Critical security update to Flarum core, with new incident write-up (v1.0.2)

pupsik

After update, problem with extensions:

Fatal error: Declaration of FoF\Gamification\Gambit\HotGambit::conditions(Flarum\Query\AbstractQueryState $search, array $matches, $negate) must be compatible with Flarum\Search\AbstractRegexGambit::conditions(Flarum\Search\SearchState $search, array $matches, $negate) in \vendor\fof\gamification\src\Gambit\HotGambit.php on line 33

Ralkage

pupsik which PHP version are you running?

peopleinside

pupsik you should ask help to the Gamification developer extension 🙂
Prcek this is maybe because you need run php flarum migrate after the SSH update command or simply insert the database password for end up the update 😄 I don't think this is related to the security issue that has been fixed.

@davwheat you may need add the security alert also on GitHub https://github.com/flarum/core/security/advisories

pupsik

Never mind. I have a backup of v0.1.0-beta.16. I will use that and sleep well.

pupsik

7.4.16

Hari

Successfully upgraded, thanks for the bug fix 🙂 🎉

it would be great if we get notified in our own flarum dashboard about the updates like Wordpress does 😄

for now subscribed @ github core & receiving email notifications 🙂

tankerkiller125

Hari this is something we've discussed a little bit internally, but always got pushed off/back it order to get stable out. Now that stable is out we'll probably revisit this kind of thing.

[deleted]

I upgraded But still I am really afraid. 😨

Hari

[deleted] you are grownup now, do not be afraid of anything .. just save the backup in the vault 😋

Prcek

Update: As @peopleinside note, don't forget php flarum migrate after update 🙈

Prcek

peopleinside Yeah, you are absolutely right 👍 This is the first time I forgot to run php flarum migrate after upgrade. So I wondered what my eyes saw 😁

luceos

peopleinside @davwheat you may need add the security alert also on GitHub https://github.com/flarum/core/security/advisories

Yeah we are working on that.

davwheat

peopleinside

A security advisory for this vulnerability has been published on GitHub: https://github.com/flarum/core/security/advisories/GHSA-5qjq-69w6-fg57

Justoverclock

flarum.it, update ok 🙂

Zeokat

First Stable first CVE with score 10 😅

luceos

Zeokat it was quite a challenge, but I think we nailed it 🙈🤯

pupsik

I fixed my error, by uninstalling gamification, and installing it back on 1.0.2.