Zikula Community

The solution:

• Delete TinyMCPUK (the one included until scribite! 3.1) from /javascript/scribite_editors/tiny_mce.
• Delete FCKeditor from /javascript/scribite_editors/fckeditor.
• Upgrade to version 4.1 or later.
• It is important to completely delete the editors before upgrading the new version because some file locations have changed!

Explanation:

The vulnerabilities are specifically with the external file managers, not within "scribite!" or Zikula. The WYSIWYG editors include 3rd party filemanagement tools which can be loaded without using the scribite! framework for Zikula thus bypassing Zikula's security checks. If the upload folders are are writable, any user can upload files into these folders without permission check. Changing folder permissions to readonly will prevent this, but just to be sure, the editors should be deleted.

What next?

scribite! will continue supporting functions for TinyMCE, using version packaged from http://tinymce.moxiecode.com/download.php above without the file manager, but it's not included in scribite!. FCKeditor will be replaced with CKeditor (http://ckeditor.com/) in "scribite!" version 4.2 . "scribite!" 4.1 also supports gettext and has some important modifications in preparation for next Zikula version 1.3.0. A dedicated Zikula based file manager is being written that will take advantage of Zikula's in-built permissions system thus bypassing the the need for external filemanagers.

Links

• scribite! in ExtensionDB
• scribite! at Cozi