[Harald Ponce de Leon]

An update to the osCommerce 2.2 Milestone 2 version has been released that addresses security related issues and bug reports that exist in the released version.

It is recommended for osCommerce 2.2 Milestone 2 store owners to apply the changes to their installations due to the security issues and bug reports that have been fixed. The changes involved are minimal, do not break compatibility with contributions, and further strengthens the security of the shop installation.

This update release focuses solely on security related issues and bug reports, and does not introduce any new features that have been made for the next development milestone release.

This release is a full release package containing updated source files, documentation, and information on what changes have been made to easily apply to existing installations.

This update release includes the following changes:

• PHP 5 compatibility updates
  
• MySQL 5 compatibility updates
  
• Cross Site Scripting fixes
  
• HTTP/E-Mail header injection fixes
  
• Database data input updates
  
• File Manager file saving fixes
  
• Split Page Result class fixes

This update release can be downloaded from:

http://www.oscommerc...tions/downloads

Update 051113

An additional update labelled 051113 has been released that fixes the following problems:

• Removes control characters in the update.txt file that cause PHP parsing errors
  
• Fixes bug report 1662; update of customers address through the My Account page resulted in the country value not being stored properly and affected tax rate values. (brought to our attention by JanZ)

The documented changes found inside the download package can be seen here:

http://www.oscommerc...e-20051113.html

The complete 2.2 Milestone 2 Update changes involve the following files:

catalog/admin/includes/classes/email.php
catalog/admin/includes/classes/split_page_results.php
catalog/admin/includes/classes/upload.php
catalog/admin/includes/functions/database.php
catalog/admin/includes/functions/general.php
catalog/admin/includes/functions/html_output.php
catalog/admin/categories.php
catalog/admin/file_manager.php
catalog/admin/orders.php

catalog/includes/classes/email.php
catalog/includes/classes/shopping_cart.php
catalog/includes/classes/split_page_results.php
catalog/includes/functions/database.php
catalog/includes/functions/general.php
catalog/includes/functions/html_output.php
catalog/includes/functions/sessions.php
catalog/address_book_process.php (051113)
catalog/advanced_search_result.php
catalog/index.php
catalog/redirect.php

This post has been edited by hpdl: 14 November 2005 - 01:26 AM