It is unclear to me which versions of Tracks are vulnerable.

I have pulled the trunk today and noticed that recently rails 1.1.6 was quietly committed.  Are you going to put out a notification of some sort about previous versions shipping with vulnerable rails in vendor/?

Which versions should people be steering clear of?

Is there an official upgrade path from 1041 to something less ugly?

FWIW I had success simply swapping out 1041’s vendor/ for the one out of the trunk.

Bsag will post something to the project blogs soon, but here’s the scoop:

The trunk has moved to 1.1.6, which includes the fixes to the vulnerability. As you’ve no dount figured out, the trunk is at http://www.rousette.org.uk/svn/tracks-repos/trunk

I also patched 1.041 with the security patch released by Rais Core and checked this in as 1.042. The svn url for this new version is at http://www.rousette.org.uk/svn/tracks-repos/tags/tracks-1.042

Happy (and safe) GTDing!

I’ve zipped up 1.042 for download, and included upgrade instructions:

Tracks 1.042