Downloads
Download tar.gz
137.69 KB
MD5: 402d329c26040c3dbfa7d5d6bf0ac4e2
SHA-1: 5456b1fb43f52799290e42f5a92b04c5c015d396
SHA-256: c983dfad0fdf6c8a3441255e96db67a6420e3c919ef6085c8046d29524be8450
Download zip
173.54 KB
MD5: ce82d34a0e3e29c73b8b1cffaefe6166
SHA-1: 7e09d5640f7ebd62f2bd46d33d5837dc7f490185
SHA-256: 542121a0b52fce5c3d2472e33c84759ffc277ca106ddf39ad1856d9de0fa60c3
Release notes
This release of 6.x-3.x fixes one security issue. Updating is strongly recommended for all Drupal 6 webform users.
See SA-CONTRIB-2015-078 - Webform - Cross Site Scripting (XSS) for details.
Security issue
When a webform component is used as the "To" address or addresses for sending an e-mail, the name of the component is not sufficiently sanitized when it is displayed in the list of e-mail settings, leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or update webform nodes. This permission is normally granted only to administrative users.
Changes since 6.x-3.22:
- #SA153017 by Dan Chadwick: Incorrect display of select component in e-mail list.
Security update
