Security Update

This is an important security update that should be applied as soon as possible.

Thank you to Aria Akhavan, @Colonel_mortis , Lucas Brönner for reporting some of these issues.

Please see the full change log for further details

Edited Tuesday at 6:35 PM1 day by Stuart
Fixed release note link

When I try from a different browser that isn't logged in, I see this, followed by the rate limiting if I click Complete Upgrade. Ah, the joys of giving up complete control of everything, to be on IC Cloud. 😡

Edited Monday at 9:50 PM2 days by Chris027

Update: Support helped me very quickly.

The waiting while one's site is down, is killing and axiety causing. Thankfully they resovled it.

re: https://invisioncommunity.com/release-notes-v5/5021-r56/

This is an important security focused update, please upgrade as soon as possible.

This update has been automatically applied to Cloud customers.

Just to let you know, this patch has not been applied to my site - I have just started the update myself. I thought I'd mention this in case there has been some sort of omission/oversight of a subsection of Cloud customers.

5 minutes ago, Como said:

re: https://invisioncommunity.com/release-notes-v5/5021-r56/

Just to let you know, this patch has not been applied to my site - I have just started the update myself. I thought I'd mention this in case there has been some sort of omission/oversight of a subsection of Cloud customers.

They have all been patched, even if the upgrader hasnt been run :)

20 hours ago, Stuart said:

Please see the full change log for further details

Release notes in first post are linked to release notes from 4.7.26
This should be the link: https://invisioncommunity.com/release-notes-v5/5021-r56/

@Stuart , is there a way to disable 2FA via constants.php?

I can’t access ACP after updating to 5.0.21. I use 2FA Question and right after updating, I entered the answer correctly, still it said it was wrong and it blocked:

(Failed too many times)

Then clicking on the button, goes to

8 minutes ago, Adriano Faria said:

@Stuart , is there a way to disable 2FA via constants.php?

I can’t access ACP after updating to 5.0.21. I use 2FA Question and right after updating, I entered the answer correctly, still it said it was wrong and it blocked:

(Failed too many times)

Then clicking on the button, goes to

Yes, you can use the DISABLE_MFA constant to temporarily disable 2FA.

https://invisioncommunity.com/4guides/advanced-options/configuration-options/using-constantsphp-r25/

Constant - DISABLE_MFA
Use - Disabled two factor authentication on the system.
Example value - TRUE

Just for you and other people visiting this thread.

1 minute ago, Adriano Faria said:

Is this a known 5.0.21 issue?

Not at this time, but it seems that something odd is going on.

Your error message is from trying to access a front-end module that you don't have permission for. The MFA process does not redirect from the AdminCP to the front-end, you may have something else going on there (maybe a custom Loader extension redirecting the browser?). We did harden the answer verification for the security answers MFA handler.