XOOPS 2.0.13 Security Release - XOOPS - XOOPS News

XOOPS

News

News World of XOOPS Developers Hacks Themes Archive Submit News

XOOPS: XOOPS 2.0.13 Security Release

Posted by: MithrandirOn 2005/7/2 9:44:55 15264 reads

Earlier this week, I had some conversations with James from GulfTech Research and Development about a security hole in the XML-RPC interface.

We worked together on finding a solution and also found one - but unfortunately it was not a universal solution, which we now correct with XOOPS 2.0.13 that also solves some other sanitation issues where the server's magic_quotes_gpc settings was not taken correctly into consideration.

Everyone is urged to upgrade to 2.0.13 at earliest convenience and the XOOPS Core Development team apologizes for the high frequency of updates this week.

Upgrade Instructions
1. Download Patch
2. Extract Patch
3. Upload Patch files (four files) to webserver
4. That's it - no need to update System Module for this one

XOOPS 2.0.13 Stable
.zip | tarball
XOOPS 2.0.12a to 2.0.13 patch
.zip | tarball

The comments are owned by the author. We aren't responsible for their content.

Re: XOOPS 2.0.13 Security Release

smdcom Published 07/02/2005 10:10 Joined 04/27/2004 Comments 901

wow.. another quick release... thanks Mith.

Re: XOOPS 2.0.13 Security Release

davidl2 Published 07/02/2005 10:12 XOOPS is my life! Joined 05/26/2003 Comments 4843

I would rather see frequent releases, than have security problems.

Good work Mith and all concerned.

Re: XOOPS 2.0.13 Security Release

dashbord Published 07/02/2005 10:28 Updated 07/02/2005 10:51 Just popping in Joined 04/19/2004 Comments 39

Thanks Mithrandir,

I update 2.0.12a and it works fine with xlanguage2.0.

But 2.0.13, unfortunately it doesn't work with xlanguage2.0.

Re: XOOPS 2.0.13 Security Release

Daz_Al Published 07/02/2005 10:41 Just popping in Joined 10/31/2004 Comments 10

Hi, after waiting to see what happens after a few probs with these patches, it seems I have missed the boat lol. I can't seem to download the 2.0.12a patch, the site just times out with an error. I am still on 2.0.10 what do is the process for getting from 2.0.10 to 2.0.13 I am lost lol. Cheers any help would be appreciated.

Re: XOOPS 2.0.13 Security Release

Mithrandir Published 07/02/2005 10:43 XOOPS is my life! Joined 06/21/2003 Comments 6320

You can get 2.0.10-to-2.0.12a directly from SourceForge:
http://prdownloads.sourceforge.net/xoops/Xoops-2.0.10-to-2.0.12a.zip?download

Re: XOOPS 2.0.13 Security Release

Daz_Al Published 07/02/2005 10:44 Just popping in Joined 10/31/2004 Comments 10

Thanx Mith.

Re: XOOPS 2.0.13 Security Release

Horatio Published 07/02/2005 11:03 Just popping in Joined 07/02/2005 Comments 13

I am also still at 2.0.10 and waiting for the 2.2 release. Will there be an upgrade package for 2.0.10 or only from 2.0.13 (or later?).

It's such a fuzz updating five sites...

Re: XOOPS 2.0.13 Security Release

teibaz Published 07/02/2005 11:15 Not too shy to talk Joined 06/13/2004 Comments 103

i'm still waiting 2.2, but tried several versions with 'new' install on my localhost. Interesting: is 2.2 will late a lot?

Re: XOOPS 2.0.13 Security Release

Mithrandir Published 07/02/2005 11:26 XOOPS is my life! Joined 06/21/2003 Comments 6320

XOOPS 2.2 is on schedule for a release next Sunday (July 10th)

The more people testing the current CVS Nightly (except the PM module which is still in development) the higher the chance of the on-time release

Re: XOOPS 2.0.13 Security Release

Mithrandir Published 07/02/2005 11:27 XOOPS is my life! Joined 06/21/2003 Comments 6320

Quote:

Will there be an upgrade package for 2.0.10 or only from 2.0.13 (or later?).

It's such a fuzz updating five sites...

You will be able to upgrade directly from 2.0.10 to 2.2 - however, an actual upgrade package might be somewhat difficult, or at least extensive.

In any case, you will be able to apply the full 2.2 package on a 2.0.10 (or later) installation and upgrade. So now's the time to note down those changes to the core, you may have made.

Re: XOOPS 2.0.13 Security Release

Horatio Published 07/02/2005 11:45 Just popping in Joined 07/02/2005 Comments 13

Looool, I can't remember, so probably I will find out all the things again in 2.2 and change them... Smart idea to document them, however...

Re: XOOPS 2.0.13 Security Release

Gambero[removed] Published 07/02/2005 12:32 Quite a regular Joined 01/13/2005 Comments 393

Upgraded without problems. Good work.

Re: XOOPS 2.0.13 Security Release

Jan304 Published 07/02/2005 12:59 Official Support Member Joined 03/31/2002 Comments 520

I just noticed that a lot of files that are updated have a empty line at the end of the file, wich will result in php sending headers and wich will eventuelly result errors.

Example of files: class/criteria.php and include/checklogin.php. I downloaded the tar.gz packages. Please fix this.

Re: XOOPS 2.0.13 Security Release

skara Published 07/02/2005 13:40 Friend of XOOPS Joined 09/24/2004 Comments 84

How to upgrade from 2.0.9.3 to 2.0.13?
any easy way?

Re: XOOPS 2.0.13 Security Release

indream Published 07/02/2005 14:05 Not too shy to talk Joined 09/21/2004 Comments 170

good and without problems work.
thanks.

Re: XOOPS 2.0.13 Security Release

Lance_ Published 07/02/2005 14:11 Home away from home Joined 01/12/2004 Comments 983

To be on the safe side of upgrades, always do incremental upgrades.

Look at all the upgrade packages available and upgrade per the logical numbering system.

If you are certain the upgrade does not have any Database modifications, then uploading the latest version full package and updating your System will do.

Re: XOOPS 2.0.13 Security Release

Shine Published 07/02/2005 14:18 Just can't stay away Joined 07/22/2002 Comments 822

Since there are no Database changes since XOOPS 2.0.9.3 you can download the whole full latest STABLE XOOPS version and upload them to your server. (overwrite the excisting files with the exception of your mainfile.php !!!!!)
Upgrade admin/modules/system and to be sure everything will do alright all your modules.
grtz., Shine

Re: XOOPS 2.0.13 Security Release

Defkon1 Published 07/02/2005 14:24 Not too shy to talk Joined 01/27/2005 Comments 151

all systems go with 2.0.13...

thx!

Re: XOOPS 2.0.13 Security Release

JimLunsford Published 07/02/2005 14:34 Not too shy to talk Joined 10/26/2004 Comments 191

5 sites updated with no problems. Thanks guys!

Re: XOOPS 2.0.13 Security Release

Herko Published 07/02/2005 15:49 XOOPS is my life! Joined 02/04/2002 Comments 4238

Quote:

Skara wrote:
How to upgrade from 2.0.9.3 to 2.0.13?
any easy way?

Easiest way is to dlownload all patches to your harddrive, unpack then to separate folders, create a new 'big patch' folder and copy the 2.0.9.3 patch files there. Then add the 2.0.10 files, overwriting any existing files in the 2.0.9.3 patch, and continue this process untill you have made sure you have all the files included in all the patches, and the latest versions of those that feature in more then one patch release. Then upload it all to the server, overwriting the originals

Herko

Re: XOOPS 2.0.13 Security Release

Gambero[removed] Published 07/02/2005 16:02 Updated 07/02/2005 17:04 Quite a regular Joined 01/13/2005 Comments 393

Hello!

I am still running XOOPS 2.0.7.3 on a very big website. Now I would like to know something.

Can I upgrade to 2.0.13 ?

I am using modules:

- TinyEvent 1.01
- Edito 2.2
- CBB 1.14
- Shoutbox 3.1
- Articles 0.25
- MyMenu 1.4
- Database tools 1.1
- Liaise 1.21
- BopComments 0.71
- XOOPS modules that come with the package

Will those modules work normally afther upgrade ?

Can I unpack XOOPS 2.0.13 stable and overwrite to server all exept mainfile.php and then only update system module ? Will it work ?

Thanks!

EDIT: Ok, jdseymour is helping me ... you don't have to answer.

Re: XOOPS 2.0.13 Security Release

pegasus00321 Published 07/02/2005 19:40 Quite a regular Joined 04/29/2005 Comments 339

Quote:

You will be able to upgrade directly from 2.0.10 to 2.2 - however, an actual upgrade package might be somewhat difficult, or at least extensive.

In any case, you will be able to apply the full 2.2 package on a 2.0.10 (or later) installation and upgrade. So now's the time to note down those changes to the core, you may have made.

Will you be providing a upgrade package from 2.0.10? I have 2 sites running that version because I have heavily modified them for speed and I didnt want to upgrade till 2.2 since it would be somewhat of a hassile modifying the code.

Re: XOOPS 2.0.13 Security Release

m0nty Published 07/02/2005 19:46 XOOPS is my life! Joined 10/24/2003 Comments 3337

@Gambero

Liaise 1.21 will not work with XOOPS 2.0.10 (as far as i'm aware)

you will need to also update that to 1.23 version.

Re: XOOPS 2.0.13 Security Release

iolai Published 07/02/2005 21:47 Quite a regular Joined 06/26/2004 Comments 206

Gambero,

I've upgraded to 2.12a from 2.0.7.3, and had
problems with newbb - had to update newbb again (but that's only me misreading instructions).

Question to others: I've seen that there is another newbb update in 2.0.13 package. Should I ignore it, if I use newbb2?

Re: XOOPS 2.0.13 Security Release

m0nty Published 07/02/2005 22:16 XOOPS is my life! Joined 10/24/2003 Comments 3337

Quote:

Question to others: I've seen that there is another newbb update in 2.0.13 package. Should I ignore it, if I use newbb2?

Always ignore it and also ignore news too in the upgrade packs, if you are using newbb2 or news 1.2 or later.

Re: XOOPS 2.0.13 Security Release

Gambero[removed] Published 07/02/2005 22:30 Quite a regular Joined 01/13/2005 Comments 393

The update went great! No problems!

And I updated liaise module and works great!

Re: XOOPS 2.0.13 Security Release

jdseymour Published 07/02/2005 22:44 Friend of XOOPS Joined 11/11/2004 Comments 3782

Quote:

Question to others: I've seen that there is another newbb update in 2.0.13 package. Should I ignore it, if I use newbb2?

Yes only updates to newbb 1 will be included in the patch. If you use newbb 2/ CBB delete the newbb folder from the patch.

Re: XOOPS 2.0.13 Security Release

Silviotech Published 07/02/2005 23:16 Just popping in Joined 06/18/2004 Comments 36

Version already available in XOOPS Paraná and in XOOPS BR in the Brazilian language

Quote:

the XOOPS Core Development team apologizes for the high frequency of updates this week.

I think it is not necessary excuses for updatings, because the same ones come exactly to help all of the users of XOOPS.

in our country we saying is wrong that it is apprehended

Re: XOOPS 2.0.13 Security Release

m0nty Published 07/02/2005 23:23 XOOPS is my life! Joined 10/24/2003 Comments 3337

yep. better to get them out straight away once u fixed the holes and bugs. and before everyone had already updated.. now they needn't bother with 2.0.11 or 2.0.12 can goto 2.0.13.

saves being like micro$oft and waiting till a million people have been hacked before releasing a fix for it that they've held onto for 6 months.. lol slight exageration, or is it? hehehe

Re: XOOPS 2.0.13 Security Release

boss_hog Published 07/03/2005 14:43 Just popping in Joined 06/11/2005 Comments 17

Hey yall,
will it be safe to upgrade from 2.0.12 to 2.0.13?
I don't see a patch for 2.0.12 to 2.0.12a, but, I may have missed it!
Any input would be appreciated.
Thanks
Joe

Re: XOOPS 2.0.13 Security Release

Shine Published 07/03/2005 14:48 Just can't stay away Joined 07/22/2002 Comments 822

Upgrade from 2.0.7.3 -> 2.0.13 went flawlesy.
(uploaded and overwritten the whole xoopscore)

Indeed there are a lot of files with empty lines on the end (as Jan304 already said.) Went to all the files and deleted those lines first.

One request:
Within the module.textsanitizer.php prox. line 154-155
there is a handy code: [siteurl]
I always use this code if I want to realise an internal link. Frustrating is that standard it always popups within a new window. Why not delete the target=_blank at this piece of code. Otherwise we have 2 options [url] and [siteurl] with the same window opening.

Grtz., Shine

Re: XOOPS 2.0.13 Security Release

JMorris Published 07/03/2005 15:47 XOOPS is my life! Joined 04/11/2004 Comments 2722

Upgraded from 2.0.12a > 2.0.13 without a hitch.

Awesome work to all who were involved!

Re: XOOPS 2.0.13 Security Release

CeBepuH Published 07/03/2005 20:43 Updated 07/03/2005 21:43 Not too shy to talk Joined 06/10/2002 Comments 128

Anybody else having avatar problems in 2.0.13?

Selecting an avatar from the list, hitting submit and... avatar not changed.

Edit: just realised the my avatar problem can't have been introduced in this version. But it exists here. Upgraded so many times my site lately that I'm not sure with which version this problem was introduced.

Re: XOOPS 2.0.13 Security Release

zite83 Published 07/04/2005 15:58 Just popping in Joined 10/05/2004 Comments 41

I dont mind the updates even if there is one a day.. It takes time to make something perfect.. I dont know what I would do without you guys.. Thanks so much for this awesome CMS

Re: XOOPS 2.0.13 Security Release

m0nty Published 07/04/2005 21:12 XOOPS is my life! Joined 10/24/2003 Comments 3337

Quote:

Anybody else having avatar problems in 2.0.13?

try doing a search for avatar upload problem

https://xoops.org/modules/newbb/viewtopic.php?topic_id=36935&forum=20&post_id=163913#forumpost163913

Re: XOOPS 2.0.13 Security Release

giba Published 07/05/2005 1:15 Just can't stay away Joined 04/26/2003 Comments 638

Xoops 2.0.13 - install full report Tests.

1 - Install (ok)
2 - Install (modules complements ok)
3 - All site in XOOPS 2.0.13 ok

-------------------------------------------------
Suggestions and example code for add if possible

a) In file install/index.php in line 29

add: include_once "../../include/version.php";

b) For install user Dummies for new in xoops.

Detect language browser in install...

File: install/index.php line 40 and 41 (open blank) and Add line:

Before:
Resized Image

After add line and include code:

Quote:

$accept_langs = explode(',', $_SERVER['HTTP_ACCEPT_LANGUAGE']);
$lanteste = $accept_langs[0];
switch ($lanteste) {
default:
case "fr":
$language = 'french';
$_POST['lang'] = 'french';
break;
case "ja":
$language = 'japanese';
$_POST['lang'] = 'japanese';
break;
case "ms":
$language = 'malay';
$_POST['lang'] = 'malay';
break;
case "es":
$language = 'spanish';
$_POST['lang'] = 'spanish';
break;
case "pt":
$language = 'portuguese';
$_POST['lang'] = 'portuguese';
break;
case "pt-br":
$language = 'portuguese';
$_POST['lang'] = 'portuguese';
break;
case "en":
$language = 'english';
$_POST['lang'] = 'english';
break;
case "de":
$language = 'german';
$_POST['lang'] = 'german';
break;
case "de-de":
$language = 'german';
$_POST['lang'] = 'german';
break;
case "en-us":
$language = 'english';
$_POST['lang'] = 'english';
break;
}
//$language = 'english';

Note: Attention for comments in line //$language = 'english';

This is simple corrections great works, was for new user dummie is good

Exemples:

Screen: French

Resized Image

Screen: German

Resized Image

Screen: Malay

Resized Image

Screen: Spanish

Resized Image

For more examples:

Xoops Core release 2.0.13 for dumies

Sorry my bad english and ( Melhorando )

Thanks for look in code.

Re: XOOPS 2.0.13 Security Release

dlh Published 07/05/2005 17:31 Joined 02/20/2002 Comments 182

Outstanding work - upgrade GearHeads all the way from 2.0.7.3 with no problems. Whew!

Just a tip for the user base - after copying files make sure you update the System module AND your other modules.

Dan

Re: XOOPS 2.0.13 Security Release

Marco Published 07/05/2005 18:36 Home away from home Joined 03/15/2004 Comments 1256

@dlh
I'm dreaming some old friends of xoops, listed here,make their come back, for joining past with future !
marco

Re: XOOPS 2.0.13 Security Release

GrodsCorp Published 07/06/2005 2:37 Just popping in Joined 06/13/2005 Comments 4

Sorry, guys. Excuse my ignorance but can I update from version 2.0.9.2 straight to this release?

Thanks...

Re: XOOPS 2.0.13 Security Release

gravies Published 07/07/2005 2:35 Not too shy to talk Joined 08/18/2004 Comments 119

So is the xmlrpc interface being used by anything? I can find very little mention of it with search. There was talk of somebody using bloggerapi... was anything released?

If it is not being used can we delete xmlrpc.php? If so, is there anything else that can be removed for a slimmer, more secure install?

Re: XOOPS 2.0.13 Security Release

Herko Published 07/07/2005 7:24 XOOPS is my life! Joined 02/04/2002 Comments 4238

@GrodsCorp: please read the earlier comments in this thread, this has been answered twice I think.

@gravies: XOOPS is one of the first applications that has the secure xml-rpc classes, thanks to a collaboration between the orgaisation that discovered the vulnerability and made the world aware (it's been in the news all over the world) and our core developer Mithrandir who picked up on this very quick. So there is no need to remove any files for security reasons when you use that latest and greatest version.

Herko

Re: XOOPS 2.0.13 Security Release

Peekay Published 07/07/2005 10:27 XOOPS is my life! Joined 11/20/2004 Comments 2335

@shine.
Quote:

Indeed there are a lot of files with empty lines on the end (as Jan304 already said.) Went to all the files and deleted those lines first.

I don't suppose you remember which PHP files needed extraneous lines removing in the full 2.0.13 download?

Re: Is this a bug ?

Gambero[removed] Published 07/07/2005 12:32 Updated 07/07/2005 17:10 Quite a regular Joined 01/13/2005 Comments 393

I think I found a bug. I created a custom group (before I upgraded to 2.0.13) with admin rights for module News and MyDownloads.

Now afther upgrade those users in this group can access the admin menu but they can't delete the comments under those two modules.

Login

Username

Password

Remember me

Search

Advanced Search

Donat-O-Meter

Stats
Goal:	$100.00
Due Date:	Nov 30
Gross Amount:	$0.00
Net Balance:	$0.00
Left to go:	$100.00

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

{{ record.commit.author.name }} {{ record.commit.author.date | formatDate }}

XOOPS: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: XOOPS 2.0.13 Security Release

Re: Is this a bug ?

Login

Search

Recent Comments

Re: New Admin Theme for XOOPS (Beta)

Sanford Pharmacy: Exceptional Pharmacy Services Tailored to You

Re: New Admin Theme for XOOPS (Beta)

Re: XOOPS 2.5.12 Beta-2 available for Testing

Re: XOOPS 2.5.12 Beta-2 available for Testing

Who's Online

Donat-O-Meter

Latest GitHub Commits

{{ record.sha.slice(0, 7) }} - {{ record.commit.message | truncate }}

Archives

News archives