6.0.3 Released (SECURITY FIX + Maintenance Release)

[Matt]

Version 6.0.3 is now available for download in the client area of our site.

** This version includes a fix for a critical security vulnerability affecting all versions of the software since 3.0.1 -- More information below, under "Who Should Update". Also included in this release is a collection of bug fixes implemented since the release of 6.0.2

Do NOT attempt to update if your Support & Updates service has expired prior to the release date! See this release note for the full details.

Refer to this post for more information on our version number schema, and specifically what we mean when we say that this is a "Maintenance Release".

Who Should Update

This release includes a critical security fix, and is highly recommended for anyone running versions of the software between 3.0.1 and 6.0.2. Exact details of the vulnerability are withheld, because there are no known instances of its exploitation "in the wild." (we don't want to make the hacker's job too easy!) For those unable to update to 6.0.3, a patch is in the works to close this vulnerability -- more details regarding that will be forthcoming soon, but the best option is to update to 6.0.3 if possible.

Code modifications: As always, if you have any PHP code modifications, to update you will need to re-apply those changes after you update, and custom code modifications are not supported in the helpdesk system. Keep this in mind when deciding whether you want to update or not.

Addon Developers: Be sure to check out the developer-oriented "changes to note" geared toward external Addon developers, see changes to note in the developer section of the wiki for that.

Template FILE modifications: I'm referring to using a custom template set with changes to system or module templates, located in the geo_templates/ directory, not changes to the main templates. For such modifications, see this page for notes on changes to those template files in the new versions. Also follow the updating tips in Customizing System or Module Templates for the smoothest update possible when there are customized system/module templates at stake.

High traffic sites For high traffic sites, it is recommended to first test the update on a test location, so that the update on the live site is as seamless as possible.

Software Update Cost
If you have purchased the software within the last year, this will be a free software update. If you are outside of your 1 year of downloads, or are not sure, contact the sales department at sales@geodesicsolutions.com to get a free price quote.

Geo Client Area
If you do not have an account to log into the client area, you will need to be added to our new client area in order to download the new version. Send the following details to sales@geodesicsolutions.com when you are requesting the software update:

First Name:
Last Name:
Address:
City:
USA State:
Non-USA Province:
Zip / Postal Code:
Country:
Phone:
E-mail Address:

Release Notes:

Read the release notes for information on new features and bug fixes in the linked page.

Template File Changes:
Changed template files from 6.0.2 to 6.0.3:

• module/my_account_links.tpl
• system/browsing/common/listing_set.tpl
• system/classes/Region/get_region.tpl
• system/search_class/details_form.tpl

Changes relative to default template set folder geo_templates/default/, see this page for more info on the specific changes for each file.

Changed Files:
Changed files between 6.0.2 to 6.0.3

• addons/SEO/ - Addon updated
• addons/storefront/ - Addon updated
• addons/tokens/ - Addon updated
• admin/addon_manage.php
• admin/admin_beta_settings.php
• admin/admin_messaging_class.php
• admin/AJAXController/Filter.php
• admin/home.php
• admin/menus/sections/site_setup.php
• admin/recurring_billing.php
• admin/templates/home.tpl
• admin/templates/login.tpl
• admin/templates/orders/list_recurring_billings.tpl
• classes/adodb/ - 3rd Party Library Updated
• classes/Ajax.class.php
• classes/auction_bid_class.php
• classes/authenticate_class.php
• classes/browse_ads.php
• classes/browse_affiliate_ads.php
• classes/browse_notify_friend.php
• classes/browse_notify_seller.php
• classes/browse_tag.php
• classes/geo_smarty_plugins/function.debug_templates_used.php
• classes/geo_smarty_plugins/postfilter.process_tags.php - New file
• classes/geo_smarty_plugins/resource.geo_tset.php
• classes/order_items/images.php
• classes/order_items/offsite_videos.php
• classes/order_items/_listing_placement_common.php
• classes/payment_gateways/account_balance.php
• classes/payment_gateways/cashu.php
• classes/payment_gateways/payflow_pro.php
• classes/PEAR/PayPal/Type/AddressVerifyRequestType.php
• classes/PEAR/PayPal/Type/AddressVerifyResponseType.php
• classes/PEAR/PayPal/Type/APICredentialsType.php
• classes/PEAR/PayPal/Type/BankAccountDetailsType.php
• classes/PEAR/PayPal/Type/BusinessInfoType.php
• classes/PEAR/PayPal/Type/BusinessOwnerInfoType.php
• classes/PEAR/PayPal/Type/DoAuthorizationRequestType.php
• classes/PEAR/PayPal/Type/EnterBoardingRequestDetailsType.php
• classes/PEAR/PayPal/Type/GetBoardingDetailsResponseDetailsType.php
• classes/PEAR/PayPal/wsdl/eBLBaseComponents.xsd
• classes/PEAR/PayPal/wsdl/PayPalSvc.wsdl
• classes/php5_classes/Category.class.php
• classes/php5_classes/DataAccess.class.php
• classes/php5_classes/DataAccess.class.zend.php
• classes/php5_classes/Email.class.php
• classes/php5_classes/Number.class.php
• classes/php5_classes/Order.class.php
• classes/php5_classes/products.php
• classes/php5_classes/products.zend.php
• classes/php5_classes/Region.class.php
• classes/php5_classes/smarty - 3rd Party Library Updated
• classes/php5_classes/Template.class.php
• classes/php5_classes/View.class.php
• classes/register_class.php
• classes/search_class.php
• classes/site_class.php
• classes/swfupload/license.txt
• classes/swfupload/swfupload.js
• classes/user_management_information.php
• index.php
• js/codemirror/ - 3rd Party Library Updated
• js/tiny_mce/ - 3rd Party Library Updated
• modules/shared/browsing.php

Update Instructions:
Perform the update as specified in the User Manual.

Example Addon:
The Example Addon is used by developers as a starting point and as "working documentation" to build 3rd party addons.

You can get the example addon (instructions may change):

1. Log into the client area.
2. Click on Public Downloads. You will find the example addon in the public downloads section.

If you have any problems, start a support ticket, or post a reply to this thread.

Troubleshooting

• Troubleshooting will be located in the tools available in the support section of our site, the main resource being the updates user manual. Currently there are no troubleshooting tips specifically for this release.

[jonyo]

Version 6 now requires MySQL 4.1 or higher, the featured pic modules and certain search queries will not work with older versions of MySQL prior to version 4.1. We did not realize this restriction at the time, so right now the 6.0 platform lists the earlier minimum requirement, this will be corrected in version 6.0.4.

For anyone on 1and1 host that has an older database using 4.0 version of MySQL, follow these instructions from 1and1, to switch your database to use MySQL 5.0.