3

Joomla 3.6.5 is released today that includes a High Priority security fix that is affecting Joomla! 1.6.0 through 3.6.4.

How can I apply the fix manually to Joomla 2.5.999 (PhilETaylor's unofficial fork) as I have a joomla 2.5 that can't be updated to Joomla 3.x because of some reasons?

2

I did start writing out all the code you'll need but as you know, Joomla 2.5 differs and I haven't worked with it for a long time, so I won't go down that route.

Step 1: Take a backup of your site before doing this!

You'll need to download the Joomla 3.6.4 to 3.6.5 update package (direct download link) from joomla.org

The files you'll need will be in the following directories:

  • administrator/
  • components/
  • libraries/
  • plugins/authentication/joomla

Open the file in your IDE (Sublime, Notepadd++), side-by-side with the same files from a Joomla 3.6.4 installation.

You'll then be able to see the code differences between 3.6.4 and 3.6.5, like so:

enter image description here

You code that has been added, you can then copy over to the same file on your Joomla 2.5.28 file.

Apply the same process for all the files from the update package.


Please note that there are a lot of differences in code between Joomla 2.5 and 3.x, so you may need to make some code tweaks.

Hope this helps

  • 1
    Here is an online tool I sometimes use for comparing code that might help as well: quickdiff.com – YellowWebMonkey Dec 14 '16 at 12:08
  • Yes, essentially you will need to write your own branch of Joomla! that applies the latest 3.6.5 security patches to 2.5. – Michael Yaeger Dec 14 '16 at 14:24
  • However, @Lodder's instructions are simply for the security fixes added in 3.6.5 from 3.6.4. Obviously, there are MANY other security fixes from 2.5.28 to 3.6.4 that may be considered equally important. – Michael Yaeger Dec 14 '16 at 14:34
  • @Lodder I have implemented the differences. Would you like to review it? – webchun Dec 15 '16 at 5:42
  • @webchun - nice one. Unfortunately though, I'm not on the Joomla security strike team so I wouldn't know where to start with testing. – Lodder Dec 15 '16 at 8:45
2

VirtueMart has released a Joomla 2.5.28 Patch which can be found here:

https://dev.virtuemart.net/projects/virtuemart/activity

Of course use it with caution and backup before patching.

1

As others have stated, you can apply just the security fixes that 3.6.5 contains, but there are many other security fixes between 2.5 and 3.6.5 that are equally important. Since you are asking how to apply the fix to 2.5, I am assuming that you have not already applied every other security fix to your site. Thus, if you apply this fix, your site will STILL be vulnerable.


The best approach will be to take the Joomla 2.5 to 3.x Step by Step Migration.


For very large or complex 2.5 to 3.x migrations

The one-click update will be fine and work well for many. For some larger, more complex sites, the one-click update may not be the best route. For large or very complex sites, you may want to follow instructions for a regular migration and bypass the one-click update functionality. To do this, follow the same instructions for planning 1.5 to 3.x and migrating from Joomla 1.5 to 3.x, simply substitute 2.5 for 1.5 while reading.

  • 1
    I know how complex this may be for many sites. I still manage a site that is on 2.5. However, we are actively developing a plan for migration, which should be the case for all 2.5 sites considering the Joomla! team made special efforts to ensure a smooth and seamless transition. – Michael Yaeger Dec 14 '16 at 15:00
1

Looking at the description of the high priority Joomla 3.6.5 security patch:

"Incorrect use of unfiltered data stored to the session on a form validation failure allows for existing user accounts to be modified; to include resetting their username, password, and user group assignments."

It looks like disabling User Registration on Joomla 2.5 websites and removing any untrusted user accounts may be sufficient to protect the website from this vulnerability without the need for any additional patch.

Of course, if the website needs user registration to be enabled then the patch released by the VirtueMart Team may be the best option. (Thanks @FFrewin).

0

To be completely honest and even if you do not like the answer I hope it will at least help you not to waste time.

It can be done, but I don´t recommend it at all.

Joomla 3.6.X are literally thousands of lines of code and hundreds of errors fixed. Many of them have been critical security errors, not just the latter one in 3.6.5.

It's much better that you try to solve the reasons why you can not upgrade.

Bye

  • 5
    I respectfully disagree. A security patch might only affect a few lines of code and assuming this is the case here, it shouldn't be too hard to reverse engineer the patch by comparing changed files and then applying the same changes to the equivalent files in Joomla 2.5. There are probably hundreds of thousands of Joomla 2.5 websites still in service and I'm hoping someone with the skills is motivated enough to work through this process and provide the updated files. This has happened previously. See docs.joomla.org/Security_hotfixes_for_Joomla_EOL_versions for details. – Neil Robertson Dec 14 '16 at 6:29
  • You are both right and wrong: "It CAN be done!" "It's much better that you try to solve the reasons why you can not upgrade" – Michael Yaeger Dec 14 '16 at 14:30
  • 1
    Of course it can be done. But I would not recommend it at all. I think is too risky. I don´t think I deserve the down vote because I am just giving him my best advice. I would not do it and most probably people here telling you how to do it, neither would do it in their sites. Because the best advise is to figure out the reasons preventing you to upgrade, fix them and upgrade to latest joomla version. – Piero Marsilio Dec 14 '16 at 14:34
  • You said it can not be done before you edited it. Maybe that's why you got downvoted alot. – webchun Dec 14 '16 at 15:57
  • 1
    I edited later for the sake of giving a better answer that is the goal of this. – Piero Marsilio Dec 14 '16 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.