Jon - glad to hear, is there a way we can get some official notification of this - I think that module developers should do a quick review of their code to insure that they are not using the function in a way that could comprimise security, and the only way we're going to know about it, is via a bulletin - that's been an established API call for a long time, and you just never know the context in which it's going to be used in.

If I wasn't distracted today and went looking through the forums to find out if someone reported something else in regards to 3.3.3/4.3.3 - I know I would have blithly been ignorant of this issue, which could have caused issues - luckily, I'm just changing one function to make sure the door is slammed shut on this one.

Richard
DNN Modules

I sent an email with this thread to security@dotnetnuke.com just in case everyone thought everyone else was going to do it :)

I hope that we'll see some notification so that other third party developers can validate the proper operation of thier code considering that this issue is out there and third party modules are running under it already.