Following up from the previous exploit, I have added some more lines to protect the submission system from script & iframe exploits. The exploit only affects elements which allow html elements to be posted. This is easily rectified by adding these two lines to the descript() function in fusion_core.php after line 353 approx:
That's all there is to it. Another stride towards making PHPFusion as secure as possible. You can get the latest fusion_core.php file from the service pack. The Sourceforge download has been updated to include this fix. Thanks.
