CVE-2016-8869: Improper Input Validation (CWE-20)
value: The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 9.8
Published: 2016-11-04T21:59Z
Repository: https://github.com/joomla/joomla-cms
Language: PHP
Files changed: administrator/manifests/files/joomla.xml, components/com_users/controllers/user.php, libraries/cms/version/version.php
Commit date: 2016-10-25 16:31:06 +0200
Commit message: Prepare 3.6.4 Stable Release

Diff: diff --git a/administrator/manifests/files/joomla.xml b/administrator/manifests/files/joomla.xml
index 096b20e801..f981c41286 100644
--- a/administrator/manifests/files/joomla.xml
+++ b/administrator/manifests/files/joomla.xml
@@ -4,11 +4,11 @@
 	<author>Joomla! Project</author>
 	<authorEmail>admin@joomla.org</authorEmail>
 	<authorUrl>www.joomla.org</authorUrl>
 	<copyright>(C) 2005 - 2016 Open Source Matters. All rights reserved</copyright>
 	<license>GNU General Public License version 2 or later; see LICENSE.txt</license>
-	<version>3.6.4-dev</version>
+	<version>3.6.4</version>
 	<creationDate>October 2016</creationDate>
 	<description>FILES_JOOMLA_XML_DESCRIPTION</description>
 
 	<scriptfile>administrator/components/com_admin/script.php</scriptfile>
 
diff --git a/components/com_users/controllers/user.php b/components/com_users/controllers/user.php
index 15e2d6a5ed..3a53bc73fc 100644
--- a/components/com_users/controllers/user.php
+++ b/components/com_users/controllers/user.php
@@ -281,91 +281,10 @@ class UsersControllerUser extends UsersController
 
 		// Logout and redirect
 		$this->setRedirect('index.php?option=com_users&task=user.logout&' . JSession::getFormToken() . '=1&return=' . base64_encode($url));
 	}
 
-	/**
-	 * Method to register a user.
-	 *
-	 * @return  boolean
-	 *
-	 * @since   1.6
-	 */
-	public function register()
-	{
-		JSession::checkToken('post') or jexit(JText::_('JINVALID_TOKEN'));
-
-		// Get the application
-		$app = JFactory::getApplication();
-
-		// Get the form data.
-		$data = $this->input->post->get('user', array(), 'array');
-
-		// Get the model and validate the data.
-		$model  = $this->getModel('Registration', 'UsersModel');
-
-		$form = $model->getForm();
-
-		if (!$form)
-		{
-			JError::raiseError(500, $model->getError());
-
-			return false;
-		}
-
-		$return = $model->validate($form, $data);
-
-		// Check for errors.
-		if ($return === false)
-		{
-			// Get the validation messages.
-			$errors = $model->getErrors();
-
-			// Push up to three validation messages out to the user.
-			for ($i = 0, $n = count($errors); $i < $n && $i < 3; $i++)
-			{
-				if ($errors[$i] instanceof Exception)
-				{
-					$app->enqueueMessage($errors[$i]->getMessage(), 'notice');
-
-					continue;
-				}
-
-				$app->enqueueMessage($errors[$i], 'notice');
-			}
-
-			// Save the data in the session.
-			$app->setUserState('users.registration.form.data', $data);
-
-			// Redirect back to the registration form.
-			$this->setRedirect('index.php?option=com_users&view=registration');
-
-			return false;
-		}
-
-		// Finish the registration.
-		$return = $model->register($data);
-
-		// Check for errors.
-		if ($return === false)
-		{
-			// Save the data in the session.
-			$app->setUserState('users.registration.form.data', $data);
-
-			// Redirect back to the registration form.
-			$message = JText::sprintf('COM_USERS_REGISTRATION_SAVE_FAILED', $model->getError());
-			$this->setRedirect('index.php?option=com_users&view=registration', $message, 'error');
-
-			return false;
-		}
-
-		// Flush the data from the session.
-		$app->setUserState('users.registration.form.data', null);
-
-		return true;
-	}
-
 	/**
 	 * Method to login a user.
 	 *
 	 * @return  boolean
 	 *
diff --git a/libraries/cms/version/version.php b/libraries/cms/version/version.php
index e72cbf8094..701408f556 100644
--- a/libraries/cms/version/version.php
+++ b/libraries/cms/version/version.php
@@ -36,19 +36,19 @@ final class JVersion
 	 * Maintenance version.
 	 *
 	 * @var    string
 	 * @since  3.5
 	 */
-	const DEV_LEVEL = '4-dev';
+	const DEV_LEVEL = '4';
 
 	/**
 	 * Development status.
 	 *
 	 * @var    string
 	 * @since  3.5
 	 */
-	const DEV_STATUS = 'Development';
+	const DEV_STATUS = 'Stable';
 
 	/**
 	 * Build number.
 	 *
 	 * @var    string
@@ -68,19 +68,19 @@ final class JVersion
 	 * Release date.
 	 *
 	 * @var    string
 	 * @since  3.5
 	 */
-	const RELDATE = '18-October-2016';
+	const RELDATE = '21-October-2016';
 
 	/**
 	 * Release time.
 	 *
 	 * @var    string
 	 * @since  3.5
 	 */
-	const RELTIME = '16:37';
+	const RELTIME = '16:33';
 
 	/**
 	 * Release timezone.
 	 *
 	 * @var    string

Vulnerable code: 	<version>3.6.4-dev</version>
	/**
	 * Method to register a user.
	 *
	 * @return  boolean
	 *
	 * @since   1.6
	 */
	public function register()
	{
		JSession::checkToken('post') or jexit(JText::_('JINVALID_TOKEN'));

		// Get the application
		$app = JFactory::getApplication();

		// Get the form data.
		$data = $this->input->post->get('user', array(), 'array');

		// Get the model and validate the data.
		$model  = $this->getModel('Registration', 'UsersModel');

		$form = $model->getForm();

		if (!$form)
		{
			JError::raiseError(500, $model->getError());

			return false;
		}

		$return = $model->validate($form, $data);

		// Check for errors.
		if ($return === false)
		{
			// Get the validation messages.
			$errors = $model->getErrors();

			// Push up to three validation messages out to the user.
			for ($i = 0, $n = count($errors); $i < $n && $i < 3; $i++)
			{
				if ($errors[$i] instanceof Exception)
				{
					$app->enqueueMessage($errors[$i]->getMessage(), 'notice');

					continue;
				}

				$app->enqueueMessage($errors[$i], 'notice');
			}

			// Save the data in the session.
			$app->setUserState('users.registration.form.data', $data);

			// Redirect back to the registration form.
			$this->setRedirect('index.php?option=com_users&view=registration');

			return false;
		}

		// Finish the registration.
		$return = $model->register($data);

		// Check for errors.
		if ($return === false)
		{
			// Save the data in the session.
			$app->setUserState('users.registration.form.data', $data);

			// Redirect back to the registration form.
			$message = JText::sprintf('COM_USERS_REGISTRATION_SAVE_FAILED', $model->getError());
			$this->setRedirect('index.php?option=com_users&view=registration', $message, 'error');

			return false;
		}

		// Flush the data from the session.
		$app->setUserState('users.registration.form.data', null);

		return true;
	}

	const DEV_LEVEL = '4-dev';
	const DEV_STATUS = 'Development';
	const RELDATE = '18-October-2016';
	const RELTIME = '16:37';
Fixed code: 	<version>3.6.4</version>
	const DEV_LEVEL = '4';
	const DEV_STATUS = 'Stable';
	const RELDATE = '21-October-2016';
	const RELTIME = '16:33';