search

barryvdh / laravel-elfinder

elFinder bundle for Laravel
738 stars 169 forks source link

elfinder 2.1.48 and earlier version security issue #282

Closed setlec closed 4 years ago

setlec commented 4 years ago

Hello there, FIY: this a copy paste from this url https://github.com/Studio-42/elFinder/tree/2.1 since this project uses version 2.1.10 i thought it would be good to warn you.

WARNING: IF YOU HAVE OLDER (IN PARTICULAR 2.1.48 OR EARLIER) VERSIONS OF ELFINDER ON PUBLIC SERVERS, IT MAY CAUSE SERIOUS DAMAGE TO YOUR SERVER AND VISITED USER. YOU SHOULD UPDATE TO THE LATEST VERSION OR REMOVE IT FROM THE SERVER.

lovecoding-git commented 4 years ago

Which issue is there?

setlec commented 4 years ago

wasn't the warning text nor the link enought to indicate the issue? let repaste the issue:

WARNING: IF YOU HAVE OLDER (IN PARTICULAR 2.1.48 OR EARLIER) VERSIONS OF ELFINDER ON PUBLIC SERVERS, IT MAY CAUSE SERIOUS DAMAGE TO YOUR SERVER AND VISITED USER. YOU SHOULD UPDATE TO THE LATEST VERSION OR REMOVE IT FROM THE SERVER.

lovecoding-git commented 4 years ago

I used latest version. "barryvdh/laravel-elfinder": "^0.4.5"

Is this OK?

setlec commented 4 years ago

I've no clue, if that is ok. I don't know if this port of elfinder has been update a newer version (2.1.48+) of elfinder. but as far i could see, the elfinder version that is being used in the master branch is 2.1.10.

ciamarro commented 4 years ago

It's using ~2.1.10 so it pulls studio-42/elfinder (2.1.57) Just update

barryvdh commented 4 years ago

I updated the minimum, but yeah just run composer update.