xguide wrote:

.....you think it is better to see victims of hacks on the forums?

xguide wrote:
Do you know a programming language and you think Ajann contribution is not good to secure xoops? Users do not need alert and you think it is better to see victims of hacks on the forums?

Read a good article with good decision to do with futur XOOPS development.

"We are trying to get the word out there to developers that they have at least one brand new security consideration that they didn't have before," said Chess, who co-authored the report.

"Usually we security guys are coming along long after the fact. But this time, we have a chance to fix the problem before it really matters."

"This is a case where even educated developers didn't know it was a big deal because even the security community didn't know it was there," Chess said.

oice to make," said Fortify's Chess. "In terms of disclosing details about a vulnerability, the right thing to do is to tell the developer about it and give them a chance to patch it.

"But the problem here is that we are talking about a vulnerability that is in so many different frameworks and there are so many people not using frameworks, that we want to give everyone a chance to fix it at once, and that meant announcing it," he said.

http://www.securityfocus.com/news/11456

vaughan wrote:

i said that protector module will stop practically most of the exploits that you brought up in that security focus.

JAVesey wrote:
Quote:

vaughan wrote:

i said that protector module will stop practically most of the exploits that you brought up in that security focus.

xguide was also told that the reports relate to old and subsequently updated modules yet still goes on and on and on and on..............

@xguide
If you don't read posts or don't understand what is said in them, are so concerned about security and think that the XOOPS core and the current modules are vulnerable then why not use a different CMS and see how you get on with it?

Much better than your continuing to post outdated drivel on here and taking other users time to correct your misunderstandings and inaccuracies.

xguide wrote:

It is important to remember members to update modules and server software. Because xoops.org repository it is not up to date. And the XOOPS distributed package is not secure because its core only provide a simple token system. Users need extra protection. They need at minimum a module like Protector but this module do not come with XOOPS package.