Question Upgrade to v3.2.0 Failed

Status
Not open for further replies.

adwade

Customer
I tried to upgrade to the 3.2.0 version and upon trying to install the XML file the window just went blank and nothing else happened. So I waited awhile, but never ever transpired. When I reloaded the Admin Home page I noticed the following message: "There are manual rebuild processed that have been stopped before completion. Click here to complete them."

So I clicked on it and the same thing happened again.(i.e. Blank Page) I reread the Overview page (On Xenforo/Resources) and noticed "PHP 5.6+" is now a requirement. So that may be my problem, as our (shared) server only has 5.4.45

QUESTIONS:
1)How do I back out of this upgrade attempt?
2)How do I address the message I noticed above in my Admin Home page?
3)What was the last version of this add-on that correctly supports PHP 5.4.45?
 
1)How do I back out of this upgrade attempt?
I don't know if this is possible.
2)How do I address the message I noticed above in my Admin Home page?
Try disabling DB Security then click the message's link.
3)What was the last version of this add-on that correctly supports PHP 5.4.45?
I don't believe any version of this mod was designed to be compatible with PHP 5.4, as this version is no longer supported by PHP (meaning your server is likely vulnerable to unpatched security exploits by using such an old version of PHP) we have no intention of supporting it.

I would strongly recommend you look for a better web host.
 
Wow, this is certainly sad news. I understand your recommendation of looking for a better host, however understand we have been with this company for over 10yrs now and things have always worked for us. Also understand, we run a small website on a shoestring budget of just $10/mo, so shopping for a new host and moving everything is pretty much out of the question.

That said, for now I have disabled your add-on and the site seems to be running OK.

I 'was' running v3.0.2 without any issues beforehand, so you're saying I cannot go back to running that version any longer?

Has your v3.2.0 of the add-on caused irreparable damage to my website?

If this is as serious as a problem as you make it sound like, I must say I am a bit surprised that your add-on does not check the version of PHP that is running when an install or an upgrade it attempted. After all, I would at least expect a warning somewhere that moving forward to a newer version cannot be un-done. In all my years (i.e. over a decade) of running a forum, I've never had an add-on to do this, so you can imagine my surprise.
 
Also, here is one (of five) of what appears to be identical server error messages...

Code:
Error Info
ErrorException: Fatal Error: Call to undefined method XenForo_Helper_Php::safeUnserialize() - library/DBTech/Security/XenForo/Model/Language.php:15
Generated By: A.D., Today at 3:29 AM
Stack Trace

#0 [internal function]: XenForo_Application::handleFatalError()
#1 {main}

Request State

array(3) {
  ["url"] => string(62) "http://www.recumbentriders.org/forums/admin.php?add-ons/toggle"
  ["_GET"] => array(1) {
    ["add-ons/toggle"] => string(0) ""
  }
  ["_POST"] => array(7) {
    ["filter"] => string(0) ""
    ["exists"] => array(111) {
      ["xenCODE_KeywordsMeta"] => string(1) "1"
      ["AboutUs"] => string(1) "1"
      ["AcpErrorMail"] => string(1) "1"
      ["AddOnInstaller"] => string(1) "1"
      ["Addons"] => string(1) "1"
      ["AdvancedSearch"] => string(1) "1"
      ["SV_AlertImprovements"] => string(1) "1"
      ["BBCodeParser"] => string(1) "1"
      ["liam_showBirthYear"] => string(1) "1"
      ["Bookmark"] => string(1) "1"
      ["Calendar"] => string(1) "1"
      ["ChangeAuthor"] => string(1) "1"
      ["ChangeDate"] => string(1) "1"
      ["ChangeLimit"] => string(1) "1"
      ["sv_comtactusthread"] => string(1) "1"
      ["SV_ConvImprovements"] => string(1) "1"
      ["ConversationReplyLimit"] => string(1) "1"
      ["ConversationSearch"] => string(1) "1"
      ["ConversationsPrune"] => string(1) "1"
      ["ConvertImage"] => string(1) "1"
      ["XMCrowdModeration"] => string(1) "1"
      ["siropu_custom_tabs"] => string(1) "1"
      ["Donations"] => string(1) "1"
      ["dbtech_security"] => string(1) "1"
      ["EmailLog"] => string(1) "1"
      ["SV_EmailQueue"] => string(1) "1"
      ["EnableDebugFromAdminHome"] => string(1) "1"
      ["ExportThread"] => string(1) "1"
      ["FlagPost"] => string(1) "1"
      ["FMS_Print_Message"] => string(1) "1"
      ["ForumListCount"] => string(1) "1"
      ["ForumViewCount"] => string(1) "1"
      ["SolidMean_ForumBackup"] => string(1) "1"
      ["Sedo_GoToTop"] => string(1) "1"
      ["GFN404"] => string(1) "1"
      ["GPXViewer"] => string(1) "1"
      ["HeaderThumbs"] => string(1) "1"
      ["History"] => string(1) "1"
      ["HistoryPlus"] => string(1) "1"
      ["iwdConversations"] => string(1) "1"
      ["InactiveMembers"] => string(1) "1"
      ["InsertAttachment"] => string(1) "1"
      ["InsertAttachmentAll"] => string(1) "1"
      ["Instagram"] => string(1) "1"
      ["SolidMean_IPInContactMail"] => string(1) "1"
      ["JumpToPerms"] => string(1) "1"
      ["LinkCheck"] => string(1) "1"
      ["LiveUpdate"] => string(1) "1"
      ["liam_loginasuser"] => string(1) "1"
      ["MemberSearch"] => string(1) "1"
      ["Faqe_MemberlistSorting"] => string(1) "1"
      ["MembersOnline"] => string(1) "1"
      ["NewMembers"] => string(1) "1"
      ["Awedo_NewPostsAndThreads"] => string(1) "1"
      ["NewPostsResponsive"] => string(1) "1"
      ["NodesAsTabs"] => string(1) "1"
      ["OpenPDF"] => string(1) "1"
      ["PostReplace"] => string(1) "1"
      ["ProfilePage"] => string(1) "1"
      ["QuickLinks"] => string(1) "1"
      ["quoteME"] => string(1) "1"
      ["RegisterEmail"] => string(1) "1"
      ["RegisterTimezone"] => string(1) "1"
      ["RemoveDateOfBirth"] => string(1) "1"
      ["RemoveLastEdited"] => string(1) "1"
      ["RemoveNotableMembers"] => string(1) "1"
      ["RemoveSearchForums"] => string(1) "1"
      ["RemoveSignature"] => string(1) "1"
      ["RemoveStayLoggedIn"] => string(1) "1"
      ["ResetPasswordFromACP"] => string(1) "1"
      ["Robots"] => string(1) "1"
      ["Rotate"] => string(1) "1"
      ["Rsvp"] => string(1) "1"
      ["SVSeperateStickyAndNormal"] => string(1) "1"
      ["SidebarDonations"] => string(1) "1"
      ["SidebarPositions"] => string(1) "1"
      ["SimilarThreads"] => string(1) "1"
      ["Statistics"] => string(1) "1"
      ["TabAlerts"] => string(1) "1"
      ["FilterTemplatesByAddOn"] => string(1) "1"
      ["ThreadViewCount"] => string(1) "1"
      ["ThreadWatchers"] => string(1) "1"
      ["toggle_menu"] => string(1) "1"
      ["TopThreads"] => string(1) "1"
      ["TPUOldThreadWarning"] => string(1) "1"
      ["Unvote"] => string(1) "1"
      ["UserAgent"] => string(1) "1"
      ["SV_UsernameRestrictions"] => string(1) "1"
      ["ViewMap"] => string(1) "1"
      ["ViewYourPosts"] => string(1) "1"
      ["vigLink"] => string(1) "1"
      ["WatchedForumsEmail"] => string(1) "1"
      ["XenNotices"] => string(1) "1"
      ["aTemplateSecurity"] => string(1) "1"
      ["phc_MassBanEMails"] => string(1) "1"
      ["phc_KeywordManagement"] => string(1) "1"
      ["AutoHighlightPermalink"] => string(1) "1"
      ["CButtonUnderAvatar"] => string(1) "1"
      ["FontAwesomeSwitch"] => string(1) "1"
      ["YourContentInVisitorPanel"] => string(1) "1"
      ["administrateForum"] => string(1) "1"
      ["FHSignatureOnce"] => string(1) "1"
      ["hCollapseAddons"] => string(1) "1"
      ["kl_password_tools"] => string(1) "1"
      ["nobita_AvatarAlive"] => string(1) "1"
      ["nobita_avatarUrl"] => string(1) "1"
      ["RainDD_UserActivity"] => string(1) "1"
      ["ssd_newposts"] => string(1) "1"
      ["tc_ordertmgroups_alphab"] => string(1) "1"
      ["WGBB_Notes"] => string(1) "1"
      ["wmt_socialshareprivacy"] => string(1) "1"
    }
    ["id"] => array(104) {
      ["xenCODE_KeywordsMeta"] => string(1) "1"
      ["AboutUs"] => string(1) "1"
      ["AcpErrorMail"] => string(1) "1"
      ["AddOnInstaller"] => string(1) "1"
      ["Addons"] => string(1) "1"
      ["AdvancedSearch"] => string(1) "1"
      ["SV_AlertImprovements"] => string(1) "1"
      ["BBCodeParser"] => string(1) "1"
      ["liam_showBirthYear"] => string(1) "1"
      ["Bookmark"] => string(1) "1"
      ["Calendar"] => string(1) "1"
      ["ChangeAuthor"] => string(1) "1"
      ["ChangeDate"] => string(1) "1"
      ["ChangeLimit"] => string(1) "1"
      ["sv_comtactusthread"] => string(1) "1"
      ["SV_ConvImprovements"] => string(1) "1"
      ["ConversationReplyLimit"] => string(1) "1"
      ["ConversationSearch"] => string(1) "1"
      ["ConversationsPrune"] => string(1) "1"
      ["ConvertImage"] => string(1) "1"
      ["XMCrowdModeration"] => string(1) "1"
      ["siropu_custom_tabs"] => string(1) "1"
      ["Donations"] => string(1) "1"
      ["EmailLog"] => string(1) "1"
      ["SV_EmailQueue"] => string(1) "1"
      ["EnableDebugFromAdminHome"] => string(1) "1"
      ["ExportThread"] => string(1) "1"
      ["FlagPost"] => string(1) "1"
      ["FMS_Print_Message"] => string(1) "1"
      ["ForumListCount"] => string(1) "1"
      ["ForumViewCount"] => string(1) "1"
      ["SolidMean_ForumBackup"] => string(1) "1"
      ["Sedo_GoToTop"] => string(1) "1"
      ["GFN404"] => string(1) "1"
      ["GPXViewer"] => string(1) "1"
      ["HeaderThumbs"] => string(1) "1"
      ["History"] => string(1) "1"
      ["HistoryPlus"] => string(1) "1"
      ["iwdConversations"] => string(1) "1"
      ["InactiveMembers"] => string(1) "1"
      ["InsertAttachment"] => string(1) "1"
      ["Instagram"] => string(1) "1"
      ["SolidMean_IPInContactMail"] => string(1) "1"
      ["JumpToPerms"] => string(1) "1"
      ["LinkCheck"] => string(1) "1"
      ["LiveUpdate"] => string(1) "1"
      ["liam_loginasuser"] => string(1) "1"
      ["MemberSearch"] => string(1) "1"
      ["Faqe_MemberlistSorting"] => string(1) "1"
      ["MembersOnline"] => string(1) "1"
      ["NewMembers"] => string(1) "1"
      ["Awedo_NewPostsAndThreads"] => string(1) "1"
      ["NewPostsResponsive"] => string(1) "1"
      ["NodesAsTabs"] => string(1) "1"
      ["OpenPDF"] => string(1) "1"
      ["ProfilePage"] => string(1) "1"
      ["QuickLinks"] => string(1) "1"
      ["quoteME"] => string(1) "1"
      ["RegisterEmail"] => string(1) "1"
      ["RegisterTimezone"] => string(1) "1"
      ["RemoveDateOfBirth"] => string(1) "1"
      ["RemoveLastEdited"] => string(1) "1"
      ["RemoveNotableMembers"] => string(1) "1"
      ["RemoveSearchForums"] => string(1) "1"
      ["RemoveSignature"] => string(1) "1"
      ["RemoveStayLoggedIn"] => string(1) "1"
      ["ResetPasswordFromACP"] => string(1) "1"
      ["Robots"] => string(1) "1"
      ["Rotate"] => string(1) "1"
      ["Rsvp"] => string(1) "1"
      ["SVSeperateStickyAndNormal"] => string(1) "1"
      ["SidebarDonations"] => string(1) "1"
      ["SidebarPositions"] => string(1) "1"
      ["SimilarThreads"] => string(1) "1"
      ["Statistics"] => string(1) "1"
      ["TabAlerts"] => string(1) "1"
      ["FilterTemplatesByAddOn"] => string(1) "1"
      ["ThreadViewCount"] => string(1) "1"
      ["ThreadWatchers"] => string(1) "1"
      ["TopThreads"] => string(1) "1"
      ["TPUOldThreadWarning"] => string(1) "1"
      ["UserAgent"] => string(1) "1"
      ["SV_UsernameRestrictions"] => string(1) "1"
      ["ViewMap"] => string(1) "1"
      ["ViewYourPosts"] => string(1) "1"
      ["vigLink"] => string(1) "1"
      ["WatchedForumsEmail"] => string(1) "1"
      ["XenNotices"] => string(1) "1"
      ["aTemplateSecurity"] => string(1) "1"
      ["phc_MassBanEMails"] => string(1) "1"
      ["phc_KeywordManagement"] => string(1) "1"
      ["AutoHighlightPermalink"] => string(1) "1"
      ["CButtonUnderAvatar"] => string(1) "1"
      ["FontAwesomeSwitch"] => string(1) "1"
      ["YourContentInVisitorPanel"] => string(1) "1"
      ["FHSignatureOnce"] => string(1) "1"
      ["hCollapseAddons"] => string(1) "1"
      ["nobita_AvatarAlive"] => string(1) "1"
      ["nobita_avatarUrl"] => string(1) "1"
      ["RainDD_UserActivity"] => string(1) "1"
      ["ssd_newposts"] => string(1) "1"
      ["tc_ordertmgroups_alphab"] => string(1) "1"
      ["WGBB_Notes"] => string(1) "1"
      ["wmt_socialshareprivacy"] => string(1) "1"
    }
    ["_xfToken"] => string(8) "********"
    ["_xfRequestUri"] => string(26) "/forums/admin.php?add-ons/"
    ["_xfNoRedirect"] => string(1) "1"
    ["_xfResponseType"] => string(4) "json"
  }
}
 
Wow, this is certainly sad news. I understand your recommendation of looking for a better host, however understand we have been with this company for over 10yrs now and things have always worked for us. Also understand, we run a small website on a shoestring budget of just $10/mo, so shopping for a new host and moving everything is pretty much out of the question.
There are certainly several hosts within that budget, not to mention VPS services within that budget that would allow you to control your own PHP version.

However, if loyalty to your host is more important to you than the security of your site, I can only say that I hope you (and/or all your members) are not using the same or similar passwords on your site as you (and/or all your members) are using anywhere else on the internet.

I 'was' running v3.0.2 without any issues beforehand, so you're saying I cannot go back to running that version any longer?
Downgrading is not supported. You may be able to uninstall the mod and re-install the older version.

Has your v3.2.0 of the add-on caused irreparable damage to my website?
I can't answer that. I can tell you that by design, modifications cannot cause irreparable damage unless they are specifically crafted to be malicious, but that is during normal operations. When installations are half-done, I cannot say what may or may not happen, but I doubt any damage would be irreparable.

If this is as serious as a problem as you make it sound like, I must say I am a bit surprised that your add-on does not check the version of PHP that is running when an install or an upgrade it attempted. After all, I would at least expect a warning somewhere that moving forward to a newer version cannot be un-done. In all my years (i.e. over a decade) of running a forum, I've never had an add-on to do this, so you can imagine my surprise.
If XenForo had a PHP version / XenForo version limitation option (like vBulletin does), we would have taken advantage of it :)

I will do some research to see if it's possible to halt installation if the PHP version is too low.

ErrorException: Fatal Error: Call to undefined method XenForo_Helper_Php::safeUnserialize()
EDIT: I have discovered that the method I'm calling only exists in XenForo v1.5.3 and newer. Is it possible for you to upgrade to that version?
 
Last edited:
Fillip H. said:
Can you open /library/XenForo/Helper/Php.php and see if it contains this block of code:

PHP:
---------
/**
* Unserializes a string, avoiding unserializing potentially dangerous objects.
*
* In PHP7, if an object is present, unserialization will happen but with the object becoming in complete.
* In previous versions, if an object is present, unserialization will fail and false will be returned.
*
* See serializedContainsObject for comments on false positives.
*
* @param string $serialized
*
* @return bool|mixed
*/
public static function safeUnserialize($serialized)
{
if (PHP_VERSION_ID >= 70000)
{
// PHP 7 has an option to disable unserializing objects, so use that if available
return @unserialize($serialized, array('allowed_classes' => false));
}

if (self::serializedContainsObject($serialized))
{
return false;
}

return @unserialize($serialized);
}
I do not think it does. The file is dated 11/18/15 and I assume is from v1.5.2

CORRECTION, the file looks to be from my original install of v1.5.0

The contents of such are shown below...
Code:
<?php

class XenForo_Helper_Php
{
	/**
	 * Validates a callback more strictly and with more detailed errors.
	 *
	 * @param string|object|array $class A class name, object, function name, or array containing class/object and method
	 * @param null|string $method If first param is class or object, the method name
	 * @param string $error Error key returned by reference
	 * @param bool $forceMethod If true, if no method is provided, never treat the class as a function
	 *
	 * @return bool
	 *
	 * @throws InvalidArgumentException
	 */
	public static function validateCallback($class, $method = null, &$error = null, $forceMethod = true)
	{
		if (is_array($class))
		{
			if ($method)
			{
				throw new InvalidArgumentException('Method cannot be provided with class as array');
			}

			$method = $class[1];
			$class = $class[0];
		}

		if ($forceMethod)
		{
			$method = strval($method);
		}
		else
		{
			if (!$method)
			{
				if (is_object($class))
				{
					throw new InvalidArgumentException('Object given with no method');
				}

				if (!function_exists($class))
				{
					$error = 'invalid_function';
					return false;
				}
				else
				{
					return true;
				}
			}
		}

		if (!is_string($method))
		{
			throw new InvalidArgumentException('Method to check is not a string');
		}

		if (!is_object($class))
		{
			if (!$class || !class_exists($class))
			{
				$error = 'invalid_class';
				return false;
			}
		}

		$reflectionClass = new ReflectionClass($class);
		$isObject = is_object($class);

		if (
			($isObject && $reflectionClass->hasMethod('__call'))
			|| (!$isObject && $reflectionClass->hasMethod('__callStatic'))
		)
		{
			// magic method will always be called if a method can't be
			return true;
		}

		if (!$method || !$reflectionClass->hasMethod($method))
		{
			$error = 'invalid_method';
			return false;
		}

		$reflectionMethod = $reflectionClass->getMethod($method);

		if ($reflectionMethod->isAbstract() || !$reflectionMethod->isPublic())
		{
			$error = 'invalid_method_configuration';
			return false;
		}

		$isStatic = $reflectionMethod->isStatic();

		if ($isStatic && $isObject)
		{
			$error = 'method_static';
			return false;
		}
		else if (!$isStatic && !$isObject)
		{
			$error = 'method_not_static';
			return false;
		}

		return true;
	}

	/**
	 * Does a detailed validation of a callback and returns the error
	 * in a ready to print phrase
	 *
	 * @param string|object|array $class A class name, object, function name, or array containing class/object and method
	 * @param null|string $method If first param is class or object, the method name
	 * @param null|XenForo_Phrase $errorPhrase If an error occurs, outputs the phrase
	 * @param bool $forceMethod If true, if no method is provided, never treat the class as a function
	 *
	 * @return bool
	 */
	public static function validateCallbackPhrased($class, $method = null, &$errorPhrase = null, $forceMethod = true)
	{
		$success = self::validateCallback($class, $method, $error, $forceMethod);
		if ($success)
		{
			return true;
		}

		$printableCallback = self::getPrintableCallback($class, $method);
		$innerErrorPhrase = new XenForo_Phrase('error_' . $error);

		$errorPhrase = new XenForo_Phrase('callback_x_invalid_y', array(
			'callback' => $printableCallback,
			'error' => $innerErrorPhrase
		));

		return false;
	}

	/**
	 * Returns a callback in a simple printable form
	 *
	 * @param string|object|array $class A class name, object, function name, or array containing class/object and method
	 * @param null|string $method If first param is class or object, the method name
	 *
	 * @return string
	 *
	 * @throws InvalidArgumentException
	 */
	public static function getPrintableCallback($class, $method = null)
	{
		if (is_array($class))
		{
			if ($method)
			{
				throw new InvalidArgumentException('Method cannot be provided with class as array');
			}

			$method = $class[1];
			$class = $class[0];
		}

		if (!$method)
		{
			if (is_object($class))
			{
				throw new InvalidArgumentException('Object given with no method');
			}

			return strval($class);
		}

		if (!is_string($method))
		{
			throw new InvalidArgumentException('Method must be a string when given an object');
		}

		if (is_object($class))
		{
			return get_class($class) . '->' . $method;
		}
		else
		{
			return $class . '::' . $method;
		}
	}
}
 
Last edited:
EDIT: I have discovered that the method I'm calling only exists in XenForo v1.5.3 and newer. Is it possible for you to upgrade to that version?
Ideally yes, but for now what I am more concerned about is keeping our website up & running. So for the moment, I'm just trying to find a breadcrumb trail to lead me back out of the v3.2.0 upgrade attempt.(i.e. I'd first like to repair any damage done, before attempting to add more possible problems into the mix and unnecessarily complicate things beyond my ability to recover.)
 
Yeah, I've discovered that the function used to secure parts of our products was added over a year ago to v1.5.3.

Also, I've discovered how to halt installation of our products if the XenForo and PHP versions do not meet the minimum requirement, so going forward this won't be an issue.

If you uninstall the new version and reinstall the version you last had installed, the old version should continue to work fine. I do apologise for the inconvenience :(
 
This is good news for now, so I'll try that and let you know how it goes.

One other question, after I un-install v3.2.0 do I need to delete the directories your add-on uses on my server -or- just re-upload the v3.0.2 files like I normally do?
 
I would delete the /library/DBTech/Security directory after uninstallation, just to be absolutely sure you have all the old files and not the new. It certainly won't hurt to do so :)
 
Everything seemed to go fine and to my knowledge things are back on-track again. Now just a few other questions:

1)In v3.1.0 of your add-on it states: "Fix: Setting password expiry to Unlimited could result in a password changing loop in certain circumstances" Do you think that version of your add-on would work for me?(i.e. I'd like to upgrade to the best possible version.)

2)If/when I do upgrade XF to v1.5.3 what will that get me? By that, I mean will my current v3.0.2 of your add-on stop working? -or- Would doing so allow me to run a newer version of your add-on?

3)"I have discovered that the method I'm calling only exists in XenForo v1.5.3 and newer." Does this imply that I would be able to upgrade to v3.2.0 of your add-on, if/when I move up to XF v1.5.3...but am still running v5.4.45 of PHP?
 
Honestly, I have no idea whether or not DragonByte Security will work on PHP 5.4. I do know for a fact that the blank page you experienced was a result of you running a very old version of XenForo.

The reason why I set 5.6 as the requirements for all our XenForo mods is two-fold:
1. I wish to encourage people keeping up to date with the currently supported version of PHP. I don't want to be a contributor to people running old, unsecured versions of PHP on their servers.
2. I discovered that during development of DragonByte Shop, I had inadvertently used a PHP 5.6-only feature. Rather than go back and re-do large portions of the mod, I modified the version requirement.

I didn't actively try to exclude older versions of PHP, it was just an unfortunate happenstance in this particular circumstance.

If you want to try upgrading again after upgrading XenForo (please do upgrade to 1.5.11, not just 1.5.3 :p), feel free - just remember the steps you had to do to downgrade Security again and be ready to repeat them if need be.

Don't worry, if it ends up not working you will see errors appear immediately. I see no reason to suspect there will be a tiny, unused portion of the mod that will crash your site in the middle of the night when no-one's watching :p
 
Hello adwade,

This ticket has now been closed with the status Answered.

We hope your issue or question has been addressed to your satisfaction. If not, please feel free to re-open it by clicking this link.

If you have any further issues or questions, please feel free to start a new support ticket via the button at the top of every page.

Thank you!
 
Status
Not open for further replies.

DragonByte Security

XenForo 1.5.3+ XenForo 2.0.x XenForo 2.1.x XenForo 2.2.x
Seller
DragonByte Technologies
Release date
Last update
Total downloads
2,202
Customer rating
5.00 star(s) 1 ratings
Top