솔루션 시스템 코어의 보안 업데이트가 이루어졌습니다.
기존
3.1.3
업데이트
3.1.4
금번 업데이트 이후 사이트내의 문제가 발생한다면 문의 남겨주시면 신속히 해결하여 드리겠습니다.
시스템의 일괄 업데이트 적용은 저희 디웹스가 개발한 자체솔루션의 특 장점중 하나입니다.
디웹스는 모든 클라이언트분들이 사업에만 전념 하실 수 있도록 항상 노력하고 있습니다.
디웹스를 선택해 주셔서 감사합니다.
- 디웹스 -
Change Log
Version 3.1.4
Release Date: March 23, 2017
- Security
- Fixed a header injection vulnerability in common function set_status_header() under Apache (thanks to Guillermo Caminer from Flowgate).
- Fixed byte-safety issues in Encrypt Library (DEPRECATED) when mbstring.func_overload is enabled.
- Fixed byte-safety issues in Encryption Library when mbstring.func_overload is enabled.
- Fixed byte-safety issues in compatibility functions password_hash(), hash_pbkdf2() when mbstring.func_overload is enabled.
- Updated Encrypt Library (DEPRECATED) to call mcrypt_create_iv() with MCRYPT_DEV_URANDOM.
- General Changes
- Updated the Image Manipulation Library to work-around an issue with some JPEGs when using GD.
Bug fixes for 3.1.4
- Fixed a regression (#4975) - Loader Library couldn’t handle objects passed as view variables.
- Fixed a bug (#4977) - Loader Library method helper() could accept any character as a filename extension separator.
- Fixed a regression where the Session Library would fail on a session_regenerate_id(TRUE) call with the ‘database’ driver.
- Fixed a bug (#4987) - Query Builder caching didn’t keep track of table aliases.
- Fixed a bug where Text Helper function ascii_to_entities() wasn’t byte-safe when mbstring.func_overload is enabled.
- Fixed a bug where CI_Log, CI_Output, CI_Email and CI_Zip didn’t handle strings in a byte-safe manner when mbstring.func_overload is enabled.
- Fixed a bug where Session Library didn’t read session data in a byte-safe manner when mbstring.func_overload is enabled.
- Fixed a bug (#4990) - Profiler didn’t close
- Fixed a bug (#4990) - Profiler didn’t HTML-escape quotes for $_SESSION variables.
- Fixed a bug where Input Library method set_cookie() didn’t allow its httponly and secure parameters to be overriden to FALSE.
- Fixed a bug (#5006) - common function get_mimes() didn’t load application/config/mimes.php if an environment specific config exists.
- Fixed a bug (#5006) - common function remove_invisible_characters() didn’t remove URL-encoded 0x7F.
- Fixed a bug (#4815) - Database Library stripped URL-encoded sequences while escaping strings with the ‘mssql’ driver.
- Fixed a bug (#5044) - HTML Helper function img() didn’t accept data: URI schemes for the image source.
- Fixed a bug (#5050) - Database Library tried to access an undefined property in a number of error handling cases.
- Fixed a bug (#5057) - Database driver ‘postgre’ didn’t actually apply extra options (such as ‘connect_timeout’) to its DSN.
2017-03-09 11:06:01
2017-03-22 14:08:11