Dokeos 1.8.4 security patch 2

[ywarnier]

A new set of vulnerabilities has been found in Dokeos 1.8.4. These vulnerabilities have only been published on the Dokeos wiki so far and a mailing has been sent to administrators who registered their campus with us, providing them with the following patch.

The patch is available here: Dokeos 1.8.4 Security Patch 2

To install the patch, simply uncompress the zip file at the root of your Dokeos installation. It will replace existing vulnerable files and your campus will simply continue to work as usual.
This patch also includes the Dokeos 1.8.4 Security Patch 1, so if you haven't patched your portal since upgrading it to 1.8.4, we strongly recommend you apply SP2 (and only SP2) as soon as possible.

More information can be found on the Security page of our public wiki: http://www.dokeos.com/wiki/index.php/Security

These vulnerabilities have been reported by Digital Security Research Group. We would like to take this opportunity to thank them.

We would also like to take this opportunity to remind our friends at Claroline that they might suffer from the same vulnerabilities that are patched in Dokeos 1.8.4 by the SP2 zip file.