Everyone should know that there are now scripts available to automatically crack any SPIP site vulnerable to the security flaw fixed in SPIP 2.0.9 and SPIP 1.9.2i. Using these scripts an attacker can automatically download a copy of your database and, using that information, change all of your users' passwords. Please upgrade your sites or, if you cannot upgrade, install `ecran_securite.php`.
`ecran_securite.php` is a "security screen" which blocks attacks using all known vulnerabilities in SPIP. This can help keep your site secure until you are able to upgrade it. See <http://www.spip.net/en_article4201.html > for installation instructions or for more information.
Hello,
I have version 2.9 installed and there is a problem when some users want to register on Farsi page. They inter email address to receive password. But what they receive is something like this:
:login __________18
Password: Password
They cannot login with that information. The problem maybe is because of entering names in Farsi characters and not English.
Do you think there is any other reason? And any solution?
Kamran
Hello,
I have version 2.9 installed and there is a problem when some users want to register on Farsi page. They inter email address to receive password. But what they receive is something like this:
:login __________18
Password: Password
They cannot login with that information. The problem maybe is because of entering names in Farsi characters and not English.
Do you think there is any other reason? And any solution?
Kamran
Actually, the login accepts only ascii characters : A-Za-z0-9-_
UTF8 characters would be dangerous for some security reasons.
Is this just because many UTF-8 implementation have buggy decomposition, normalisation, and byte-stream validation algorithms? Or are there more security implications as well?
I also read some other stuff related to the default configuration of Apache or MySQL when they don’t correctly support the UTF-8 charset.
But, as I can’t find the references immediatly, I can’t detail the risks.
Actually, the login accepts only ascii characters : A-Za-z0-9-_
UTF8 characters would be dangerous for some security reasons.
Is this just because many UTF-8 implementation have buggy decomposition, normalisation, and byte-stream validation algorithms? Or are there more security implications as well?
I also read some other stuff related to the default configuration of Apache or MySQL when they don’t correctly support the UTF-8 charset.
But, as I can’t find the references immediatly, I can’t detail the risks.
Actually, the login accepts only ascii characters : A-Za-z0-9-_
UTF8 characters would be dangerous for some security reasons.
Is this just because many UTF-8 implementation have buggy decomposition,
normalisation, and byte-stream validation algorithms? Or are there more
security implications as well?
In this case I don't think we have a security issue. The problem seems
more that something is poorly implemented. Precise tests would be
needed.
! " # $ % & ' ( ) * + , - . /
0 1 2 3 4 5 6 7 8 9 : ; < = > ?
@ A B C D E F G H I J K L M N O
P Q R S T U V W X Y Z [ \ ] ^ _
` a b c d e f g h i j k l m n o
p q r s t u v w x y z { | } ~
