Menu
▾
▴
Re: [Apc-aa-general] Security fix in AA - update from SVN recommended
|
From: Honza M. <hon...@ec...> - 2014-02-20 17:18:53
|
Hi Misi, > did: > > svn switch --relocate > https://apc-aa.svn.sourceforge.net/svnroot/apc-aa/trunk > https://svn.code.sf.net/p/apc-aa/svn/trunk . Good. SVN repository of Sourceforge has moved some time ago, so the provided command is necessary for older SVN installs. > got the update, and after database update failed with: > > *Warning*: mysqli_connect() [function.mysqli-connect > <http://ekonoled.ro/aa/service/function.mysqli-connect>]: (HY000/2005): > Unknown MySQL server host 'p:localhost' (1) in > */home/ekledo/public_html/apc-aa_2.50/include/phplib/db_mysql.inc* on > line *72* > > *Database error:* connect (p:localhost, ekledo_adbusr, $Password, > ekledo_aadb) failed - 2005 - Unknown MySQL server host 'p:localhost' (1) > *Error Number:*: 0 > > I am currently running PHP Version 5.2.17* We switched from deprecated ext/mysql to modern ext/mysqli extension. The new extension supports persistent connection (see ...host 'p:localhost'.... above) from PHP 5.3. So yes - it is PHP version related. You can fix this by using Non persistent connection to the database - see AA_USE_NON_PERSISTENT_CONNECT in your config.php3. This will solve the DB connection problem, but there are probably more spots, where we use PHP 5.3 constructs (like the one in site.php3* line *115*) The tested version of PHP with current AA is PHP 5.3 - 5.5, so I would recommend to upgrade PHP. The register_globals is no longer issue for current AA. It could be the problem for other apps, of course. > Last time I had to downgrade PHP because register globals = off did not > work. Now if I upgrade php all other sites with reg.globals = on will > stop - meaning that I have to upgrade all sites at once and pray new > version will work because I can not go back afterwards. You have to upgrade PHP in near future in all cases, so now is probably the right time to do that. If you do not have time to convert all of your sites to PHP 5.5, I can patch the perm_sql.php3 file for you, so you can just replace it in your old AA install. However, this it just temporary solution. Honza Dne Čt 20. února 2014 Bako Mihaly napsal(a): > Hi Honza! > > After > > svn update > > got: > > svn: Repository moved permanently to > 'https://svn.code.sf.net/p/apc-aa/svn/trunk'; please relocate > > did: > > svn switch --relocate > https://apc-aa.svn.sourceforge.net/svnroot/apc-aa/trunk > https://svn.code.sf.net/p/apc-aa/svn/trunk . > > got the update, and after database update failed with: > > *Warning*: mysqli_connect() [function.mysqli-connect > <http://ekonoled.ro/aa/service/function.mysqli-connect>]: (HY000/2005): > Unknown MySQL server host 'p:localhost' (1) in > */home/ekledo/public_html/apc-aa_2.50/include/phplib/db_mysql.inc* on > line *72* > > *Database error:* connect (p:localhost, ekledo_adbusr, $Password, > ekledo_aadb) failed - 2005 - Unknown MySQL server host 'p:localhost' (1) > *Error Number:*: 0 > > I am currently running PHP Version 5.2.17* > > I got when connecting to site: > > Parse error*: syntax error, unexpected ':' in > */home/ekledo/public_html/apc-aa_2.50/modules/site/site.php3* on line *115* > > Is this because PHP is to old? > > Last time I had to downgrade PHP because register globals = off did not > work. Now if I upgrade php all other sites with reg.globals = on will > stop - meaning that I have to upgrade all sites at once and pray new > version will work because I can not go back afterwards. > > What do you suggest? > > best, > > Misi > > On 2014-02-19 19:15, Honza Malik wrote: > > Hi all, > > > > Gert Steenssens found SQL INJECTION problem in our SQL permission > > system, > > > > which were there for a long time from its beginning phase. > > > > All systems, which uses SQL based permission system should be updated > > (see > > > > the line define("PERM_LIB", "sql") in your config.php3 script). The > > systems which uses LDAP permission system are not affected. > > > > The database structure is stable for quite a long time, so any update > > from > > > > Subversion should be quite easy - just type: > > svn update > > > > The current AA in SVN works well with PHP 5.3, 5.4 and 5.5 and MySQL > > >= 5.0 > > > > (or MariaDB). > > > > Thanks Gert for the report, > > > > Honza > > > > ------------------------------------------------------------------------- > > ----- Managing the Performance of Cloud-Based Applications > > Take advantage of what the Cloud has to offer - Avoid Common Pitfalls. > > Read the Whitepaper. > > http://pubads.g.doubleclick.net/gampad/clk?id=121054471&iu=/4140/ostg.clk > > trk _______________________________________________ > > "Did you get answers to your ActionApps-related queries? If yes, please > > help the ActionApps community by uploading the answers onto appropriate > > space in the ActionApps documentation wiki. See the *How to contribute* > > section today http://actionapps.org/en/How_To_Contribute" > > _______________________________________________ > > apc-aa-general mailing list > > apc...@li... > > https://lists.sourceforge.net/lists/listinfo/apc-aa-general > > --------------------------------------------------------------------------- > --- Managing the Performance of Cloud-Based Applications > Take advantage of what the Cloud has to offer - Avoid Common Pitfalls. > Read the Whitepaper. > http://pubads.g.doubleclick.net/gampad/clk?id=121054471&iu=/4140/ostg.clktr > k _______________________________________________ > "Did you get answers to your ActionApps-related queries? If yes, please > help the ActionApps community by uploading the answers onto appropriate > space in the ActionApps documentation wiki. See the *How to contribute* > section today http://actionapps.org/en/How_To_Contribute" > _______________________________________________ > apc-aa-general mailing list > apc...@li... > https://lists.sourceforge.net/lists/listinfo/apc-aa-general |
