Support Forum

Latest News and Developments

Critical Security Update - Version 5.5.0.1 Released

Add Reply

Add Topic

Critical Security Update - Version 5.5.0.1 Released

Mr Papa

Simi Valley, CA

SP Master

Free Members

Offline

Aug 12, 2014 - 8:50 pm

Quote

Today, we have released an urgent security update to Simple:Press. We strongly encourage you to update your sites running Simple:Press immediately.

This release corrects a potential sql injection vulnerability in the search function of Simple:Press. The bug was reported by a Simple Press user that wishes to remain anonymous. We want to thank him for the responsible reporting of this issue so it could be researched and resolved.

So please be sure to update your installations of Simple:Press...

The next planned version of Simple:Press, v5.5.1, is still on target for release in a couple weeks when the WordPress team ships their 4.0 version.

Visit Cruise Talk Central and Mr Papa's World

Blaise

Member

Pro Subscribers

Offline

Aug 14, 2014 - 4:32 am

Quote

Hi,

Could you please let me know which files were updated so I can just replace those files? I have done quite a few customisations and do not want to overwrite them all.

thanks!

Yellow Swordfish

Glinton, England

SP Master

Offline

Aug 14, 2014 - 5:02 am

Quote

/sp-control.php
/sp-api/sp-api-primitives.php
/forum/content/classes/sp-search-view-class.php

I have to say that making changes to core code is a really, really bad idea. It should also be unnecessary. Like WordPress itself, Simple:Press has an extremely rich set of WP style hooks - actions and filters - which should result in there being no need to customise any code at all. Plus most of the time - customisation can be performed in templates with the creation of a child theme.

When users have asked for a specific customisation they need and there has been no hook available we have always put one in place for them to use and will continue to do so in the future.