Компонент Balbooa Forms

[_liberator_]

Balbooa Forms Pro 2.4.3.1​

*** Скрытый текст не может быть процитирован. ****** Скрытый текст не может быть процитирован. ***
*** Скрытый текст не может быть процитирован. ****** Скрытый текст не может быть процитирован. ***

Спойлер: Changelog

2.4.3.1 — 31.07.2026​

Added

• Strengthened authorization and validation for sensitive file operations.
• Improved security controls and validation for file uploads
• Added additional authorization checks for protected application actions
• Enhanced server-side validation of user input across multiple request handlers
• Implemented additional security safeguards to improve overall application security

2.4.3 — 28.07.2026​

Security Update

This release addresses a critical security vulnerability affecting the Signature field in previous Forms versions.

CVE: CVE-2026-65880

Security Fixes:

• Fixed improper handling of user-supplied data when processing Signature field submissions by enforcing an explicit server-side decoding method and strengthening validation of structured form input.

Affected Versions: 2.4.2.1 and earlier

Action Required:

• Update all installations running versions earlier than BA Forms 2.4.3.
• Enable CAPTCHA protection on publicly accessible forms to help reduce automated attacks.
• Review your website files for any unexpected or suspicious PHP files.

2.4.2.1 — 24.07.2026​

Fixed

• Form submission issue when HTML, CSS, and JavaScript minification was enabled.

2.4.2 — 16.07.2026​

Added

• Signature Storage Path option
• Signature files now receive randomly generated server-side filenames
• Generated submission PDF files now receive randomly generated server-side filenames

Fixed

• Form submission issue when Joomla caching was enabled

2.4.1 — 09.07.2026​

Security Update

This release addresses a security vulnerability affecting previous Forms versions

CVE: CVE-2026-56291

Security Fixes:

• Added server-side validation of allowed file extensions for frontend uploads based on the field configuration
• For the Upload File field, a new MIME Types option has been added to improve upload security
• Uploaded files now receive randomly generated server-side filenames instead of preserving client filenames
• Added CSRF protection to frontend file upload requests

Affected Versions: 2.4.0 and earlier

Action Required:

• Update to Forms 2.4.1 immediately
• Review the images/baforms/uploads/ directory, including all subdirectories, and remove any unexpected PHP files, as uploaded content directories should not contain executable PHP files

Спасибо, а кто не имеет такой возможности скачать - вот мой рабочий вариант (- проверено на Joomla 4 и 5, злоумышленники могут создавать файлы, но они не будут исполняться на сервере!), файл .htaccess которые необходимо добавить в директорию /images/baforms/uploads , его содержимое такое:

# ==============================================================================
# Gridbox Uploads Security Protection
# Location: components/com_gridbox/assets/uploads/.htaccess
# Purpose:
#   - prevent directory listing
#   - block script execution
#   - block hidden/config/backup files
#   - restrict access to dangerous file types
# ==============================================================================

# ------------------------------------------------------------------------------
# 1) Disable directory listing
# ------------------------------------------------------------------------------
Options -Indexes

# ------------------------------------------------------------------------------
# 2) Deny access to hidden files and folders
#    Examples: .htaccess, .env, .git, .svn, .DS_Store
# ------------------------------------------------------------------------------
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# ------------------------------------------------------------------------------
# 3) Block execution/access to script files
#    This is the main protection for uploads directory
# ------------------------------------------------------------------------------
<FilesMatch "\.(?ihp|phtml|php3|php4|php5|php7|php8|phar|pht|phps|shtml|cgi|pl|inc|asp|aspx|jsp|sh|py|rb)$">
    Require all denied
</FilesMatch>

# ------------------------------------------------------------------------------
# 4) Block potentially dangerous backup, config and log files
# ------------------------------------------------------------------------------
<FilesMatch "\.(?i:bak|old|save|swp|sql|sqlite|db|ini|conf|log|yml|yaml|env|dist|orig|tmp|temp)$">
    Require all denied
</FilesMatch>

# ------------------------------------------------------------------------------
# 5) Block archive files if they should never be served directly
#    Leave this block if uploads folder is not supposed to contain archives
# ------------------------------------------------------------------------------
<FilesMatch "\.(?i:zip|rar|7z|tar|gz|tgz|bz2|xz)$">
    Require all denied
</FilesMatch>

# ------------------------------------------------------------------------------
# 6) Disable PHP engine for Apache mod_php environments
#    Safe to leave here; ignored if PHP-FPM/CGI is used
# ------------------------------------------------------------------------------
<IfModule mod_php.c>
    php_flag engine off
</IfModule>

# ------------------------------------------------------------------------------
# 7) Remove PHP handlers and types where Apache allows it
# ------------------------------------------------------------------------------
<IfModule mod_mime.c>
    RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .php8 .phar .pht .phps
    RemoveType .php .phtml .php3 .php4 .php5 .php7 .php8 .phar .pht .phps
</IfModule>

# ------------------------------------------------------------------------------
# 8) Extra hardening: deny access to common sensitive file names
# ------------------------------------------------------------------------------
<FilesMatch "(?i:^(composer\.json|composer\.lock|package\.json|package-lock\.json|webpack\.config\.js|gulpfile\.js|\.user\.ini|php\.ini)$)">
    Require all denied
</FilesMatch>