Latest News

This patch fixes several issues in the v2.3.7 release and v2.3.7 patch #1, patch#2, and patch#3.  It also provides several tweaks and even some new features, though the main focus is providing several regression fixes.  It should be noted that the new optional 'Upgrade permissions' upgrade scripts will attempt to lock down the site by fixing file and folder permissions (except for cgi-bin) which means also turning off the 'execute' permission.   It must be noted that this patch (like the previous patches to v2.3.7) will break any custom text module view templates using in-place editing.  Unlike previous patches, this patch file also includes all the 'installation' files in the event you secured your site by deleting or renaming the /install folder. Patch #4 to v2.3.7 is found at http://sourceforge.net/projects/exponentcms/files/exponent-2.3.7-patch-4.zip/download​

(updated Jan 29th) After being out of service for quite some time, we have the Exponent CMS forums back up and running (forums.exponentcms.org) with a few caveats:

We've been notified of a security vulnerability which could compromise your Exponent CMS installation.  This vulnerability applies to all versions of Exponent 2.x up to v2.3.7 patch #2.  The immediate fix is to rename the /install folder to something else, or remove/delete it. Though we've been working hard to close Cross-Site Scripting (XSS) vulnerabilities, this one could be more permanent and seems to result from an anomaly within PHP which allows a string variable to be internally interpreted and processed as an array thereby masking the payload.

After a failed attempt to get something under the tree for Christmas, we now release v2.3.7 specifically to address the fatal flaws within the pulled v2.3.6 release.  These include: