Re: [Apc-aa-general] Security fix in AA - update from SVN recommended

[Bako M. <mi...@sb...>]

Hi Honza,

thank you very much, in this case I will try to upgrade. I hope I will 
not need other patching.

best,

Misi

On 2014-02-20 19:18, Honza Malik wrote:
> Hi Misi,
>
>> did:
>>
>> svn switch --relocate
>> https://apc-aa.svn.sourceforge.net/svnroot/apc-aa/trunk
>> https://svn.code.sf.net/p/apc-aa/svn/trunk .
> Good. SVN repository of Sourceforge has moved some time ago, so the provided
> command is necessary for older SVN installs.
>   
>> got the update, and after database update failed with:
>>
>> *Warning*: mysqli_connect() [function.mysqli-connect
>> <http://ekonoled.ro/aa/service/function.mysqli-connect>]: (HY000/2005):
>> Unknown MySQL server host 'p:localhost' (1) in
>> */home/ekledo/public_html/apc-aa_2.50/include/phplib/db_mysql.inc* on
>> line *72*
>>
>> *Database error:* connect (p:localhost, ekledo_adbusr, $Password,
>> ekledo_aadb) failed - 2005 - Unknown MySQL server host 'p:localhost' (1)
>> *Error Number:*: 0
>>
>> I am currently running PHP Version 5.2.17*
> We switched from deprecated ext/mysql to modern ext/mysqli extension. The new
> extension supports persistent connection (see ...host 'p:localhost'.... above)
> from PHP 5.3. So yes - it is PHP version related. You can fix this by using
> Non persistent connection to the database - see AA_USE_NON_PERSISTENT_CONNECT
> in your config.php3.
>
> This will solve the DB connection problem, but there are probably more spots,
> where we use PHP 5.3 constructs (like the one in site.php3* line *115*)
> The tested version of PHP with current AA is PHP 5.3 - 5.5, so I would
> recommend to upgrade PHP.
>
> The register_globals is no longer issue for current AA. It could be the
> problem for other apps, of course.
>   
>> Last time I had to downgrade PHP because register globals = off did not
>> work. Now if I upgrade php all other sites with reg.globals = on will
>> stop - meaning that I have to upgrade all sites at once and pray new
>> version will work because I can not go back afterwards.
> You have to upgrade PHP in near future in all cases, so now is probably the
> right time to do that. If you do not have time to convert all of your sites to
> PHP 5.5, I can patch the perm_sql.php3 file for you, so you can just replace
> it in your old AA install. However, this it just temporary solution.
>
>     Honza
>
>   
>
>
> Dne Čt 20. února 2014 Bako Mihaly napsal(a):
>> Hi Honza!
>>
>> After
>>
>> svn update
>>
>> got:
>>
>> svn: Repository moved permanently to
>> 'https://svn.code.sf.net/p/apc-aa/svn/trunk'; please relocate
>>
>> did:
>>
>> svn switch --relocate
>> https://apc-aa.svn.sourceforge.net/svnroot/apc-aa/trunk
>> https://svn.code.sf.net/p/apc-aa/svn/trunk .
>>
>> got the update, and after database update failed with:
>>
>> *Warning*: mysqli_connect() [function.mysqli-connect
>> <http://ekonoled.ro/aa/service/function.mysqli-connect>]: (HY000/2005):
>> Unknown MySQL server host 'p:localhost' (1) in
>> */home/ekledo/public_html/apc-aa_2.50/include/phplib/db_mysql.inc* on
>> line *72*
>>
>> *Database error:* connect (p:localhost, ekledo_adbusr, $Password,
>> ekledo_aadb) failed - 2005 - Unknown MySQL server host 'p:localhost' (1)
>> *Error Number:*: 0
>>
>> I am currently running PHP Version 5.2.17*
>>
>> I got when connecting to site:
>>
>> Parse error*: syntax error, unexpected ':' in
>> */home/ekledo/public_html/apc-aa_2.50/modules/site/site.php3* on line *115*
>>
>> Is this because PHP is to old?
>>
>> Last time I had to downgrade PHP because register globals = off did not
>> work. Now if I upgrade php all other sites with reg.globals = on will
>> stop - meaning that I have to upgrade all sites at once and pray new
>> version will work because I can not go back afterwards.
>>
>> What do you suggest?
>>
>> best,
>>
>> Misi
>>
>> On 2014-02-19 19:15, Honza Malik wrote:
>>> Hi all,
>>>
>>>      Gert Steenssens found SQL INJECTION problem in our SQL permission
>>>      system,
>>>
>>> which were there for a long time from its beginning phase.
>>>
>>>      All systems, which uses SQL based permission system should be updated
>>>      (see
>>>
>>> the line define("PERM_LIB", "sql") in your config.php3 script). The
>>> systems which uses LDAP permission system are not affected.
>>>
>>>      The database structure is stable for quite a long time, so any update
>>>      from
>>>
>>> Subversion should be quite easy - just type:
>>>      svn update
>>>      
>>>      The current AA in SVN works well with PHP 5.3, 5.4 and 5.5 and MySQL
>>>      >= 5.0
>>>
>>> (or MariaDB).
>>>
>>>      Thanks Gert for the report,
>>>      
>>>            Honza
>>>
>>> -------------------------------------------------------------------------
>>> ----- Managing the Performance of Cloud-Based Applications
>>> Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
>>> Read the Whitepaper.
>>> http://pubads.g.doubleclick.net/gampad/clk?id=121054471&iu=/4140/ostg.clk
>>> trk _______________________________________________
>>> "Did you get answers to your ActionApps-related queries? If yes, please
>>> help the ActionApps community by uploading the answers onto appropriate
>>> space in the ActionApps documentation wiki. See the *How to contribute*
>>> section today http://actionapps.org/en/How_To_Contribute"
>>> _______________________________________________
>>> apc-aa-general mailing list
>>> apc...@li...
>>> https://lists.sourceforge.net/lists/listinfo/apc-aa-general
>> ---------------------------------------------------------------------------
>> --- Managing the Performance of Cloud-Based Applications
>> Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
>> Read the Whitepaper.
>> http://pubads.g.doubleclick.net/gampad/clk?id=121054471&iu=/4140/ostg.clktr
>> k _______________________________________________
>> "Did you get answers to your ActionApps-related queries? If yes, please
>> help the ActionApps community by uploading the answers onto appropriate
>> space in the ActionApps documentation wiki. See the *How to contribute*
>> section today http://actionapps.org/en/How_To_Contribute"
>> _______________________________________________
>> apc-aa-general mailing list
>> apc...@li...
>> https://lists.sourceforge.net/lists/listinfo/apc-aa-general
>
> ------------------------------------------------------------------------------
> Managing the Performance of Cloud-Based Applications
> Take advantage of what the Cloud has to offer - Avoid Common Pitfalls.
> Read the Whitepaper.
> http://pubads.g.doubleclick.net/gampad/clk?id=121054471&iu=/4140/ostg.clktrk
> _______________________________________________
> "Did you get answers to your ActionApps-related queries? If yes, please
> help the ActionApps community by uploading the answers onto appropriate
> space in the ActionApps documentation wiki. See the *How to contribute*
> section today http://actionapps.org/en/How_To_Contribute"
> _______________________________________________
> apc-aa-general mailing list
> apc...@li...
> https://lists.sourceforge.net/lists/listinfo/apc-aa-general