Push v2.11.20240911 - see changelog for relevant changes

getk2 · Sep 11, 2024 · f4f714d · f4f714d
1 parent 5bb47b2
commit f4f714d
Show file tree

Hide file tree

Showing 7 changed files with 12 additions and 9 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,9 @@
 
 # Changelog
 
+### v2.11.20240911 - September 11th, 2024
+- Fixed reported vulnerability in the third-party PHP library "class.upload.php" (https://github.com/getk2/k2/issues/561)
+
 ### v2.11.20240609 - June 9th, 2024
 - Improved database performance for the K2 Content module. When selecting specific items, a single query will now be executed instead of distinct queries, as was done previously.
 - Improved database performance for itemlist views (category, tag, user, date, search) by using a forced index on the category JOIN. The performance benefits for this change will be greatly noticed on sites with dozens to hundreds of thousands of K2 items, especially during crawling hours by search engines, SEO bots etc.

diff --git a/docs/update.js b/docs/update.js
@@ -74,7 +74,7 @@
     };
 
     /* === K2 App === */
-    var K2_LATEST_VERSION = '2.11.20240609';
+    var K2_LATEST_VERSION = '2.11.20240911';
     var K2_RELEASE_NOTES = 'https://github.com/getk2/k2/blob/master/CHANGELOG.md';
 
     if (kookie.read('K2_hideUpdateMessage')) return;

diff --git a/docs/update.xml b/docs/update.xml
@@ -5,7 +5,7 @@
         <description>K2, the powerful content extension for Joomla (by JoomlaWorks)</description>
         <element>com_k2</element>
         <type>component</type>
-        <version>2.11.20240609</version>
+        <version>2.11.20240911</version>
         <infourl title="K2 - Changelog">https://github.com/getk2/k2/blob/master/CHANGELOG.md</infourl>
         <downloads>
             <downloadurl type="full" format="zip">https://getk2.org/downloads/?f=K2_Rolling_Release.zip</downloadurl>
@@ -24,7 +24,7 @@
         <description>K2, the powerful content extension for Joomla (by JoomlaWorks)</description>
         <element>com_k2</element>
         <type>component</type>
-        <version>2.11.20240609</version>
+        <version>2.11.20240911</version>
         <infourl title="K2 - Changelog">https://github.com/getk2/k2/blob/master/CHANGELOG.md</infourl>
         <downloads>
             <downloadurl type="full" format="zip">http://getk2.org/downloads/?f=K2_Rolling_Release.zip</downloadurl>

diff --git a/k2.xml b/k2.xml
@@ -2,11 +2,11 @@
 <extension type="component" version="2.5" method="upgrade">
     <name>COM_K2</name>
     <author>JoomlaWorks</author>
-    <creationDate>June 9th, 2024</creationDate>
+    <creationDate>September 11th, 2024</creationDate>
     <copyright>Copyright (c) 2009 - 2024 JoomlaWorks Ltd. All rights reserved.</copyright>
     <authorEmail>[email protected]</authorEmail>
     <authorUrl>https://www.joomlaworks.net</authorUrl>
-    <version>2.11.20240609</version>
+    <version>2.11.20240911</version>
     <license>https://gnu.org/licenses/gpl.html</license>
     <description>Thank you for installing K2 by JoomlaWorks, the powerful content extension for Joomla</description>
     <installfile>install.k2.php</installfile>

diff --git a/manifest.xml b/manifest.xml
@@ -2,11 +2,11 @@
 <install type="component" version="1.5" method="upgrade">
     <name>K2</name>
     <author>JoomlaWorks</author>
-    <creationDate>June 9th, 2024</creationDate>
+    <creationDate>September 11th, 2024</creationDate>
     <copyright>Copyright (c) 2009 - 2024 JoomlaWorks Ltd. All rights reserved.</copyright>
     <authorEmail>[email protected]</authorEmail>
     <authorUrl>https://www.joomlaworks.net</authorUrl>
-    <version>2.11.20240609</version>
+    <version>2.11.20240911</version>
     <license>https://gnu.org/licenses/gpl.html</license>
     <description>Thank you for installing K2 by JoomlaWorks, the powerful content extension for Joomla</description>
     <installfile>install.k2.php</installfile>

diff --git a/media/k2/assets/vendors/verot/class.upload.php/src/class.upload.php b/media/k2/assets/vendors/verot/class.upload.php/src/class.upload.php
@@ -3101,7 +3101,7 @@ public function process($server_path = null)
                 }
                 // if the file is text based, or has a dangerous extension, we rename it as .txt
                 if ((((substr($this->file_src_mime, 0, 5) == 'text/' && $this->file_src_mime != 'text/rtf') || strpos($this->file_src_mime, 'javascript') !== false)  && (substr($file_src_name, -4) != '.txt'))
-                    || preg_match('/\.(asp|cgi|js|ph3|ph4|ph5|ph7|phar|php|php3|php4|php5|php6|php7|pht|phps|phtml|pl|py)$/i', $this->file_src_name)
+                    || preg_match('/\.(asp|cgi|js|ph3|ph4|ph5|ph7|phar|php|php3|php4|php5|php6|php7|pht|phps|phtml|pl|py)/i', $this->file_src_name)
                     || $this->file_force_extension && empty($file_src_name_ext)) {
                     $this->file_src_mime = 'text/plain';
                     if ($this->file_src_name_ext) {

diff --git a/plugins/system/k2.php b/plugins/system/k2.php
@@ -26,7 +26,7 @@ public function onAfterInitialise()
         }
 
         // Define K2 version & build here
-        define('K2_CURRENT_VERSION', '2.11.20240609');
+        define('K2_CURRENT_VERSION', '2.11.20240911');
 
         // Define the DS constant (for backwards compatibility with old template overrides & 3rd party K2 extensions)
         if (!defined('DS')) {