Skip to main content ↑ ↓
ElkArte 1.0.8 - Release announcement Started by emanuele · · Read 20947 times 0 Members and 1 Guest are viewing this topic. previous topic - next topic

ElkArte 1.0.8 - Release announcement

update: after the release a couple of issues have been discovered:
1) the "who is online" page will not display correctly the ip addresses,
2) if using high level of caching, the menu may disappear.
the first is a mostly cosmetic bug, the second can be worked around by reducing temporarily the caching level. it's indeed sub-optimal, but better than a security hole i guess.
both are going to be addressed soon, an "unofficial" patch that fixes both is available as attachment to the following message:
http://www.elkarte.net/community/index.php?topic=3907.msg27726#msg27726
if you really need both fixed you can download the patch and install it, though it will be released "officially" in the next 24 hours with more fixes if needed.

sorry for the trouble.


today, we are pleased to release elkarte 1.0.8. this release fixes a security issue related to the unserialize php function (related to cve-2016-5726 and cve-2016-5727). the release fixes also some bugs that were found or reported since the release of 1.0.7. as this is a security release, it is extremely important to update for everyone running elkarte.
if you are running a version prior to 1.0.7, the recommended procedure is install any update since 1.0.7 and then the 1.0.8 patch.

apart from fixing the security issue, some notable updates in 1.0.8 include:
stopped using inet_aton and inet_ntoa to improve ipv6 handling,
 fixed youtube embedding urls to avoid problems in certain conditions,
* fixed editing of polls with expiration date,

this release follows our semantic version (major.minor.patch), meaning that third-point (x.x.x) releases should contain backwards-compatible bug fixes and enhancements, so for the most part you will not find new features in this release. major new features will be reserved for second point versions (x.x.x).

refer to the release notes on the forum for a complete list of updates.

patching procedure:
  • go to the page https://github.com/elkarte/elkarte/releases/tag/v1.0.8
  • download the file elkarte_1-0-8_patch.zip to your computer
  • go to your forum: admin > main > package manager > upload package
  • click the button to upload the package
  • locate and select the file you downloaded at point 2
  • click the "upload" button
  • follow the instructions on the screen.

for any question you may have, feel free to ask on the support forum.

of course you are encouraged to update to this release since it contains a lot of fixes and improvements, thank you for your continued support!
Last Edit: July 31, 2016, 04:39:24 pm by emanuele
bugs creator.
features destroyer.
template killer.

Re: ElkArte 1.0.8 - Release announcement

Reply #1 –

thanks for the release :thumbsup:

Re: ElkArte 1.0.8 - Release announcement

Reply #2 –

how's the openid bug coming? :d

Re: ElkArte 1.0.8 - Release announcement

Reply #3 –

finished updating to 1.0.8. thank you very much for this release.

i can also confirmed what @scripple just said above.

Re: ElkArte 1.0.8 - Release announcement

Reply #4 –

so should i update now or wait till the issue is fixed?

Re: ElkArte 1.0.8 - Release announcement

Reply #6 –

Quote from: Jason – so should i update now or wait till the issue is fixed?
if you value more an ip address than your forum security, wait.
if you can live with a couple of issues until they are fixed, install it.

i'm going to split the bug reports in their own topics, otherwise it becomes a mess. ;)

http://www.elkarte.net/community/index.php?topic=3907.0
http://www.elkarte.net/community/index.php?topic=3908.0
bugs creator.
features destroyer.
template killer.

Re: ElkArte 1.0.8 - Release announcement

Reply #7 –

posted an update to the first message, and posting it here as well for redundancy:
Quoteupdate: after the release a couple of issues have been discovered:
1) the "who is online" page will not display correctly the ip addresses,
2) if using high level of caching, the menu may disappear.
the first is a mostly cosmetic bug, the second can be worked around by reducing temporarily the caching level. it's indeed sub-optimal, but better than a security hole i guess.
both are going to be addressed soon, an "unofficial" patch that fixes both is available as attachment to the following message:
http://www.elkarte.net/community/index.php?topic=3907.msg27726#msg27726
if you really need both fixed you can download the patch and install it, though it will be released "officially" in the next 24 hours with more fixes if needed.

sorry for the trouble.
bugs creator.
features destroyer.
template killer.

Re: ElkArte 1.0.8 - Release announcement

Reply #8 –

Quote from: emanuele – posted an update to the first message, and posting it here as well for redundancy:
Quoteupdate: after the release a couple of issues have been discovered:
1) the "who is online" page will not display correctly the ip addresses,
2) if using high level of caching, the menu may disappear.
the first is a mostly cosmetic bug, the second can be worked around by reducing temporarily the caching level. it's indeed sub-optimal, but better than a security hole i guess.
both are going to be addressed soon, an "unofficial" patch that fixes both is available as attachment to the following message:
http://www.elkarte.net/community/index.php?topic=3907.msg27726#msg27726
if you really need both fixed you can download the patch and install it, though it will be released "officially" in the next 24 hours with more fixes if needed.

sorry for the trouble.

so has the 'official' fix been released yet?

Re: ElkArte 1.0.8 - Release announcement

Reply #9 –

considering the original patch was postponed by at least a couple of days i would be surprised if i were able to push it out in 24 hours... :p
that aside, i'm waiting to see if it's possible to fix another issue with the sessions in php 7 while we are at it.
bugs creator.
features destroyer.
template killer.

Re: ElkArte 1.0.8 - Release announcement

Reply #10 –

Quote from: emanuele – that aside, i'm waiting to see if it's possible to fix another issue with the sessions in php 7 while we are at it.
i am about to ask about this. my ea1.1b1 shows whitepage  on php7. ea1.0.8 works fine on php7 (at least i can see no errors so far).
 

Re: ElkArte 1.0.8 - Release announcement

Reply #11 –

bug reports? :p
bugs creator.
features destroyer.
template killer.

Re: ElkArte 1.0.8 - Release announcement

Reply #12 –

when trying to install the patch i get:


42.execute modification./sources/subs/scheduledtask.class.phptest failed


1.replace./sources/subs/scheduledtask.class.phptest successful
2.replace./sources/subs/scheduledtask.class.phptest failed
3.replace./sources/subs/scheduledtask.class.phptest successful
4.replace./sources/subs/scheduledtask.class.phptest successfu
and...




faceit-faceit100
execute modification./themes/faceit-faceit100/scripts/elk_jquery_embed.jstest failed
1.replace./themes/faceit-faceit100/scripts/elk_jquery_embed.jstest failed
2.replace./themes/faceit-faceit100/scripts/elk_jquery_embed.jstest successful

Re: ElkArte 1.0.8 - Release announcement

Reply #13 –

the one in the theme could be the theme itself is using an older version of the file that changed in the meantime and now is out-of-sync. i should check it.

the one about scheduledtask.class... could you attach it here?
bugs creator.
features destroyer.
template killer.

Re: ElkArte 1.0.8 - Release announcement

Reply #14 –

attached is the file.  i think it was modified a while back to fix a bug on the subscriptions task.