We've released a security update for Invision Community 4.7.20 and Invision Community 5.0.7

We recommend that all those using Invision Community update to the latest version as soon as possible.

Please note that Invision Community Cloud and Enterprise customers on either v4 or v5 already have this security update applied.

What does this update do?

This update fixes two issues in Invision Community 4.7.20 and one in Invision Community 5.0.7. We will update this topic with more information when we're confident most customers have upgraded.

These issues were reported to us by Egidio Romano from Karma(In)Security. We thank Egidio for reporting these issues to us as always.

I'm using the self hosted version (Invision Community Classic) on a version older than the latest, what should I do?

You can upgrade to the latest versions of 4.7.20 or 5.0.7 via the AdminCP. Follow the instructions in the banner to upgrade to the latest version which has been updated to include the security update.

I'm using Invision Community 5.0.8 Beta 1, what should I do?

You can upgrade to Invision Community 5.0.8 Beta 2.

I'm using Invision Community Cloud, what should I do?

You don't need to do anything. All packages except Invision Community Classic are already protected even if you're not on the latest version.

If you have any questions, let me know!

Hey @Matt , it's a nice facility within the AdminCP that it auto-detects the version differences (based on the underlying code perspective) and adds a banner to update. The only caveat in this instance is there is already a version 4.7.20 and now a new patched version 4.7.20, there should never be two 4.7.20 versions.

IC seems to follow semver in convention but not practice, as this security fix should have probably been 4.7.21, but I see there is already a 4.7.21 in Beta (https://invisioncommunity.com/release-notes/4721-beta-1-r133/). Given that, this security patch should have been 4.7.22 and that existing 4.7.21 beta never goes beyond beta but instead gets merged into a new 4.7.23. I know it can be a pain to manage, but this would make it clear as to what is included in what version and also display properly in the AdminCP (although the banner helps allude to which version of 4.7.20 is actively running in this case, but that isn't good practice).

And thanks to Egidio Romano for identifying the security issue! 👍

11 hours ago, Clover13 said:

Hey @Matt , it's a nice facility within the AdminCP that it auto-detects the version differences (based on the underlying code perspective) and adds a banner to update. The only caveat in this instance is there is already a version 4.7.20 and now a new patched version 4.7.20, there should never be two 4.7.20 versions.

IC seems to follow semver in convention but not practice, as this security fix should have probably been 4.7.21, but I see there is already a 4.7.21 in Beta (https://invisioncommunity.com/release-notes/4721-beta-1-r133/). Given that, this security patch should have been 4.7.22 and that existing 4.7.21 beta never goes beyond beta but instead gets merged into a new 4.7.23. I know it can be a pain to manage, but this would make it clear as to what is included in what version and also display properly in the AdminCP (although the banner helps allude to which version of 4.7.20 is actively running in this case, but that isn't good practice).

And thanks to Egidio Romano for identifying the security issue! 👍

I hear what you're saying but our build system is pretty fixed in its ways. When we release a new build ID (107803) as a git tag, we can name it either something new (4.7.21) or call it the same as the current release and then it'll be detected as a patch. A patch is often an easier path for customers because a full release (new human ID) would mean you'd have to run the upgrader. Also we tend to assign out human IDs a little in advance, so we have a lot of 4.7.21 already done by the time we needed to make a patch, which would mean we'd need to mess with tags in git to reset them to new IDs.

For example, with 5.0.7, we already had a 5.0.8 in beta testing.

We are looking to improve the patch system so that they are surfaced to the dashboard so it is more clear.

5 hours ago, z929669 said:

I'm currently running 4.7.20 (self-hosted), and this upgrade has rendered all of my custom forum read/unread icons invisible in my dev instance. Re-uploading the icons doesn't resolve, and I can only get the 'unread' icon to reappear upon clicking "Mark site read". After doing so, my unread icons are again invisible after a new post is made until I read the new post, at which point, I get the unread icon again. So the update effectively renders all unread forum icons invisible.

These icons have been in use and working for over ten years, so unless there's been an undisclosed change to the icon format specifications, there's an issue.

Clearing the cache has no impact.

TIA for any suggestions.

There hasn't been a chance in unread icons. The changes were for the oauth call back endpoint and calendar events.

9 hours ago, Large Scale Planes said:

I get a "error downloading update" message for the 4.7.20 version, whereupon I'm asked to upload the files to the server manually and click continue when ready. Where exactly do I upload them, though? Initially I uploaded the ZIP file to forums root directory, and then I tried the unzipped folder, but both were greeted with "no applications to upgrade". So I'm presuming that I didn't upload the files to the correct location. What am I supposed to do?

Kev

Do you get this resolved? Just upload the files from the zip to the your server, overwriting the existing files.

@Marc works fine from admin but the file in client area is 5.0.8 beta 2 not 4.7.21 beta 1

22 hours ago, Matt said:

Do you get this resolved? Just upload the files from the zip to the your server, overwriting the existing files.

Really? So I have navigate into all those directories and copy the files manually via FTP? The last time I had to do that, it took forever! There's gotta be a better way than that! How about more clues as to why the patch couldn't be downloaded? Actually, it gets through the download part, but errors out at "extracting...".

Kev

6 minutes ago, Large Scale Planes said:

Really? So I have navigate into all those directories and copy the files manually via FTP?

No. FTP apps can merge files and folders, so it’s just one action. You don’t have to open any folders at all.

25 minutes ago, Large Scale Planes said:

I realise now that I should have uploaded the new files while the upgrader was paused and waiting, rather than just randomly when it seemed like a good time. Is there any way to invoke the upgrader manually? I guess I could re-download the unmodified files just as I'm being prompted to, but it's only asking to downgrade a small handful of them, and I'm concerned this would cause more problems, rather than solve them.

Kev

Go to <board_url>/admin/upgrade to complete the upgrade 👍🏻

The patch is safe. It's a few lines of code.

The people that have been having trouble and been doing things like this:

2 hours ago, Large Scale Planes said:

I realise now that I should have uploaded the new files while the upgrader was paused and waiting, rather than just randomly when it seemed like a good time.

12 minutes ago, Em Dee said:

The upgrade has broken my site. I'm no techie, so have no idea what most of you are talking about and hoping Support can log in remotely soon and sort it out for me. I don't have a local installation and usually just click the 'Upgrade' buttons and let the magic happen.

Now getting error messages:

CANNOT_WRITE
/var/www/html/107811/system/File/Amazon.php::321

AND

SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your secret access key and signing method.

IPS\File\Exception: CANNOT_WRITE (3)

#0 /var/www/html/107811/system/File/File.php(366): IPS\File\_Amazon->save()

#1 /var/www/html/107811/system/Theme/Theme.php(5576): IPS\_File::create('core_Theme', '341e4a57816af3b...', ' :root{--sp-0:0...', 'css_built_0', false, NULL, false)

#2 /var/www/html/107811/system/Theme/Theme.php(2718): IPS\_Theme::writeCss(Array)

#3 /var/www/html/107811/system/Theme/Theme.php(652): IPS\_Theme->compileCss('core', 'global', 'framework', 'framework.css')

#4 /var/www/html/107811/system/Dispatcher/Standard.php(54): IPS\_Theme->css('framework.css', 'core', 'global')

#5 /var/www/html/107811/system/Dispatcher/Admin.php(89): IPS\Dispatcher\_Standard::baseCss()

#6 /var/www/html/107811/system/Dispatcher/Dispatcher.php(110): IPS\Dispatcher\_Admin->init()

#7 /var/www/html/107811/admin/index.php(13): IPS\_Dispatcher::i()

#8 {main}

I've just flagged this to the support team, we're on it.