Security upgrade to 2.2.15 - Quick Patches

"Solution - Upgrade to MODX Revolution 2.2.15. Due to the nature of this issue and the number of files requiring changes the solution is to upgrade. No installable patch or fileset is available for prior versions."

I strongly believe you should be offering a fast ability to patch this without an upgrade install. Surely there is a way to repair this quickly without needing to do full upgrades. It is just not practical for businesses that control hundreds of sites, there needs to be a way to batch patch these.

Please consider making a patch release at least for the last few minor versions (back to 2.2.10 or something). We can't keep asking our clients to pay for these upgrades so frequently.

Marcus,

In my personal opinion, building file patches for previous versions for every security issue is not sustainable nor is it a good practice. We have done so when possible however, when more files get involved and you're trying to backward manage file changes between patches, this could end up with broken sites. It should be expected that the MODX development team will release patch releases at least 6 times per year, not all of these will be security releases. It may be feasible for the development group to create a version to version patch for say 2.2.14 to 2.2.15 but, as I mentioned, patching backward further than that where other files may have been patched along the way becomes increasingly difficult and takes away from developing the future versions.

It's really awesome and exciting to hear you have hundreds of sites to keep up to date. I'll talk to the team about the idea of creating v2v file patches.

MODX's growing popularity is making it an increasing target for hackers and once they've identified a vulnerability in a previous release, it's only a matter of time before it's hacked.

That all said, nothing is impossible. In an ideal world it would be possible for your clients to keep their sites up to date (on a current version) themselves and you'd only need to intervene with minor releases (such as going from 2.2 ot 2.4).

I've asked about this patch issue. With 2.2.15 there are too many files changed for this specific issue. Where possible we will try to provide instructions for short-term manual file patching. We are discussing strategies for making upgrades of large numbers of sites more easy. One such strategy is to use CLI installation/upgrades with pre-scripted automation. There are several MODX folks doing this now in various ways to ensure updating sites quickly and without having to go through the time intensive one at a time method. Obviously this would need to be repeated on a per-platform/server basis.

I also asked about version to version patch files and this is limited by the architecture of Revo and it's need to have the database updated at upgrade. Simply replacing files will not actually complete the process. Again this can be made easier using the CLI Installer/Upgrade.

You can find out more about CLI installs here: http://rtfm.modx.com/revolution/2.x/getting-started/installation/command-line-installation#CommandLineInstallation-DoingaBasicUpgradeMODXviaCLI

Thanks Jay, I certainly understand it is time consuming. In this case, between 2.2.14 and 2.1.5 I can only see about 27 file diffs and when I look at each one I can see probably 5 or so files that look significant.

The problem for us is that it is not just a matter of extracting a zip and running the setup. We have other systems in place to, local versions of teach install, all put into GIT repos, slightly different dynamic configs than the default. Plus the time it takes to test to make sure the upgrade didn't break anything.

If there was just a selection of 20 odd files (looks like only about 30 or so changes occurred in 2.2.14 - 2.2.15 anyway) in a zip that we could extract over the top, that would be awesome.

I don't know the ins and outs of this and the effect on the system. I'll discuss it with members of the dev team to see what they think. I personally have no idea as to what is or isn't feasible or possible.

It would make life a lot simpler for us if there was a up-grader via the manager section like wordpress now has, ( log in, upgrade, check site, log out), this could have a little tick box for automatic upgrades that we could tick once we have done a couple via the manager and nothing breaks, this would definitely make life easier.