Jump to content
View in the app

A better way to browse. Learn more.

Invision Community

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Security Updates for 4.7.20, and 5.0.7

This topic contains 52 posts with an estimated read time of 41 minutes. A summary containing the most significant posts is available with an estimated read time of 9 minutes.

Featured Replies

I've managed to repair, but just for your information 😀

  • Replies 51
  • Views 6.2k
  • Created
  • Last Reply

Top Posters In This Topic

Most Popular Posts

  • Clover13
    Clover13

    Hey @Matt , it's a nice facility within the AdminCP that it auto-detects the version differences (based on the underlying code perspective) and adds a banner to update. The only caveat in this instan

  • opentype
    opentype

    No. FTP apps can merge files and folders, so it’s just one action. You don’t have to open any folders at all.

  • Stuart Silvester
    Stuart Silvester

    Go to <board_url>/admin/upgrade to complete the upgrade 👍🏻

Posted Images

22 hours ago, Matt said:

Do you get this resolved? Just upload the files from the zip to the your server, overwriting the existing files.

Really? So I have navigate into all those directories and copy the files manually via FTP? The last time I had to do that, it took forever! There's gotta be a better way than that! How about more clues as to why the patch couldn't be downloaded? Actually, it gets through the download part, but errors out at "extracting...".

Kev

6 minutes ago, Large Scale Planes said:

Really? So I have navigate into all those directories and copy the files manually via FTP?

No. FTP apps can merge files and folders, so it’s just one action. You don’t have to open any folders at all.

29 minutes ago, opentype said:

No. FTP apps can merge files and folders, so it’s just one action. You don’t have to open any folders at all.

Really? I've never noticed this functionality in Filezilla to be honest. Does it happen automatically, or do I need to select a "merge" option from somewhere? I know the question sounds stupid, but this is genuinely news to me.

In any case, I've just finished uploading the files, and now the patch notification has gone, but ACP is complaining about modified files, and prompting me to re-download the unmodified originals. 🙄

Kev

8 minutes ago, Large Scale Planes said:

In any case, I've just finished uploading the files, and now the patch notification has gone, but ACP is complaining about modified files, and prompting me to re-download the unmodified originals. 🙄

I realise now that I should have uploaded the new files while the upgrader was paused and waiting, rather than just randomly when it seemed like a good time. Is there any way to invoke the upgrader manually? I guess I could re-download the unmodified files just as I'm being prompted to, but it's only asking to downgrade a small handful of them, and I'm concerned this would cause more problems, rather than solve them.

Kev

25 minutes ago, Large Scale Planes said:

I realise now that I should have uploaded the new files while the upgrader was paused and waiting, rather than just randomly when it seemed like a good time. Is there any way to invoke the upgrader manually? I guess I could re-download the unmodified files just as I'm being prompted to, but it's only asking to downgrade a small handful of them, and I'm concerned this would cause more problems, rather than solve them.

Kev

Go to <board_url>/admin/upgrade to complete the upgrade 👍🏻

Is the security patch for version 4.7.20 safe to install now? I don't want to break my site rn.

23 minutes ago, Donnie95 said:

Is the security patch for version 4.7.20 safe to install now? I don't want to break my site rn.

It hasn't been unsafe to install the patch. You are less safe without the security patch.

1 hour ago, Stuart Silvester said:

Go to <board_url>/admin/upgrade to complete the upgrade 👍🏻

Thanks! I suspected it would be something like that.

Kev

14 minutes ago, Stuart Silvester said:

It hasn't been unsafe to install the patch. You are less safe without the security patch.

Some members are saying that the patch broke their sites.

Just now, Donnie95 said:

Some members are saying that the patch broke their sites.

The patch is indeed safe to install. For the most part, people who have had issues have had issues hosting side

  • Author
  • Management

The patch is safe. It's a few lines of code.

The people that have been having trouble and been doing things like this:

2 hours ago, Large Scale Planes said:

I realise now that I should have uploaded the new files while the upgrader was paused and waiting, rather than just randomly when it seemed like a good time.

13 hours ago, Matt said:

The patch is safe. It's a few lines of code.

The people that have been having trouble and been doing things like this:

Thanks. I came here for help, not ridicule.

And on that score, on another site I run, I had exactly the same download error while trying to perform the upgrade (it's on the same server, so no surprise there), so attempted to do it the "correct" way, but was met with "no applications to upgrade". I'm now stuck in a loop of being prompted to upgrade, but the upgrade failing to complete.

Kev

OK, so just to wrap up my sorry little saga here, it turns out that (and I'm almost too embarrassed to admit this) I've been uploading all the upgrade files to our old server, not the current one! Classic user error, but of the worst kind - pay attention to the IP address next time! (It didn't help that I had the servers mislabelled in Filezilla).

Anyway, my apologies for wasting everyone's time, though I did in fact learn a few things along the way. Time to see if I can get the v5 upgrade to work now...

Kev

Glad to hear you managed to get things sorted, Kev. Sorry to hear you felt you were being ridiculed there. That really wasn't the case. It just happened to be yours used as an example to say "Look, there isn't an issue with the upgrade itself". Don't want you to feel like you cant ask for help, as that's what we're here for 😊l

On 5/21/2025 at 12:03 AM, Gary said:

Cool, just double checking. 😇

On 5/21/2025 at 2:56 AM, Matt said:

I hear what you're saying but our build system is pretty fixed in its ways. When we release a new build ID (107803) as a git tag, we can name it either something new (4.7.21) or call it the same as the current release and then it'll be detected as a patch. A patch is often an easier path for customers because a full release (new human ID) would mean you'd have to run the upgrader. Also we tend to assign out human IDs a little in advance, so we have a lot of 4.7.21 already done by the time we needed to make a patch, which would mean we'd need to mess with tags in git to reset them to new IDs.

For example, with 5.0.7, we already had a 5.0.8 in beta testing.

We are looking to improve the patch system so that they are surfaced to the dashboard so it is more clear.

There hasn't been a chance in unread icons. The changes were for the oauth call back endpoint and calendar events.

Do you get this resolved? Just upload the files from the zip to the your server, overwriting the existing files.

I still have no 'unread' forum icons in my test env, and I just noticed that after applying the 4.7.21 upgrade into that instance, my version wasn't incremented likewise:

image.png

Needless to say, I'm not installing this into my prod instance.

1 hour ago, z929669 said:

I still have no 'unread' forum icons in my test env, and I just noticed that after applying the 4.7.21 upgrade into that instance, my version wasn't incremented likewise:

image.png

Needless to say, I'm not installing this into my prod instance.

If you installed only the patch, you would remain on 4.7.20. If you opted into beta upgrades and did a full upgrade, you would get 4.7.21 Beta 1.

The upgrade has broken my site. I'm no techie, so have no idea what most of you are talking about and hoping Support can log in remotely soon and sort it out for me. I don't have a local installation and usually just click the 'Upgrade' buttons and let the magic happen.

Now getting error messages:

CANNOT_WRITE
/var/www/html/107811/system/File/Amazon.php::321

AND

SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your secret access key and signing method.

IPS\File\Exception: CANNOT_WRITE (3)

#0 /var/www/html/107811/system/File/File.php(366): IPS\File\_Amazon->save()

#1 /var/www/html/107811/system/Theme/Theme.php(5576): IPS\_File::create('core_Theme', '341e4a57816af3b...', ' :root{--sp-0:0...', 'css_built_0', false, NULL, false)

#2 /var/www/html/107811/system/Theme/Theme.php(2718): IPS\_Theme::writeCss(Array)

#3 /var/www/html/107811/system/Theme/Theme.php(652): IPS\_Theme->compileCss('core', 'global', 'framework', 'framework.css')

#4 /var/www/html/107811/system/Dispatcher/Standard.php(54): IPS\_Theme->css('framework.css', 'core', 'global')

#5 /var/www/html/107811/system/Dispatcher/Admin.php(89): IPS\Dispatcher\_Standard::baseCss()

#6 /var/www/html/107811/system/Dispatcher/Dispatcher.php(110): IPS\Dispatcher\_Admin->init()

#7 /var/www/html/107811/admin/index.php(13): IPS\_Dispatcher::i()

#8 {main}

  • Author
  • Management
12 minutes ago, Em Dee said:

The upgrade has broken my site. I'm no techie, so have no idea what most of you are talking about and hoping Support can log in remotely soon and sort it out for me. I don't have a local installation and usually just click the 'Upgrade' buttons and let the magic happen.

Now getting error messages:

CANNOT_WRITE
/var/www/html/107811/system/File/Amazon.php::321

AND

SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your secret access key and signing method.

IPS\File\Exception: CANNOT_WRITE (3)

#0 /var/www/html/107811/system/File/File.php(366): IPS\File\_Amazon->save()

#1 /var/www/html/107811/system/Theme/Theme.php(5576): IPS\_File::create('core_Theme', '341e4a57816af3b...', ' :root{--sp-0:0...', 'css_built_0', false, NULL, false)

#2 /var/www/html/107811/system/Theme/Theme.php(2718): IPS\_Theme::writeCss(Array)

#3 /var/www/html/107811/system/Theme/Theme.php(652): IPS\_Theme->compileCss('core', 'global', 'framework', 'framework.css')

#4 /var/www/html/107811/system/Dispatcher/Standard.php(54): IPS\_Theme->css('framework.css', 'core', 'global')

#5 /var/www/html/107811/system/Dispatcher/Admin.php(89): IPS\Dispatcher\_Standard::baseCss()

#6 /var/www/html/107811/system/Dispatcher/Dispatcher.php(110): IPS\Dispatcher\_Admin->init()

#7 /var/www/html/107811/admin/index.php(13): IPS\_Dispatcher::i()

#8 {main}

I've just flagged this to the support team, we're on it.

On 5/21/2025 at 12:03 AM, Gary said:

Cool, just double checking. 😇

On 5/21/2025 at 2:56 AM, Matt said:

There hasn't been a chance in unread icons. The changes were for the oauth call back endpoint and calendar events.

I just updated to 4.7.21 in my dev instance, and the forum 'unread' icons are still not working. Only unread icons work. The cause is due to the CSS not properly injecting the custom icon URL for unread (even after I deleted and replaced it). Note the empty string for background-image:

.cForumRow .ipsItemStatus.ipsItemStatus_large.cForumIcon_normal {

width: 50px;

height: 50px;

border-radius: 0;

background-color: transparent;

background-image: url('');

background-size: 50px 50px;

}

For the unread icon, all is well:

.cForumRow .ipsItemStatus.ipsItemStatus_large.cForumIcon_normal.ipsItemStatus_read {

background-image: url('https://stepmodifications.org/forumdev/uploads/set_resources_7/9a13a3adcf2c6671573dabcdd22c5d8d_forum_read.png');

opacity: 0.5;

}

In my prod instance without the security hotfix and running 4.7.20, the image is being properly asserted:

.cForumRow .ipsItemStatus.ipsItemStatus_large.cForumIcon_normal {

width: 50px;

height: 50px;

border-radius: 0;

background-color: transparent;

background-image: url('https://stepmodifications.org/forum/uploads/set_resources_2/9a13a3adcf2c6671573dabcdd22c5d8d_forum_unread-y.png');

background-size: 50px 50px;

}

Could someone look into how this CSS can be fixed or how the upgrade could have caused this issue? I know the security patch installation was the root cause, because it worked prior to that action (I upgrade via the ACP, without manual intervention, as my folder permissions are properly set for that). I have previously upgraded both dev and prod this way for every IPS 4.x update without issue.

It could have been a hiccup in the upgrade process rather than some code change, but I still need to understand the cause or how to resolve before I move to upgrade my prod instance.

Again, I have cleared cache via ACP > Support ... I wonder if I need to actually delete the cache folder itself or if this is more likely a DB issue. Any suggestions appreciated.

Edited by z929669

UPDATE: I have now verified that /set_resources_7/9a13a3adcf2c6671573dabcdd22c5d8d_forum_unread-y.png and several other images were not created in the cache, so it appears to be a cache-behavior issue. Again, I re-uploaded all of my forum icons and reset the ACP system cache after. I did this several times.

I'm unimpressed by the lack of assistance or suggestions on my issues with the upgrade.

10 hours ago, z929669 said:

I'm unimpressed by the lack of assistance or suggestions on my issues with the upgrade.

Hello,

I would just like to remind you that dev/staging instances are unsupported and any support we do provide is as a courtesy.

I tried to take a look, but none of the access details we have on file work for your test/dev community but I did notice that your dev community does not have the latest 4.7.21 files applied which is why you're seeing not seeing 4.7.21 shown in the AdminCP.

I would recommend trying the upgrade again, it's likely that this will fix your issue since it'll do a full import and rebuild of the standard theme resources.

16 hours ago, Stuart Silvester said:

Hello,

I would just like to remind you that dev/staging instances are unsupported and any support we do provide is as a courtesy.

I tried to take a look, but none of the access details we have on file work for your test/dev community but I did notice that your dev community does not have the latest 4.7.21 files applied which is why you're seeing not seeing 4.7.21 shown in the AdminCP.

I would recommend trying the upgrade again, it's likely that this will fix your issue since it'll do a full import and rebuild of the standard theme resources.

Yes, I understand it's a courtesy. I was hoping for just that as a client in good standing for years. Thanks for checking.

How were you able to see that my dev community does not have the 4.7.21 files without access? I had installed the 4.7.20 security hotfix, which triggered the problem. Then I had also installed the 4.7.21 upgrade when it became available shortly thereafter:

image.png

The access info I have on file is with regard to my prod environment, and there's no inputs for my dev environment in the client access details area. I haven't updated anything in prod due to my issues in dev.

I updated my client access info. It applies to prod and dev. Please feel free to have a look at dev using the "Test URL" subdomain.

Recently Browsing 0

  • No registered users viewing this page.

Account

Navigation

Search

Search

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.