_globals (a PHP setting that has long been considered insecure, and is removed from newer versions of PHP, see: http://php.net/manual/en/security.globals.php) be completely disabled in your CMSMS install. Secondly, we have removed the {eval} statements from the factory default News summary and detail templates. This will prevent content submitted by un-verified users from doing nasty things with smarty. And thirdly (though not last) we made some changes in our smarty config to improve security.

Along with the security fixes we have improved the homepage functionality in the CMSMS admin console, fixed some lingering minor issues, and generally improved the stability of your favourite content management system. Because this is a security release, we do encourage everybody to upgrade their CMSMS websites as soon as possible. As of now, per our support policy the only two officially supported versions of CMSMS are 1.11.13 and 1.12.

Core - General

Now require that register_globals be OFF. This may generate errors for some sites, you MUST change their PHP config if register_globals is on! [Security fix]
Smarty template security fix
Replace stub file for function.process_pagedata.php
Fixes Admin homepage issue (Note: current homepage must be reset!)
Adds the CmsAdminUtils class (new utility class for Admin requests). Currently with two static methods
Fixes to HTML entity decoding
PHP 5.2.x compatibility issues
Remove the html_entity_decode_utf8 function (should only have been used in the core). We now have one standard cms_html_entity_decode function
Minor fix to {cms_selflink}
Remove some extra whitespace from editcontent and edittemplate
Increase Image Manager height
Fixes issue with French locale string
Fixes #9598 - Issues with cancel button in changegroupperm and changegroupassign

News

Remove {eval} from factory default display templates (will not effect existing installs) [Security fix]
Fixes #10129 - DoS by specifying extra-large pagelimit (now maximum of 1000) [Security fix]
Fixes #10452 - Browsecat counting articles that do not start yet