Stian Didriksen

Spread the word, do not upgrade to Joomla! 1.5.16/1.5.17

Joomla! now got a new and extremely dangerous *feature* that auto-disable any plugin that throws an fatal errror.
That includes core plugins.

More info
http://blog.joomlatools.eu/2010/05/advising-to-not-upgrade-to-jooml...

Now somebody please explain to me why it's a battle to do a small CSS change and have that patch approved (only for 1.6, not 1.5 mind you):
While this:
Is approved without even doing PHP4 testing?

Bottom line: Do not upgrade to 1.5.16 or 1.5.17, and advice all your users the same!

Being able to disable plugins by creating an error is extremely insecure for your site!

Views: 58

Tags: danger, joomla, security

Stian Didriksen Comment by Stian Didriksen on May 7, 2010 at 12:30pm
I see two options.
- Roll back this specific function, and release 1.5.18 asap.
- Move this function into a separate plugin that's disabled by default, and release 1.5.18 asap.

Either way, I recommend waiting for 1.5.18 or when this is fixed, before upgrading from 1.5.15.
Markus Bopp Comment by Markus Bopp on May 7, 2010 at 1:33pm
oh noes
Amy Stephen Comment by Amy Stephen on May 7, 2010 at 2:22pm
[10:02:59 AM] Amy Stephen: the problem with these types of issues is - there are a symptom of our real problem
[10:03:20 AM] Amy Stephen: the real problem is that the level of transparency is low and the level of involvement is low
[10:03:27 AM] Amy Stephen: that creates two sides
[10:03:55 AM] Amy Stephen: the group in power feels little, if any accountability to the outside group - in fact, they feel resentful and used
[10:04:17 AM] Amy Stephen: they think no one wants to help - but in reality - they work very hard to guard their turf and protect their little perks
[10:04:44 AM] Amy Stephen: when this type of mistake happens - the group on the outside pounds on it until the police come out and chase them away
[10:05:07 AM] Amy Stephen: the end result tends to be a tie - both sides scored a few good blows - but no one fixed any problems
[10:05:36 AM] Amy Stephen: the real problem is that we cumulatively invest a great deal of time in this because the drama draws us together and creates a sense of fun and comradely
[10:05:49 AM] Amy Stephen: very similar to watching the lions eat the Christians
[10:05:56 AM] Amy Stephen: we are fucked up.
[10:06:01 AM] Amy Stephen: we ALL are
[10:06:33 AM] Amy Stephen: and we need to come to terms with the fact that things are not working - drop the weapons - disband the gangs - sit in a circle - and fix the damn thing
Stian Didriksen Comment by Stian Didriksen on May 7, 2010 at 3:09pm
@Leo yeah many devs have received tons of support requests all caused by plugins being unpublished. Hopefully this will get resolved son.

@Amy I agree! There are so many people that wants to get involved, but if you're unknown, or too known, you don't get in. And it's all just social. If we could just all focus on what matters, which is the well being of Joomla, instead of ourself personally, things would go a lot smoother.
After all, everyone on the Joomla ecosystem wants Joomla as good as can be. Why let human feelings and egos get in the way?
Shayne Bartlett Comment by Shayne Bartlett on May 7, 2010 at 7:12pm
Amy swore :0
Amy Stephen Comment by Amy Stephen on May 7, 2010 at 8:47pm
Yup, I did.
Mark W. Bender Comment by Mark W. Bender on May 8, 2010 at 1:02am
How did this slip into the trunk, and how did it 2 update releases with major problems get by the bug squad? How was this not caught before release? Why was this not caught?

I updated only 1 website before the alarm was sounded on 1.5.16. I then installed over a dozen updates to 1.5.17 last weekend. Now this?

We might have push for 1.6, but is the push for 1.6 worth literally sacrificing a quality release of a 1.5 version? Maybe we need to reassess the process, because 2 bad releases in a row certainly should "ring a few bells" in our community!
Eric Caldwell Comment by Eric Caldwell on May 8, 2010 at 8:32am
Funny thing is, why didn't the core devs do this for modules as well? I have had way more modules produce a blank sites than I have ever had a plugin cause a problem. Also, components can produce this same thing so, if your going to start installing blockers/disablers, do it across the board. Poorly written components and modules are way more prevalent that poorly written plugins.

Joomlatools found the code and published a blog on how to hack out this feature (http://blog.joomlatools.eu/2010/05/advising-to-not-upgrade-to-jooml...). Since we only upgraded our main site for testing, I'm glad we didn't roll this out to our client base. That could have caused quite a few phone calls to us. We'll be using this hack to update our base then use our updater system to roll this out to all clients (thanks JoomlaTools).

Being one of the original XOOPS devs, I understand the position of being a core person and wanting to do something to help with noobs and their challenges but, this should have been discussed with more of other core teams before being implemented.

I also understand Amy's point of how core devs feel abused and everyone wanting something for nothing, or wanting it this way or that way. It's truly a balancing act but, in the end, all the chips have to be brushed off the shoulder, problems fixed (roll this back, make it an option in the globals) and move forward.

BTW, wasn't the 1.5x release was supposed to be a LTR? If so, why add a new feature at this point?
Svein Wisnaes Comment by Svein Wisnaes on May 8, 2010 at 8:38am
I must admit I have no clue at all about who decides these upgrades, and what the rules are.

Maybe it would be a good thing to get to know how things are supposed to happen? Could anyone make a blogpost about how Joomla upgrades are controlled, made etc.? There should be enough for a little documentary here... A week in the life of a software volunteer (or two).

It would be nice to know a bit about the whole process so we can learn where we can influence and help. Reporting a bug is well and good - question is - what happens to a bug report? Who do anything about it?
Steven Trullinger Comment by Steven Trullinger on May 8, 2010 at 10:11am
So what is the testing process for these patches? .17 came out pretty darn fast was it even tested befor it went live

Comment

You need to be a member of All Together, As A Whole to add comments!

Join All Together, As A Whole

Badge

Loading…

© 2012   Created by Amy Stephen.

Badges  |  Report an Issue  |  Terms of Service