Important security update for ISPConfig 3 available

Discussion in 'General' started by till, Apr 10, 2012.

  1. till

    till Super Moderator Staff Member ISPConfig Developer

    ISPConfig 3.0.4.4 is available for download. This release is a bugfix release for ISPConfig 3.0.4.

    This release contains a critical security patch for webdav users:

    http://bugtracker.ispconfig.org/index.php?do=details&task_id=2157

    It is highly recommended to install the 3.0.4.4 update immediately.
    If installing the full update is not possible on your server,
    then install the patch manually:

    Code:
    cd /tmp
    wget http://www.ispconfig.org/downloads/webdav_user_edit_php.gz
    gzip -d webdav_user_edit_php.gz
    mv -f webdav_user_edit_php /usr/local/ispconfig/interface/web/sites/webdav_user_edit.php

    For a detailed list of changes, please see the changelog section below.

    =====================================================
    *** New! The ISPConfig 3 manual is now available! ***

    Version 1.3 for ISPConfig >= 3.0.4 (Date: 10/25/2011)
    Author: Falko Timme <[email protected]>

    333 pages

    The manual can be downloaded from these two links:

    http://www.ispconfig.org/ispconfig-3/ispconfig-3-manual/
    http://www.howtoforge.com/download-the-ispconfig-3-manual
    =====================================================

    -----------------------------------------------------
    - Download
    -----------------------------------------------------

    The software can be downloaded here:

    http://prdownloads.sourceforge.net/ispconfig/ISPConfig-3.0.4.4.tar.gz

    ------------------------------------
    - Changelog
    ------------------------------------

    http://bugtracker.ispconfig.org/index.php?do=index&tasks=&project=3&due=66&status[]=

    --------------------------------------
    - Known Issues:
    --------------------------------------

    Please take a look at the bugtracker:

    http://bugtracker.ispconfig.org

    --------------------------------------
    - BUG Reporting
    --------------------------------------

    Please report bugs to the ISPConfig bugtracking system:

    http://bugtracker.ispconfig.org

    ----------------------------------------
    - Supported Linux Distributions
    ----------------------------------------

    - Debian Etch (4.0) - Squeeze (6.0) and Debian testing
    - Ubuntu 7.10 - 11.10
    - OpenSuSE 11 - 12.1
    - CentOS 5.2 - 6.2
    - Fedora 9 - 15

    -----------------------------------------
    - Installation
    -----------------------------------------

    The installation instructions for ISPConfig can be found here:

    http://www.ispconfig.org/ispconfig-3/documentation/

    or in the text files (named INSTALL_*.txt) which are inside the docs folder of the .tar.gz file.

    ------------------------------------------
    - Update
    ------------------------------------------

    To update existing ISPConfig 3 installations, run this command on the shell:

    ispconfig_update.sh

    Select "stable" as the update resource. The script will check if an updated version of ISPConfig 3 is available and then download the tar.gz and start the setup script.

    Detailed instructions for making a backup before you update can be found here:

    http://www.faqforge.com/linux/controlpanels/ispconfig3/how-to-update-ispconfig-3/

    If the ISPConfig version on your server does not have this script yet, follow the manual update instructions below.

    -------------------------------------------
    - Manual update instructions
    -------------------------------------------

    Code:
    cd /tmp
    wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
    tar xvfz ISPConfig-3-stable.tar.gz
    cd ispconfig3_install/install
    php -q update.php
     
  2. R4IDER

    R4IDER New Member

    Thanks for the patch but there appears to be a problem, the below error appears when trying to update.

    >> Update

    <br />
    <b>Notice</b>: Use of undefined constant E_STRICT - assumed 'E_STRICT' in <b>/tmp/ispconfig3_install/install/lib/install.lib.php</b> on line <b>53</b><br />
    <br />
    <b>Parse error</b>: syntax error, unexpected T_STRING, expecting T_OLD_FUNCTION or T_FUNCTION or T_VAR or '}' in <b>/tmp/ispconfig3_install/install/lib/installer_base.lib.php</b> on line <b>36</b><br />
     
  3. till

    till Super Moderator Staff Member ISPConfig Developer

    I dont get this error here when I update. Which update method did you use and which Linux distribution and php version.
     
  4. edge

    edge Active Member Moderator

    Greetings from Dubai.

    I habd no problem with updating my Debian Squeeze servers with ispconfig_update.sh

    Keep up the good work!
     
  5. Hans

    Hans Moderator Moderator

    Hi Till,
    thank you for this release!
    I just updated my Debian Squeeze ISPConfig 3.0.4.3 server at home.
    Now ISPConfig Version: 3.0.4.4 is installed.
    All went fine. I will update the servers in the DC soon!
     
    Last edited: Apr 10, 2012
  6. R4IDER

    R4IDER New Member

    Centos 5.6 and PHP Version 5.3.10.

    I tried running ispconfig_update.sh and the below.


    cd /tmp
    wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
    tar xvfz ISPConfig-3-stable.tar.gz
    cd ispconfig3_install/install
    php -q update.php
     
    Last edited: Apr 10, 2012
  7. falko

    falko Super Moderator Howtoforge Staff

    Do you use eAccelerator? If so, disable it and try again.
     
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    @R4IDER

    Please try what falko suggested, if this wont help, please post the output of:

    php -v

    Your commandline php does not know the internal php constant E_STRICT and E_STRICT has been introduced with php 5, the same with the second error, your php does not support global variables in classes which has been introduced in php 5 as well. According to your error messages my guess is that the commandline php on your server is php 4 and not php 5.
     
  9. R4IDER

    R4IDER New Member

    Thanks for your replies.

    I have disabled eAccelerator and tried again but had the same result.

    till, you are correct my command line PHP is not the version that is used by apache. The command line version is PHP 4.4.9, I will try and get this updated and report back.
     
  10. itanium

    itanium Member

    Hello,

    Thank's for the quick update.

    I have just a little problem:

    When a customer add a database, when with my admin account i go to Site -> Database and click on the new created database i have :

    Customer = i see a blank dropdown

    Database name db[CLIENTID]_dbu1_newdatabase
    Database user dbu[CLIENTID]_dbu1_newdatabase

    Twice db[CLIENTID]_ & dbu[CLIENTID]_

    A new bug ? ;)
     
  11. till

    till Super Moderator Staff Member ISPConfig Developer

    @itanium: Creating databases by customers, resellers and the admin works fine on my servers, all customers are listed in the dropdown. Maybe you use a custom theme which is broken or does not load jqzuery correctly or you changed the database prefix after you created the affected database on your server.
     
  12. R4IDER

    R4IDER New Member

    I decided not to bother trying to update the command line php because I didn't want to break my current apache php configuration, instead I downloaded the files manually and added #!/usr/bin/php -q to the update.php and then I changed the permissions of update.php to 755 and then run the file using ./update.php I doubt anyone else will have this problem but I always like to post my solutions just in case.

    Thinking back now before Christmas I configured my server to run multiple versions of php obviously something got broken when I installed the latest php version during March.
     
    Last edited: Apr 11, 2012
  13. itanium

    itanium Member

    @till: i will reinstall a server for test. Something wrong with my setup...

    ps: my database seems to be like in the svn? I don't really understand why because i never used svn in this server. :confused:
     
  14. till

    till Super Moderator Staff Member ISPConfig Developer

    At which branch did you look in svn? In svn there are many different versions of the sql database layout as we have several svn branches, for example the 3.0.4 branch is the exact same code then that you get in the tar.gz while the trunk is the code of the upcoming 3.0.5 release.
     
  15. itanium

    itanium Member

    Ok i found the problem. An colleague gave me the bad .tar.gz who comes from the trunk branch...

    I have just restore the sql & backup of ispconfig. Update to 3.0.4.4 and now all work fine :)
     
  16. lollollollol

    lollollollol Member

    As usual, very good job!

    Hi,
    Thank you very much for this new upgrade.
    I have just upgraded one of my two servers running isp3config.

    Everithing is fine.
    Thanks!
     
  17. Mitzy

    Mitzy New Member

    Ubuntu 11.10 LEMP updated from CLI like a charm :)
     
  18. zbuzanic

    zbuzanic Member

    Updated 3 of 3, everything OK :) Thank you!
     

Share This Page