August 2008
Site Integrator: Legacy Mode in Joomla! 1.5
What is Legacy Mode and how do you using it?
Written by Andrew Eddie
The Legacy Mode is implemented in Joomla! 1.5 by way of a Plugin (remember, Plugins are the new Mambots) in the System group.
In the Administrator select Extensions -> Plugin Manager from the menu. The fastest way to find it is simply to type legacy in the Filter box and click Go.
By default the Legacy Mode Plugin will not be enabled. Click the red-and-white X to enabled it. You will see in the Toolbar a message stating that Joomla! is now in Legacy Mode.
You actually have to turn Legacy Mode on to be able to install a Joomla! 1.0 Extension. The installer does a version check and if your Extension doesn't have a marker saying it's compatible with version 1.5, it will complain and tell you to turn Legacy Mode on.
2008-10-21 04:30:04
2008-10-21 04:58:51
2008-10-21 05:00:10
If anything it only shows that both 3PD developers and the Core team are not on the same level as well as the JSST is purely commenting on the actual issues (or not and patching them) and dismissing all else with the god ol delete button. Personally as a member of the Joomla! community i find it disheartening that both parties have had a failure in communication and this has escalated into what could end up damaging both parties reputation.
2008-10-21 05:00:41
on a side note, the limitation on comments size sucks too
2008-10-21 05:18:01
Security by Obscurity IS NOT security. We know and hold to this belief. If you have found a security issue with Joomla, please report it so it can be patched.
Doing so is playing your part in the community.
Thanks.
2008-10-21 06:07:39
2008-10-21 07:05:45
Will there really come anything good out of openly criticizing one another on your respective blogs like this? While one or both parties may be right in their argumentation, I just think that this is the wrong way to handle things.
If someone posts a security vulnerability on their blog, contrary to security vulnerability routines, it still will not help anyone to bash one another in public.
2008-10-21 07:22:38
This patch was in the Joomla! 1.5.8 TODO-list, but they didn't know it and so they acted this way?
Sounds a bit grotesque
2008-10-21 08:37:15
2008-10-21 08:38:42
2008-10-21 08:56:07
Sami Mattila
2008-10-21 09:16:37
Anthon has done all users a great service by clearly explaining the issues and I like to thank him for it.
Keep up the good work and users like me ( from all the way in Singapore !) appreciate it a lot.
2008-10-21 11:50:24
2008-10-21 12:44:59
2008-10-21 13:35:28
Surely everyone in the Joomla community wants essentially the same thing: Joomla being as good as it can be and secure too?
I can't see that having people "shouting" at each other and being kicked off the project for publishing details of a security problem really helps the community that much.
I suppose it sends a strong message to everyone not to do that but it sounds like they thought that there was a breakdown of communication. This sounds to me like rapped knuckles rather than being cast into the pit.
Nick
2008-10-21 21:00:55
If at this point someone from the JOOMLA core team finds their approach objectionable, wrong or out of place, then the decent way of dealing with this is to say something like: 'Guys, thanks for the blog on your site, but you know what, the issue you raise is being dealt with by the core team in this, that or the other manner, so please update your blog accordingly'
But the last thing I would expect is a the public flaming the *company* is subjected to, which now is displayed on the FRONT page of the JOOMLA site for ANYone to see. Quite apart from the reputation of the company what really takes a KNOCK here is the reputation of JOOMLA.
Nik C
2008-10-22 02:23:07
The TinyMCE editor has its own filtering built into its plugin. You can set prohibited elements and extended valid elements. This is the only filtering of html in content that was in place prior to the inclusion of the filter in the content parameters. By default it only blocks applet.
end part 1
2008-10-22 02:24:18
The filter feature in question is an added functionality that allows you to make the restriction of html more finely grained than that available via many editors, such as TinyMCE. For example, it allows you to allow
superadmins to include certain tags while preventing other users from doing so.
More importantly if you have an editor that does not have filtering options (such as xStandard Lite plugin included in the core) or if you choose to use no editor the filter feature allows you to impose either a black list or a white list for html tags or to allow no html at all. Without the filter, all tags are allowed in those editors.
Removing the filter options would take you back to the state of having no filtering options. The proposed fix, which is to set an unchangable white list with no list of allowed tags, would mean that users can't use such harmless tags as , and even inside their wysiwyg editors. So the proposed fix would radically change functionality on everyone's sites.
end part 2
2008-10-22 02:25:25
In making changes, the bug squad strives not to break existing sites or change functionality that people are used to. Therefore by default the new filter was set to leave the editors functioning as they did in earlier 1.5 releases. We do realize the need for SOME default filtering, and will be adjusting the defaults accordingly in 1.5.8, but leaving the configuration option.
.....
the harmless tags in part 2 are :
p, strong and ul (for three simple examples)
2008-10-22 02:34:11
Thats all that needed to be said, someone like yourself taking the time filling in the blanks and assuring the community that a future fix would be put into place, not this pointless attack.. we 'the community' happen to pride ourselves on being one of the friendliest and supportive in the open source world
2008-10-22 03:09:39
2008-10-22 08:32:23
To me, and I assume a lot of other members of the community comments like this...
"Generally speaking, people in the community are highly supportive of the Project. Unfortunately, this company isn't one of them (and on multiple occasions this has shown to be true)."
...make it look like there's more history to this than just this issue.
This isn't professional. Sort it out.
2008-10-22 10:34:15
2008-10-22 20:21:18
2008-10-23 08:00:08
But after reading this blog I am having second thoughts.
2008-10-23 15:59:37
2008-10-24 09:56:22
You want to always apply patches, but always check them first... hmmm... so you seem to know which areas of Joomla need to be tested, no matter which patch you get? Or do you check every part of Joomla? Wouldn't it be better to let those people check and create the patch who *know* the insides of Joomla? Well, it's up to you what you do with your system.
You say the Joomla team made the patch a least priority thing... where did you get that information from? I read it like "we didn't see the issue as a crisis". See the difference?
I don't know how Joomla discussed the issue with the 3PD - you?
Joomla is "owned" by the core team. The Joomla community gives input to the core team. The core team listens to the community. So, if people of the community don't like the directions where the core team os going, we can discuss it, or we can try to become a core team member. But becoming a member always means that you have to stick to the policies. You can try to change policies, but don't try it with anger...
2008-10-24 10:17:36
Maybe that does not like us, but the 'evil' company has the legal right to release the patch without prior notification to the core team.
Just in case somebody worries for "security" more than for freedom:
2008-10-24 13:28:29
The last two releases of Joomla!, 1.5.6 and 1.5.7 were both security releases. In the case of 1.5.6 it was a critical issue and the release happened within a few hours of the report. In the case of 1.5.7 the vulnerabilities were not critical and thus the release was speeded up but it was not an emergency release. That allowed careful analysis and testing.
Often, as in this case, security reports come in with proposed fixes that would be much more harmful to working sites than the risks associated with the vulnerability. When the risk is not critical we are able to do much more extensive and thorough testing of any fixes. As the reporters themselves say, they did not test their patch on any working sites and did not understand the implications of what they proposed. If they had simply suggested to users that they change the settings from the default to something more secure that would have been appropriate.
end part 1
2008-10-24 13:29:16
In general, a calm, careful and systematic approach to hypothetical vulnerabilities will always work best. We understand that sometimes people panic, which seems to be what happened here, but our processes are designed to put panic aside and proceed in an orderly fashion. The reporters know our processes and were aware that they were being followed in this instance. I am sure that they are happy we did not rush their patch since they realized after our review that their patch was potentially harmful to sites.
Most people in the world of open source software think that Karl Fogel's book contains excellent advice about how to manage an open source project. I would strongly encourage everyone to read his advice about managing security issues.
http://producingoss.com/en/publicity.html#security
We follow those practices.
2008-10-24 14:09:07
First let's say I am not a developer so I have to congratulate the Joomla team for the hard work.
But... I am a Joomla user and 3 of my Joomla sites have been hacked in three different ways in the last two weeks, all of them being updated (J 1.5.7).
So for me, NO vulnerability is not high priority and I can not understand that 1.5.8 is not out with a fix as a vulnerability is known and a fix committed.
Personnally, I can not blame anyone to point out a vulnerability and try to fix it AS SOON AS POSSIBLE.
Both parties should maybe think twice...
- the 3PD should have followed the rules and should not have made it public
- the Joomla team should never consider a vulnerability a not high priority...
I am personnally waiting for 1.5.8 to reinstall my websites being bored to be hacked.
PS: All hacking were related to public registered on the site but with no rights...
2008-10-24 17:30:51
It would be my inclination to not publish Alex's comment and simply ask that he talk to the Security Team, but Anthony Ferrara has asked that we continue to publish all comments on this topic and allow people to speak their mind. Since there is no specific vulnerability mentioned, we will allow it.
2008-10-24 17:53:17
I'm surprised that the people in the core team shun people who work on the code. This is disappointing to any developer.
At the least, instead of making a public post which by many ways is disrespectful, you could have simply settled this issue over emails and made an announcement that the recent vulnerability was not very critical and it would be fixed in the next release. If you were so concerned about your users, you should have posted a general warning (instead of targeting) to users against installing patches released by 3rd party guys.
Bottom-line: Fix the issue instead of blaming someone for publicizing it. If the time and energy spent on flaming in this post was spent on fixing the security issue, I'm sure it would have been solved!
2008-10-24 18:01:47
What Web sites are vulnerable?
a) Those without text filtering activated;
b) With unknown authors (who cannot be trusted);
c) Where an author wants to intentionally cause harm;
d) And knows how to so;
e) And has access to the server.
How can you protect yourself?
Activate Text Filtering that has been available in core since Joomla! 1.5.2
How do you do learn how to do this?
a. Read the Help Screen for the Article Manager (search for text filter)
b. Follow these instructions: http://docs.joomla.org/Security_filters_for_articles
You do not need a patch or a new release
Everything you need is available in the Article Configuration Utility
What will be different in Joomla! 1.5.8?
The default setting will enable filtering for new Web sites. (Of course, this can be changed, as desired.)
2008-10-24 23:19:17
2008-10-25 05:18:58
2008-10-26 05:18:58
It's also my belief that the action that solicited this response was childish self promotion.
fwiw
2008-10-27 16:34:03
2008-10-29 03:31:35
I thing you should redirect your rage to the hackers who are becoming "famous" for crashing joomla websites ... not to the guys helping to stop it.
2008-10-30 17:14:29