I cannot update to Joomla version 3.6.4 because core files have been changed. I am stuck at 3.4.6

I still want to protect against the vulnerabilities mentioned in https://www.joomla.org/announcements/release-news/5678-joomla-3-6-4-released.html

Are there alternatives to manually going through and merging the core files between my version and the fixed version?

We do have security plugins like RSFirewall installed.

1 Answer 1


GRR stop modifying core files!

Apart from some basic XML files being updated to cater for the version, only 3 actual core PHP files were updated to fix the security exploit.

  • administrator\components\com_users\models\user.php
  • components\com_users\controller\user.php
  • libraries\fof\encrypt\aes.php

I assume, well....I hope, you haven't started modifying these so the update should be fine.

Word of advice, if you need to change the way Joomla behaves, create a system plugin. That's what they're there for!

  • 1
    It wasn't me - I am picking up from someone else who did the site :/ Thanks for this help!
    – Kater89
    Commented Oct 26, 2016 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.