Important security fix for all 3.5.x versions

[periklis]

Geetings to the community
An important security issue was brought recently to our attention by Core Advisories Team, which will also issue a public warning next week.
Using a specially crafted url a malicious user can acquire web server privileges on systems running efront. A patch is already available, all 3.5.x users are strongly recommended to download and apply it

[periklis]

btw, the offending file is www/editor/tiny_mce/langs/language.php. This is not needed in 3.6.0 and has been removed. However, it may be left over in cases 3.5.5 sites where updated to 3.6. If you are running 3.6.0 and have this file, it's safe to delete it. Next efront update will automatically remove the file from the system.

[connect]

Hi Guys, is there a specific area we need to open this patch in?

[periklis]

You just extract it inside your efront installation's main directory.