Dear customers !
I’m happy to announce the release of
Events Booking version 5.8.0! This release address two medium security issues found in the earlier versions:
1. Missing permission check result in leaking data
- This missing permission check allow un-authenticated users to get data from any Joomla user (Name, Email) base on the given User ID. The necessary check has been added to prevent this.
2. Missing CSRF token check on upload file
- The extension has an end point to allow registrants to upload file during registrations using ajax upload. The code in previous release does not have CSRF token check, this is now added to enhance security. Further more, I also added .htaccess to prevent direct access to files into this folder, just in case admin allows uploading php files by mistake. Also, addition check has been added so that if you do not use File custom field types, the upload end point will be disabled to prevent attackers from uploading files (to abuse server quota for some reasons).
- Additional checks below are implemented to prevent mass uploads attack (assume your site is on target of attack):
+ Reject unsafe files (files with unsafe file extensions, files contain code) for older Joomla version to make it works in the same way with security improvements implement in Joomla 6.1.2 File::upload method
+ Max Files Per Session: Limit maximum number of files which can be uploaded per session. By default, I set it to 100, you can change it in Events Booking -> Configuration if needed
+ Max Files Per Minutes: Limit maximum number of files which can be be uploaded per minutes. By default, I set it to 20. You can adjust it to a smaller value like 5 or 10 if needed.
+ Upload Folder Size Limit: If you worry that too many files can be uploaded which makes your hosting space becomes full, you can limit it to something like 1024MB (mean 1GB), or smaller size
+ Max Files In Upload Folder: If you worry that too many files can be uploaded, you can limit total number of files can be uploaded for your site via upload field types in Events Booking. For example, set it to 5000 files.
Please update your site to this latest version of Events Booking to have the two issues fixed and more secure. We sincerely apologize for any inconvenience this may cause and appreciate your prompt attention to this matter.
I also would like to take this chance to thanks
Phil from
mysites.guru/
for reporting the issues to us this afternoon, and discussing further about the second issue via email. Also, thanks
David from JSST for joining the discussion, too.
Regards,
Tuan
