Version 2.0.6 — security and compatibility update
Security fixes:
1. Fixed the possibility of deleting and reading arbitrary server files via a form attachment parameter (public handlers ajax.php, ajax_win.php, sendMessage.php)
2. Fixed insecure uploading of arbitrary file types and sizes via the attachment form; uploads are now limited to images and PDFs up to 5 MB, and the upload directory is protected from script execution
3. Debug output of incoming data removed from public handler responses (fixed reflected XSS)
4. Fixed open redirect in the attachment upload handler
5. Fixed unauthenticated public execution of the site installation script, which could delete and overwrite content; access is now restricted to module administrator rights
6. Fixed stored XSS in templates for displaying section names, items, and descriptions of the price list and program selection
7. E-mail for notifications is now taken from the current site settings, not from the request parameter
Encoding and compatibility:
8. All text files of the module have been converted to UTF-8 without BOM (the site must be in UTF-8 encoding; the module does not perform automatic re-encoding of site content or the database)
9. Short PHP tags (the opening angle bracket followed by a question mark) have been replaced with full tags (the opening angle bracket followed by question mark and php) to ensure correct operation when the short_open_tag directive is disabled in PHP 8
10. The information block event handler has been renamed and updated for PHP 8.2 (potential duplicate class declaration has been eliminated)
After the update:
The module updater transfers fixes to files previously copied by the master to the website (the template and sendMessage.php). If these files were manually modified by an administrator, they are not overwritten; the transfer report is saved in /bitrix/updates/atwebsite.1clanding_2.0.6_backup/, and such files must be checked and updated manually.