WARNING - Fleixcontent contains serious security issue

Thanks for pointing this out.

I agree with cden unfortunately. As great as flexicontent is (although it seems to be getting left behind these days as it isnt really active in development anymore whereas K2, Zoo and the rest are constantly being developed) - I also would recommend that flexicontent is not used until this secrity issue is resolved, or dropped from flexicontent in use of an alternative.

If you think that its too hasty to drop it just for one severe security risk then i guess you dont deem the safety and security of your website, its users and your data as important, where most others do (and if its a clients site that you are building which gets hacked, even worse).

I for one am able to delete the phpthumbs file. Others with basic knowledge (most people) cant do that and are therefore vulnerable even if not using that feature as its easy to tell when flexicontent is in use on a website, which means its easy to know the location of phpthumb and then perform the exploit.

I also agree that this should be added to the VEL for the time being, thats what its for and there are other extensions on that list with issues not as severe as this.

don wrote: I agree with cden unfortunately. As great as flexicontent is (although it seems to be getting left behind these days as it isnt really active in development anymore whereas K2, Zoo and the rest are constantly being developed)

unfortunately, i agree to. why developers didnt post any news, plans? all we can do is core hacking to add the things we want. in the end flexi will transform to half-dead elephant that working somehow...
i think what serious extension must have the same marketing. Its like stock exchange - bad news and people drop shares.
may be its time to learn from k2/zoo developers how they make profit instead of making side job?

hello
k2 and zoo aren't the same buissness modele ... flexicontent is totaly free ... and it's difficult to do this without develloppeur and sharing ...
actualiy we didn't have too much contrubution ... and manu can do anything but he have his to work ...
i understand your position ... if you have any idea !
regards

micker, solution is simple:

a) update component every 1-2 months. without it nobody will advertise component to friends and customers. there are some working solution already in issue tracker and forum.
i think somebody from developers may include they in next version of component and release it. why not?

b) zoo have interesting model - why dont copy it?
develop interesting fields and spread they via paid access. why not?

c) made paid access to fast_professional_answers on forum.
instead of current "somebody may answer your one day... or not"


micker, may you ask Emmanuel watch this thread?
he made big work and it will be sad if it will end like "another neglected project".

hello
actualy Manu want to have flexicontent for free ...
he have some project for big site, his client paid for specifique devellopper, after he share this feature for free ... it's a big work ... flexicontent is upgrade after this project type ...
actualy i didn't have any news, just when he finish his project he work to upgrade flexicontent ... but i didn't have date.(i test some new plugin and ultra module)
I think it's interesseting to created a bug squad devellopper to resolve the tracker in order to help manu to develloppe possibilty in priority.
Actualy for my experience flexicontent have less possibility then sebblock or k2 but his simplicity his better...
if you have any idea to upgrade community of devellopper i am interesting
regards

i hope the core team can respond the progress from latest development.. what are they doing right now..etc, let's make it more vibrant as community.. don't let flexicontent died... i begin to love it rather than k2...