Version 1.5.4 Is Released

[David]

Version 1.5.4 contains a few updates.  This release contains a few critical security updates regarding attachement control.  A few bugs have also been fixed.

If you are upgrading from 1.5.3 please use the update package or mod.

All files can be found here on SourceForge.
https://sourceforge.net/project/showfiles.php?group_id=57105&release_id=166159

A YaBBpak version of this update can be found here:
http://www.yabbse.org/packages/bugs

Upgrade paths
1.3.0 -> 1.4.1 (upgrade) -> 1.5.4 (upgrade)
1.4.x -> 1.5.4 (upgrade)
1.5.0 -> 1.5.4 (upgrade)
1.5.1 RC1 -> 1.5.1 (update) -> 1.5.2 (update) -> 1.5.3 (update) -> 1.5.4 (update)
1.5.1 -> 1.5.2 (update) -> 1.5.3 (update) -> 1.5.4 (update)
1.5.2 -> 1.5.3 (update) -> 1.5.4 (update)
1.5.3 -> 1.5.4 (update)

Alternative upgrade paths
1.5.1 RC1 -> 1.5.1 (update) -> 1.5.4 (upgrade; don't execute upgrade.php)
1.5.1 -> -> 1.5.4 (upgrade; don't execute upgrade.php)
1.5.2 ->  -> 1.5.4 (upgrade; don't execute upgrade.php)

[Meriadoc]

just like to say that the notify email got through to me

[VZey]

yep i got it too!

[AnalogDuck]

What versions of YaBBSE does the security patch address? I have stable (and heavily hacked) installs of 1.3 and 1.4 on some sites. Do they need to be updated immediately, or does this security udpdate only address 1.5.x?

BTW, thank you for the email notification. I definitely appreciate hearing from the YaBBSE community regarding updates -- especially when they're security updates!  

-- AnalogDuck

[[Unknown]]

What versions of YaBBSE does the security patch address? I have stable (and heavily hacked) installs of 1.3 and 1.4 on some sites. Do they need to be updated immediately, or does this security udpdate only address 1.5.x?

BTW, thank you for the email notification. I definitely appreciate hearing from the YaBBSE community regarding updates -- especially when they're security updates!  

-- AnalogDuck

You are way behind the times.  1.3.x and 1.4.x are definitely not up to security standards... let's just say if you gave me a link I could give you my new admin account on any board below 1.5.1.....

-[Unknown]

[AnalogDuck]

Good to know. I guess it's time to patch those old boards then.

Thanks for the frankness.

-- AnalogDuck

[Aeon]

1.5.1 was no risk (when it was released)
1.5.2 HUGE security updates and bug fixes (when it was released)
1.5.3 some additional security bugs fixes (when it was released)
1.5.4 another security bugs fixes (when it was released)
1.5.x .......

can't we see a bug-free release ?
I am not offending but now I know why many companies banned YabbSE !!
hey don't get it wrong .. I love YabbSE and I am still using it ... but  

[HyperDev]

I only like YaBB SE because it looks nice enough for me and it took about 8 seconds to install, whereas when I tried phpbb and IPB, it took a couple years (almost).

[David]

can't we see a bug-free release ?

There is no such thing.  Go search security trackers for vB or phpBB2, they have just as many if not more issues then we do.

YaBBSE - 6 to 15 depending on search terms

vB - 65 results
http://www.securityfocus.com/search?category=23&query=vb&rank=&submit=Search

phpBB2 - 7 results
http://www.securityfocus.com/search?category=23&query=phpbb2&rank=&submit=Search

invision board - 4 results
http://www.securityfocus.com/search?category=23&query=invision+board&rank=&submit=Search

[AnalogDuck]

Definitely. And I don't believe that there is another community out there as vibrant as the YaBBSE community. At least issues get addressed with YaBBSE -- and *quick*.

-- AnalogDuck

[Aeon]

can't we see a bug-free release ?

There is no such thing.  Go search security trackers for vB or phpBB2, they have just as many if not more issues then we do.

vB - 65 results
http://www.securityfocus.com/search?category=23&query=vb&rank=&submit=Search

phpBB2 - 7 results
http://www.securityfocus.com/search?category=23&query=phpbb2&rank=&submit=Search

invision board - 4 results
http://www.securityfocus.com/search?category=23&query=invision+board&rank=&submit=Search

I know there is nothing like that ... but I meant major security bugs-free release ... I wouldn't care for minor bugs ...

[Zeke]

I can upgrade from 1.5.1 all that way to 1.5.4 right? Without installing or upgrading to 1.5.2 or 1.5.3? Right?

[David]

I can upgrade from 1.5.1 all that way to 1.5.4 right? Without installing or upgrading to 1.5.2 or 1.5.3? Right?

Yes, use the UPGRADE package, not UPDATE.

[[Unknown]]

I know there is nothing like that ... but I meant major security bugs-free release ... I wouldn't care for minor bugs ...

Look, there's always another security hole.  There are holes in WINDOWS.  I mean, do you realize that 90% of the updates that you get on windowsupdate (they come out every few weeks...) are security fixes?!  Do you think that you own ANY software that has no holes in it?  If you do, you are nieve beyond belief.

Most security holes are fixed after they are found by some other group and exploited.  No one was exploited through these bugs, as far as we know.  I found two of them, Christian Land found two others, and Compuart patched them  (plus another hole).  No one else even knew they existed.

So be glad we're still checking.... especially when we're working on the next release which didn't have any of these bugs.... . (it has a different architecture, and mostly has bugs not holes.)

-[Unknown]

[Zeke]

I can upgrade from 1.5.1 all that way to 1.5.4 right? Without installing or upgrading to 1.5.2 or 1.5.3? Right?

Yes, use the UPGRADE package, not UPDATE.

crap >.< I used that one....Know what?