Important Security: Search option exposes account login data

NEVERMIND: I found the code block nested within a div, in the following file:

component\kunena\template\...\html\search\default.php

If anyone needs the same modification, just search for the COM_KUNENA_SEARCH_SEARCHBY_USER language variable and you'll find the code segment to delete (look for the opening and closing DIV tags).

Winuser wrote: Your reasoning that there is no security issue because only MEMBERS can access another member's login credentials is absurd.

Login Name vs. Display Name <<<---This is the reality that you keep denying. SMF, for instance, fully supported this distinction; but it didn't allow security lapses. If the forum was configured to publish display names, then no member would ever see the login name of another member.

I know full well that Kunena's problems trace back to Fireboard. If after several posts you still don't get the fundamental problem here, then I can only wait for another user to explain it better, because obviously I have not.

We do no consider the view ability of login names instead of a display name as a security vulnerability. I can agree this could be a security issue, but limited to scope based on the purpose and reason of individual websites where seeing login name could have consequences (even in closed environment controlled by account registration). There is no such concept as display name in Joomla, as such Kunena does not provide this configuration ability out of the box. I myself have proposed to offer a display name alternative (especially where names would be temporary like on a gaming community). Really this is a feature request, and will be considered as such. This is an issue with Joomla as a whole and not specific to Kunena. And no I am not pointing fingers, Joomla or Kunena can both offer a solution, but this improvement would make more sense coming from Joomla to be consistent across other components. As such I do not think that its fair to point this as a Kunena software "problem". The software works as intended with the thought out intention of working closer to Joomla.

Just a side note: the search bug (showing wrong field) was fixed about two weeks ago, so it is already in the latest K3.0 beta release.

Ok, but when users contribute bug reports and issues on series 2.x.x, your fixes should (also) be available on a series 2.x.x. update.

Series 3 is in beta, and I am assuming there is no pure template compatibility from 2 to 3. Is this correct?

More to the point, K3.0 beta is functionally meaningless for the present time because it's BETA. After upgrading to series 2 earlier this year, I then had to pay for a premium template--because we all know Kunena's template options are seriously lacking. You guys may be ready for K3.0, but have you considered the larger community?

Don't forget series 2 too quickly. This all reminds me of the Windows 8 release when everyone was quite happy and productive with Windows 7.

Winuser wrote: Ok, but when users contribute bug reports and issues on series 2.x.x, your fixes should (also) be available on a series 2.x.x. update.

Series 3 is in beta, and I am assuming there is no pure template compatibility from 2 to 3. Is this correct?

Hello,

In Kunena 3.0 we had removed Joomla! 1.5 support and the others things are just bug fixes, so there is no big differences between Kunena 2.0 and 3.0, the database schema is the same between two versions...

On Kunena 3.0 you can install templates from Kunena 2.0, there will be no differences with third party templates on Kunena 3.0 and during Kunena 3.0 developpement we have checked to keep compatbility with Kunena 2.0 templates.

Winuser wrote: Don't forget series 2 too quickly. This all reminds me of the Windows 8 release when everyone was quite happy and productive with Windows 7.

That's is uncomparable we haven't changed completly the UI, like it has been done in Windows 8

Winuser wrote: Ok, but when users contribute bug reports and issues on series 2.x.x, your fixes should (also) be available on a series 2.x.x. update.

Series 3 is in beta, and I am assuming there is no pure template compatibility from 2 to 3. Is this correct?

More to the point, K3.0 beta is functionally meaningless for the present time because it's BETA. After upgrading to series 2 earlier this year, I then had to pay for a premium template--because we all know Kunena's template options are seriously lacking. You guys may be ready for K3.0, but have you considered the larger community?

Don't forget series 2 too quickly. This all reminds me of the Windows 8 release when everyone was quite happy and productive with Windows 7.

You are welcome to contribute your technical skills on GitHub.

Unfortunately currently we don't have enough resources to maintain two versions at the same time, which basically means that there will not be updates on Kunena 2.0 series anymore (official Joomla! 1.5 support was dropped a few months ago with the 2.0.4 release).

We are going to release Kunena 3.0.0 RC1 today and in about a week the stable version. Kunena 3.0 should be 99% backwards compatible with Kunena 2.0, which means that most templates, modules and plug-ins should work out of the box as long as they support the Joomla! version you're running on.

Help us to ensure that there are no bugs to prevent you from upgrading when we release the stable version. You can do that by making a copy of your site to another sub-domain, upgrade Kunena (only) and play with it.

Winuser wrote: Don't forget series 2 too quickly.

I'm looking forward to forgetting about K 2.0 as quickly as possible and moving forward with K 3.0! :woohoo: