Security Update

This is an important security update that should be applied as soon as possible.

Thank you to Aria Akhavan, @Colonel_mortis , Lucas Brönner for reporting some of these issues.

Please see the full change log for further details

Edited Tuesday at 6:35 PM1 day by Stuart
Fixed release note link

Updated and got rate limited in the middle of it. Now my site is down.

Can't even access /admin/upgrade anymore without the rate limit message.

Edited Monday at 9:39 PM2 days by Chris027

1 minute ago, Chris027 said:

Updated and got rate limited in the middle of it. Now my site is down.

I managed to upgrade it successfully. I'm relieved!

Getting all three messages at once.

When I try from a different browser that isn't logged in, I see this, followed by the rate limiting if I click Complete Upgrade. Ah, the joys of giving up complete control of everything, to be on IC Cloud. 😡

Edited Monday at 9:50 PM2 days by Chris027

Please submit a ticket for any issues with an upgrade.

Ticket sibmitted already. I was unsure if you guys dropped the update and went home, and hopefully anyone here could help.

In the middle of the upgrade, I got the Cloudflare human detector. After that passed, the upgrade lost it's formatting and was just a page refreshing with all the languages it was updating and theme updates. Then I got rate limited.

We haven't, we're looking into it!

Update: Support helped me very quickly.

The waiting while one's site is down, is killing and axiety causing. Thankfully they resovled it.

re: https://invisioncommunity.com/release-notes-v5/5021-r56/

This is an important security focused update, please upgrade as soon as possible.

This update has been automatically applied to Cloud customers.

Just to let you know, this patch has not been applied to my site - I have just started the update myself. I thought I'd mention this in case there has been some sort of omission/oversight of a subsection of Cloud customers.

5 minutes ago, Como said:

re: https://invisioncommunity.com/release-notes-v5/5021-r56/

Just to let you know, this patch has not been applied to my site - I have just started the update myself. I thought I'd mention this in case there has been some sort of omission/oversight of a subsection of Cloud customers.

They have all been patched, even if the upgrader hasnt been run :)

1 hour ago, Marc said:

They have all been patched, even if the upgrader hasnt been run :)

Ah. I see.

20 hours ago, Stuart said:

Please see the full change log for further details

Release notes in first post are linked to release notes from 4.7.26
This should be the link: https://invisioncommunity.com/release-notes-v5/5021-r56/

Alright, the update started and then, this....

There’s a spinning icon with a “d” underneath – Something seems to have frozen. Is it worth waiting a bit longer, or should I restore a backup? Or do something else?

This is the first time an update has caused problems in all the years we’ve had automatic updates. 😬

Update: I went back to the upgrade start page, had to log in again, and it worked as it should!

Was quite stressed there for a moment! 😅

Edited Tuesday at 9:21 PM1 day by acarlsson

@Stuart , is there a way to disable 2FA via constants.php?

I can’t access ACP after updating to 5.0.21. I use 2FA Question and right after updating, I entered the answer correctly, still it said it was wrong and it blocked:

(Failed too many times)

Then clicking on the button, goes to

8 minutes ago, Adriano Faria said:

@Stuart , is there a way to disable 2FA via constants.php?

I can’t access ACP after updating to 5.0.21. I use 2FA Question and right after updating, I entered the answer correctly, still it said it was wrong and it blocked:

(Failed too many times)

Then clicking on the button, goes to

Yes, you can use the DISABLE_MFA constant to temporarily disable 2FA.

https://invisioncommunity.com/4guides/advanced-options/configuration-options/using-constantsphp-r25/

Constant - DISABLE_MFA
Use - Disabled two factor authentication on the system.
Example value - TRUE

Just for you and other people visiting this thread.

7 minutes ago, Stuart said:

Yes, you can use the DISABLE_MFA constant to temporarily disable 2FA.

Is this a known 5.0.21 issue?

1 minute ago, Adriano Faria said:

Is this a known 5.0.21 issue?

Not at this time, but it seems that something odd is going on.

Your error message is from trying to access a front-end module that you don't have permission for. The MFA process does not redirect from the AdminCP to the front-end, you may have something else going on there (maybe a custom Loader extension redirecting the browser?). We did harden the answer verification for the security answers MFA handler.

15 minutes ago, Stuart said:

maybe a custom Loader extension redirecting the browser

Certainly, since I use some custom apps. Anyway, it had been working fine since IPS 5.0 Beta and only stopped working with 5.0.21.

16 minutes ago, Stuart said:

We did harden the answer verification for the security answers MFA handler.

It’s probably something in here. I’ll compare version 5.0.20 with the latest version and see if I can find the culprit.

1 hour ago, Stuart said:

We did harden the answer verification for the security answers MFA handler.

I suspect the issue may be related to the change from == to === in system/MFA/SecurityQuestions/Handler.php.

My security answers are numeric. Changing it back to == allowed me to access the ACP. Interestingly, after restoring ===, authentication continued to work, even in an incognito session.

I can't reproduce the issue consistently, but this change seems worth investigating.

But before that, I had to reset the failed MFA attempts directly in the database to regain access:

UPDATE core_members SET failed_mfa_attempts = 0 WHERE member_id = MEMBER_ID;

I suspect the stricter comparison introduced in 5.0.21 may have broken compatibility with some existing security answers, particularly numeric ones.

Edited 22 hours ago22 hr by Adriano Faria

@Adriano Faria === also compares the data type. So if a value numeric are stored as string, and submitted awnser is int, then it fails.
Would log both data types of awnser and stored answer to see the diffrence in data type.

As far as I can tell, Request::i()->security_answer and Encrypt::decrypt() both return strings, so I wouldn't expect a data type mismatch here.

I'll check both values if the issue happens again. For now, authentication is working with === again, without changing any of my existing answers.

I just tried to upgrade and got this error

Email address or password incorrect. Make sure you are providing the details that you use to log into the IPS Client Area at invisioncommunity.com/clientarea.

But my details are correct ?

This can only happen if. those details are incorrect or it cannot contact for whatever reason