Critical security update to Flarum core, with new incident write-up (v1.0.2)

[deleted]

Star Isn't there any extension can be used for rss now?

Try this: https://discuss.flarum.org/d/27569-rss-feed

Justman10000

What was the security hole?

GreXXL

Justman10000 you can read the security advisory on Github for the full information.

Justman10000

GreXXL

This still works?

luceos

Justman10000 have you cleared your cache (php flarum cache:clear)?

Justman10000

luceos

Uff! Forgot 😂

davwheat

Hey all!

We've updated the initial post to include a full write-up of the incident, including what went wrong and how we could improve next time.

This write-up contains full details of the exploit and how it was remediated. If you have not yet updated from v1.0.0 or v1.0.1 to v1.0.2, you should do so immediately.

JoshuaPack

Good work in clearing this up ASAP. Thanks for all your hard work!

adminmatthew

is Freeflarum automatically updated to the latest version??
or how can the admin update it?

peopleinside

adminmatthew Flarum is not updated automatically.
You need follow the forum actualy under the tag https://discuss.flarum.org/t/meta. You can subscrive to be ntified when a post is made on this tag.

Then for update you need read the instruction on the announcement of each release.

adminmatthew

peopleinside But does FREEFLARUM get updated automatically?

peopleinside

adminmatthew yes, it should be updated automatically.

SKevo

adminmatthew FreeFlarum's Flarum version is updated by us (FreeFlarum) when most of the extensions become compatible. Our customers/forum admins can't update it by themselves, and all patches/upgrades are done by us, when our spare time allows it.

This time, we're also rebasing our backend & frontend. I wrote a few posts about this in the past, but what matters is that I except it to be done by the start of July, it again depends on how our free time will allow for us to upgrade.

If you have any further questions, feel free to ask them in our discussion

« Previous Page