Security release: CiviCRM 4.7.26 and 4.6.33. Monthly release 4.7.27

Közzétéve

2017-11-01 11:34

Written by

CiviCRM 4.7.26, 4.6.33 and 4.7.27

Please note that 4.6.33, 4.7.26, and 4.7.27 are security releases. All releases include the latest security fixes, and 4.7.27 includes additional bug fixes and enhancements (as a typical monthly release).

Please see below links to the security advisories:

CIVI-SA-2017-08 XSS in HTML link attributes
CIVI-SA-2017-09 Shell injection vulnerability in smarty
CIVI-SA-2017-10 XSS scripting in premium product name
CIVI-SA-2017-11 XSS in dedupe rules
CIVI-SA-2017-12 XSS in tag descrption
CIVI-SA-2017-13 Selectedchild URL parameter not properly validated for CiviCRM message templates
CIVI-SA-2017-14 XSS in search criteria description
CIVI-SA-2017-15 Extension key not properly validated when adding or disabling or uninstalling extension
CIVI-SA-2017-16 SQL injection risk in CiviReports listing

RELEASE NOTES:

Big thanks to Andrew Hunt from AGH Strategies for putting up together release notes for this version.

The release notes for 4.7.27 can be accessed here

The November 1 release is a bit special in providing 4.6.33, 4.7.26, and 4.7.27 concurrently. As always, you can download the highest version from https://civicrm.org/download. For the intermediate 4.7.26 release, go to the historical archives.

SPECIAL THANKS:

Complete list of 4.7 contributors can be found here.

WHAT'S NEW IN CIVICRM 4.7.27

Core CiviCRM updates:

Adding the ability to add icons to menu items. More details.

Convert civicrm_subscription_history.date to timestamp from datetime for new installs. More details.

Allow Inline View of Files Instead of Download. More details.

Provide option to filter by contact id & external id. More details.

CiviCampaign

Survey detail report lacks date options, more details.

CiviCase

Activity API - fetch case details. More details.

find cases: search by case ID and subject. More details.

CiviEvent

Make event_type_id available in event message templates. More details.

CiviMember

Make contact custom fields available in Membership Detail report. More details.

And many other bug fixes and improvements!

NEW INSTALLATIONS

If you are installing CiviCRM 4.7 from scratch, please use the corresponding automated installer instructions:

Install CiviCRM 4.7 on Backdrop

Install CiviCRM 4.7 on Drupal 7

Install CiviCRM 4.7 on Joomla

Install CiviCRM 4.7 on Wordpress

Authorize.net users:: Prior to 4.7, CiviCRM forced Authorize.net to send out receipt emails regardless of Authorize.net configuration. From 4.7 onwards this will not happen and you should log into your Authorize.net interface and configure whether you want Authorize.net to send out receipts (in addition to those sent by CiviCRM).

Lybunt report users:: Some fields that were previously mandatory on Lybunt are now optional. On new reports they are on by default but you might need to check the fields you want are selected for existing reports.

UPGRADING TO 4.7

If your site is highly customized with special code or theming for CiviCRM you will want to upgrade a test copy first and test your customizations. For everyone else, follow these simple steps to get yourself up and running with 4.7.

Upgrade Drupal Sites to 4.7

Upgrade Joomla Sites to 4.7

Upgrade WordPress Sites to 4.7

Filed under

Release announcements

Security Releases