CodeClimber

After a long period of development, the new major release of FCKEditor has shipped. The most notable change is the new name: it went from FCKEditor, which many people didn’t like because of its similarity to an English bad word (it was made by the initials of the project founder, Frederico Caldeira Knabben) to CKEditor where CK stands for “content & knowledge”. But obviously this is not the only change: it’s amazingly fast, it has a completely new UI, no more popup but only js modal dialogs, produces valid XHTML code (and hopefully it will not screw-up the...

While I was leaving for Barcelona to visit a friend and to enjoy Les Festes de la Mercè, a user of Subtext found a security problem in our integration with the WYSIWYG editor FCKeditor. And only one day after it has been discovered Phil released a security patch that fixes the problem. The vulnerability allowed a user to upload files in the images folder of a blog without being authenticated. To secure your installation of Subtext just download the secured version of the FCKeditor provider dll, or, as workaround, remove the following folder: Providers\BlogEntryEditor\FCKeditor\editor\filemanager Technorati tags: FCKeditor, Subtext, security patch