Admin Checklist

Type	Change
Security	the filters above the task list (category, recurring task, assigned user, checked) now only accept numbers, closing a hole where a crafted web address could reach the database
Security	importing a checklist now runs the imported titles and descriptions through the same text filter as the edit form, so a checklist file from someone else can no longer put scripts in your backend
Security	exporting a checklist now requires the same rights and confirmation as the other actions, and the file name is built from a cleaned site name
Security	reordering tasks now requires a confirmation token, so another website can no longer reorder your checklist behind your back
Security	importing a checklist now requires create and edit rights on the checklist
Security	category names and assigned user names are printed as plain text in the overview and in the categories module
Security	removed an unused helper that contained an unsafe database query
Security	the online checklist library now refuses a flood of requests from the same address, and its statistics page accepts its token through a header instead of the web address
Security	the helper plugin for update logging is only installed when the update server supplies a valid checksum for it, and only from the Joomill update server
Notes	5 6

Downloads: Admin Checklist