Topic: SMF 1.0.10 Release

[Grudge]

Following a security report from Jessica Hope/rotwang Simple Machines is happy to release a patch for all users still running SMF 1.0.9. This patch can be installed directly from your admin center by visiting the package manager. We would urge all users of SMF 1.0.9 and below to upgrade to SMF 1.1.1 but we will continue to patch the SMF 1.0 line as required.

Note: This patch is only for users of SMF 1.0.x - any user running any version from the 1.1 line should visit this topic

Users who would like to download the full SMF 1.0.10 package can find it on the archive page.

Thanks,

Simple Machines

[Bernak]

Thanks for the update!
Because an incompatibility issue I can't upgrade to 1.1 .... 
Thanks for keeping the 1.0 versions with the important security updates!

[Zenigata]

It works. Thanks.

[Ohmer]

Thanks for the backport !

[adamkemp]

How can I patch a modded forum safely? I can only find packages which will completely overwrite existing files. Is there a diff I can use?

[Dannii]

You can use the attachment in the first post.

[Daniel15]

How can I patch a modded forum safely? I can only find packages which will completely overwrite existing files. Is there a diff I can use?

As eldacar said, you can install it via the Package Manager in your SMF admin panel. I believe it will tell you there's an update, but if it doesn't, upload the file attached to the first post (under 'Upload Package')

EDIT: There's a spelling error in a comment, by the way:

// Do we have a mime type we can simpy use?

[Insight]

I have downloaded it quite a few times now with av on and off and winrar is telling me the files within it are corrupt.

They look alright when I view them, any ideas?

[Dannii]

What matters isn't whether winrar thinks they're corrupt (and it's a silly program anyways) but whether the server does. Can you install them?

[Insight]

I'll give it a try ...

yup worked, thanks

[adamkemp]

I'm sorry, I didn't see the attachment. I'll try it.

Thanks.

[KGIII]

We would urge all users of SMF 1.0.9 and below to upgrade to SMF 1.1.1 but we will continue to patch the SMF 1.0 line as required.

I can't seem to find a clear answer anywhere. I may have missed it or my search terms just might not have matched it to decent content. I have three clients whom, for reasons of their own, simply can't upgrade at this time. As this is a shared server environment and, frankly, one that my employees and myself are ultimately accountable for we have a policy that disallows insecure code on the system - within reason.

I'm not too concerned, and surely not concerned yet, but there's going to come a time when you can't really support old code I suspect. No matter how ideal, no matter how important, it simply seems to be unrealistic to expect you to. (Thanks for doing it for however long you can and do do it.)

Is there a set date or condition as to when support for the older version will expire? I have read everything from "for as long as we can" to "forever" I believe. The first is not very specific and the second is probably impossible.

I don't ask to be a pain... Reall... Well not to be a pain to you guys... Instead I ask so that I can poke and prod them into upgrading their themes to 1.1 and moving along or at least tell them when we'll have to insist that they do. As much as we'd like to be idealists and say, "It is your space, do with it as you will" there are more and more laws coming into play as well as more and more people looking for legal accountability and in a shared server environment vulnerabilities are best squished when found.

[Daniel15]

Is there a set date or condition as to when support for the older version will expire?

I'd take a guess and say it will be supported until the next major version of SMF (1.2? 2.0?) comes out. This is only a guess though, don't take my word on it

[KGIII]

Is there a set date or condition as to when support for the older version will expire?

I'd take a guess and say it will be supported until the next major version of SMF (1.2? 2.0?) comes out. This is only a guess though, don't take my word on it

LOL That's what I'd "guessed" as well but hadn't any hard or fast evidence to support it. 1.0.10 rolling down the pipes didn't help my case much but I think they understand that eventually they WILL have to upgrade for security reasons. I won't delve into it here but, well, why is it people will maintain a car but when it comes to an operating system, security application, or even software that they use for their site that folks are so inclined to say, "I have what I need, I won't go past here?" *sighs*

That's a whole other thread entirely though. One more suited for the chit chat section but thanks for at least confirming that another person thinks the same things I was thinking. Though momentum suggests that next version is going to roll down the pipes faster than 1.1 did.

[Dannii]

Also - we should be supporting 1.0 with security patches indefinetely IMHO. There's no great need not to IMHO.

[KGIII]

Also - we should be supporting 1.0 with security patches indefinetely IMHO. There's no great need not to IMHO.

If SMF does do that and sustains it they'll be the first and only. I'll give kudos where they're due and so my expectation is that, if there is any team capable or willing? It'd be this one. On the other hand, it seems unlikely and unrealistic but what the heck? I'll root for you.

[Vinspire]

Is this the patch I need to use for RC 3 ?

[Dannii]

No, this is for 1.0.9 ONLY.

[Vinspire]

No, this is for 1.0.9 ONLY.

Then how do i patch it up if i am using 1.1 RC 3 ?

[Dannii]

Go to the download page, and use the 'Large Upgrade' package, or just use the Webinstaller. That will take you to 1.1.1.