Enthusiast 3.1.5 – Urgent Security Upgrade
A security vulnerability for Enthusiast 3 has been detected a few days back, and I’ve been notified just tonight about it. I do have a security fix up, and with that said — Enthusiast 3.1.5 is an important security upgrade, most especially if your server has register_globals on.
Please download the upgrade zip or the full zip if you prefer. The upgrade will be slightly more painful than the previous upgrades.
Before I get on with the upgrade instructions after the cut, I would like to take this time to say I apologize for the lack of updates and the sudden hiatus of Frontend Friday — I’ve moved houses and things have been rather crazy the past couple weeks. I haven’t forgotten this blog, I swear ;)
And now for the upgrade instructions. This is all in the upgrade zip, not to worry. :)
Important notice: the upgrade is not as simple as the previous upgrades, hence the additional instructions. Do not blindly overwrite your config.php file!
- Overwrite the following files on your Enthusiast 3 main installation using the files found in the upgrade zip:
-
enth3/show_enthversion.php -
enth3/show_join.php -
enth3/show_joined.php -
enth3/show_lostpass.php -
enth3/show_owned.php -
enth3/show_update.php
-
- Open the
config.phpfile found in this zip and fill in your database information. For each listing you own, you must overwrite yourconfig.phpfile for that listing with this new configuration file. Please don’t forget to change the listing ID variable to the correct listing ID! - The following may be optional, depending on your setup, but highly recommended for forward compatibility and ensured security — you will need to update your code snippets to use the PHP constant
ENTH_PATHinstead of the PHP variable$path, like so:<?php include 'config.php'; $show_list = false; include ENTH_PATH . 'show_joined.php'; ?>The
install.txtfile included in the upgrade zip will contain all the new code snippets if you need to take a look.
Please upgrade your Enthusiast installations as soon as possible. If you encounter issues with this upgrade, please feel free to post comments regarding the issues.
Remember: You must also overwrite the config file found in your collective. Basically, all configuration files except for the one inside your Enth3 administration panel will need to be updated.
Remember #2: By “code snippets”, I mean all code snippets, including the collective code snippets, and the fanlisting code snippets. In that regards, it means that the config file for your collective and each of your fanlistings will need to be updated. The process is similar to when you first set up your websites — take the config file with the commented listing ID line and put it in the collective web root, and then take the same config file, uncomment the listing ID line and plug in the correct ID, and put it in the listing web root. Rinse and repeat. :)
Joss
Hi, I got this error when upgrading: (took out my username)
Warning: include(ENTH_PATHshow_enthversion.php) [function.include]: failed to open stream: No such file or directory in /home/*username*/public_html/enjoi/show_owned.php on line 275
Warning: include() [function.include]: Failed opening ‘ENTH_PATHshow_enthversion.php’ for inclusion (include_path=’.:/usr/lib/php:/usr/local/lib/php’) in /home/*username*/public_html/enjoi/show_owned.php on line 275
Rachel
Thank you so much for your dedication, Angela! I’m installing now, but getting some errors. Forgive my ignorance, but it seems my site isn’t recognizing the “ENTH_PATH”? ( Warning: include(ENTH_PATHshow_owned.php) [function.include]: failed to open stream: No such file or directory in /home/***/public_html/network.php on line 7 )
On the fanlistings themselves, I’m getting these errors: Warning: mysql_connect() [function.mysql-connect]: Access denied for user ‘***’@’localhost’ (using password: NO) in /home/***/public_html/admin/mod_owned.php on line 1711
Cannot connect to the database. Check your config file and try again. MySQL said: Can’t connect to MySQL server on .
I’ve uploaded all the new versions in the Enthusiast admin folder and uploaded the new config file and changed it to the appropriate variable ID for the fanlisting. Any suggestions?
Mervi
I’m getting the same errors as Rachel, only it’s mostly in the collective side, not in the actual fanlistings so far (haven’t gone through everything yet, though.)
Eiluned
I’m having the same problem, too, both on my collective and my individual fanlistings. :\
Angela
It looks to me that a trailing slash is missing on your Enth paths — can you verify that they’re there on your settings? The trailing slash is important.
Amber
Did you guys update your config file for the individual fanlistings? I had the same problem with ENTH_PATH until I did that.
However, now I have a strange problem on my individual fanlistings. The entire country section of the join form is gone. Weeeeeeeeeird.
Eiluned
All of my paths have trailing slashes. The errors only started when I upgraded to 3.1.5 and changed $path to ENTH_PATH in my code snippets, and I didn’t change anything in my settings when I upgraded.
Mervi
Yup, trailing slashes are all in place!
Nori
I’m having the same problem on mine as well, and my absolute paths are correct in every inch of my Enth install.
I also experienced extreme slowness on my collective (and admin panel) after upgrading – it took about five minutes for it to get past the “All Categories” page when looking at my owned page (while there are a lot of fanlistings with information/images to load in “All”, it was still *really* slow when checking much smaller categories). It wasn’t just my computer/connection, I checked it from 3 separate computers and it sped up again once I restored my 3.1.4 files.
Complaints aside, thank you for getting on to fixing the security problem so quickly :) Your hard work is greatly appreciated by lazy sods like myself.
Kaitou Icery
I have the exact same problem as everyone else here. All my paths have trailing slashes and when I updated the code on some of my fanlistings, the stats don’t even show up anymore; all the other ones have this error:
Warning: mysql_connect() [function.mysql-connect]: Access denied for user ‘***’@’localhost’ (using password: NO) in /home1/***/public_html/enth3/mod_owned.php on line 1711
Cannot connect to the database. Check your config file and try again. MySQL said: Can’t connect to MySQL server on
Despite the fact that I had the EXACT same info when I had Enth 3.14…
Kaitou Icery
Oh. ^^; I just figured out what I did wrong — I forgot to take out the “//” right before the listing, hence why I was getting that error in in the fanlistings.
Shannon
Getting the same errors as above.
Rachel
Hi Angela :)
Real quick: Yep, I have them all ending in a trailing slash. I even updated the regular URL for the collective with a trailing slash and I have the same problem.
Rachel
Update: Okay, I did what Kaitou suggested and the fanlistings themselves are fixed. :) However, the errors are still showing up at the collective.
Angela
Oh, so sorry–it was 1AM when I answered previously! Please remember to also overwrite the config files for your collective. ENTH_PATH is only defined in the config file, so without the correct version of the config file, you WILL encounter the above problems.
It’s all a config file version problem :)
Danielle
Upgraded without a hitch — thanks for the detailed instructions! :D
Angela
Yay! I’m glad it went through smoothly–was getting worried about the release there. Hehe.
Rachel
Hi again!
Sorry to bombard you with so many comments, but I’m still getting the same error. :( I forgot to mention I downloaded the upgrade only, then I went ahead and downloaded the full thing. I took the config from the full version and changed my config and there are still errors. :( Is there an upgrade file I need to access and may have missed? :[
Charity
Working great for me. :) I got everything upgraded and no problems at all. :)
Angela
There’s no extra upgrade script that you need to run, but the whole process *is* rather tedious. If you’re getting the error
Warning: include(ENTH_PATHshow_owned.php) [function.include]: failed to open stream:or similar, it means that your config file is not up-to-date as the up-to-dateconfig.phpfile will contain that information such thatENTH_PATHwill equate to your installation path. You might need to double-check yourconfig.phpif it’s the correct version. Do a search of “ENTH_PATH” and if it’s not found, then the config is outdated :)Sammie
Thanks i upgraded with a few problems but i sorted them lol . Quick question do we have to change all the enth_paths on every fanlisting to show members, join forms etc or can we keep the old coding?
Saya
I managed to update and it seems that works everything perfectly fine! Thank you!!!!
Rachel
Okay, I did check the config file in the admin section and there is no ENTH_PATH. What should I do? I’m so sorry, Angela. I feel so stupid that I’m just not understanding this. :\
Amber
Are we supposed to update both the admin AND fanlisting config files? I’ve upgraded my fanlistings, and they all work fine, but when I go to upgrade the page that shows my fanlistings, I get errors because ENTH_PATH is not defined in the current config, but I don’t see a new config file in the upgrade zip for the admin panel – just for the individual fanlistings.
Thanks for being so patient with us!
Sammie
There is one config.php file. Open it up, edit the database and password bit. then scroll down the bottom there is a bitt that has the // listing= 1; bit. the file like this is your collective file config. then take out the // and change the number to the ID of your fanlisting number this file can then be used for all you fanlistings (just change the number each time). does that make better sense? lol
Lia
I noticed you said we needed to upgrade the collective config.php, but there wasn’t one included for that, just for the individual listings. Did I miss it somewhere?
Lindsay
I’m getting the same error as Joss:
Warning: include(ENTH_PATHshow_enthversion.php) [function.include]: failed to open stream: No such file or directory in /home/***/public_html/admin/show_owned.php on line 275
Warning: include(ENTH_PATHshow_enthversion.php) [function.include]: failed to open stream: No such file or directory in /home/***/public_html/admin/show_owned.php on line 275
Warning: include() [function.include]: Failed opening ‘ENTH_PATHshow_enthversion.php’ for inclusion (include_path=’.:/usr/lib/php:/usr/local/lib/php’) in /home/***/public_html/admin/show_owned.php on line 275
That’s also the only place I’m having trouble with the Enth version showing – it works fine on individual fanlisting pages.
Nathalie
Works fine for me, too. :) Thank you for the quick release of this upgrade and for the instructions!
Christopher Kavanagh
Upgraded without any problems! Great work Angela.
Eiluned
Oops, I realized what I was doing wrong! I uploaded the new config file for the collective, but I’d forgotten to uncomment the listing line for the individual fanlistings. Everything seems to be working now. Thanks for your help and patience, Angela!
Honey
Thank you, Angela! I followed the instructions and nothing went wrong. All my fanlistings and collective are working smoothly. :)
Hikoto
Just to get this right: We have to update the config files of the both the individual fanlistings and the collective.
For the collective’s config file, we just have to delete the last portion that defines the listing ID and upload it? (As Eiluned mentioned.)
Angela
Hikoto: yes, you got it right :) Basically, the same thing you did when setting up the whole thing (collective+fanlistings); take the config file with the commented listing ID line and put that in your collective’s web root; the the the config file, uncomment the listing line and plug in the correct listing ID, and put in in the fanlisting, and do the same for the rest. :)
Hikoto
Rightio thanks! (:
Rachel
Aha! Okay, thanks to you Angela and Hikoto! I fixed it. :) Sorry for so many questions and messages. @_@ Anyway, thank you again Angela for the upgrade! I appreciate your hard work and dedication. :D
Marcie
I noticed after the upgrade that all pages are very slow its like loading in 56k. What’s up with that?
Carolynne
Just finished updating everything. It was a bit tedious to change every $path to ENTH_PATH in SO MANY files and it took forever, but it’s done. I had no problems. Thanks Angela.
Amanda
Updated everything without any problems. Thanks Angela for the update!
Camilla
Thank you so much for all your hard work, Angela! I’ve just updated everything with no problems at all :) Took a while, but it’s of course worth it to get it even safer. Thanks again! xx
Nelson
I see it nice to finally hear an update even though it’s an urgent one. Just upgraded my files without any troubles. Thanks!
Raine
All updated! Thanks for this, Angela. *hugs*
Lisa
Just checking–do we need to update the config.php file in our admin folders, or just in each fanlisting’s folder? If it’s the latter, then my upgrade is going smoothly so far. :-)
vanessa
Upgrading was actually easier than installing Enthu for the first time.. for me anyway. Thanks!
Beate
after a hell of work everything works fine
thanx for the upgrade!
Azurite
I updated all 3 of my fanlistings and my collective and it seemed to work out fine! I had a few of the problems mentioned above, but it turned out I didn’t upload the config.php file to the fanlisting yet… -_-
Anyway, all’s well now. Thanks for the update, and keep up the fabulous work!
Rebecca
I’ve read everything and can’t send emails.. >< Whenever someone registers they dont receive any emails. No errors or anything, but no emails! Help please?
Cinthya
Hi Angela,
I’ve update the Enthusiast without any problem, it works perfectly, I just notice that I didn’t see the update message like the other updates.
Thank you so much for your work ^^
Tessa
Hello, first of all, thanks for the update. I tried to update my collective, but I get the following on the main page when showing the stats:
Warning: main(ENTH_PATHshow_collective_stats.php) [function.main]: failed to open stream: No such file or directory in /home/whis3514/public_html/fanlistings/index.php on line 19
Warning: main() [function.include]: Failed opening ‘ENTH_PATHshow_collective_stats.php’ for inclusion (include_path=’.:/usr/lib/php:/usr/local/lib/php’) in /home/whis3514/public_html/fanlistings/index.php on line 19
I looked in the config file and it showed ENTH_PATH . So I’m not sure what I’m doing wrong here LOL. Help is really appreciated.
Tessa
Never mind, I don’t know what I did, but apparently it worked and now everything is showing
Cariel
Done and done! That was quick and painless. I think it might have been easier to say you just needed to copy and paste
if( !defined( ‘ENTH_PATH’ ) ) {
define( ‘ENTH_PATH’, $row[‘value’] );
}
into each fanlisting’s config file (since that was the only difference between the old and new config files) and then use the new config file for the main collective one. =)
Ai~
Couldn’t upgrade since I wasn’t using 3.1.4, so I just went ahead with a fresh install since my old server decided to disappear without notice. Everything’s working fine now! :) Thanks for the security upgrade, Angela! *hearts* God bless!
Haley
Hmm…I seem to be having the problem where all my individual fls are showing up fine, but my collective show_whatever.php pages are not being recognized.
I did a fresh install on a new domain yesterday with the ZIP from this post. Everything on the individual listings is OK, but the collective show_joined.php and show_owned.php are not working with the ENTH_PATH. Here are my errors:
Warning: include(ENTH_PATHshow_joined.php) [function.include]: failed to open stream: No such file or directory in /home/.dombey/haleyr/featherless.org/joinedfls.php on line 12
Warning: include() [function.include]: Failed opening ‘ENTH_PATHshow_joined.php’ for inclusion (include_path=’.:/usr/local/php5/lib/php:/usr/local/lib/php’) in /home/.dombey/haleyr/featherless.org/joinedfls.php on line 12
I have no idea what’s wrong. My paths are correct and everything else works but these files. Anyone care to help?
Antarel
I got this news pretty late since I only checked my fanlisting stats this week, but I carried out the updates just as you instructed and so far so good. Thanks so much! :)
Joyce
I think I screwed up. The whole fanlisting died.. I can’t fix it.
Tessa
In my fanlistings, on the member page, the all list shows up, but when selection an individual country I get an 404. It’s probably something I haven’t included, but I’ve looked and looked and I can’t seem to find it. I’ve got this problem with all three fanlistings of mine.
http://whispering-words.com/fanlistings/royaltyofcamelot/
Katja
Had totally forgotten about doing these updates. But got it done now and haven’t seen any problems so far :).
Monica
I’ve just updated everything with no problems at all, thank you Angela!
clarisse
Hi,
I’m not gonna say anything regarding your posts here. (Maybe in the near future..hehe). I’m the new hire from STORM and I’ve been hearing so many things about you. That’s why I ended up with your sites. Anyway, you’re so interesting. So bad we didn’t meet.
Good luck! Have a nice day! =)
Lunette
Maybe in the near future..hehe). I’m the new hire from STORM and I’ve been hearing so many things about you. That’s why I ended up with your sites. Anyway, you’re so interesting. So bad we didn’t meet.