Subtext Security Issue and Patch

A member of the Subtext team discovered a security vulnerability due to our integration with the FCKEditor control as well as the FreeTextBox control. This vulnerability would potentially allow unauthenticated users to upload files using the file upload tools included with these editors. The Fix If you?re running the latest version of Subtext (Subtext 2.1.1) , the quickest way to patch your installation is to copy the following web.config file? < configuration > < system.web > < authorization > < allow roles ="Admins" /> < deny roles ="HostAdmins" /> < deny users ="*" /> </ authorization > </ system.web > </ configuration > ?to the following directories within...(read more) ...