[Samson]

Just a heads up for anyone who is using Quicksilver Forums. Since the 1.4.0 release there have been three security updates that were needed.

The first two were corrected in version 1.4.1:

* Possibility of deleting PMs that don't belong to the user.
* Error reporting reveals database password info when a connection error is displayed.

The 3rd was just corrected in 1.4.2:

SQL injection (PoC code failed but there's definitely missing checks) ref: secunia-31419

While the proof of concept code for the injection error failed to operate, there were some missing sanity checks which were corrected and resolve the potential for exploitation.

All users of QSF are urged to upgrade at their earliest convenience.