Project

General

Profile

Forums » Open discussion »

Rails 2.3.14 has been released. This release contains critical security fixes.

Added by Jędrzej Nowak over 13 years ago

What about recent security bugs in Rails ? Will redmine 1.1.x work with never Rails ?


Replies (7)

RE: Rails 2.3.14 has been released. This release contains critical security fixes. - Added by Etienne Massip over 13 years ago

Redmine 1.1.x does not support RoR > 2.3.5, please see RedmineInstall.

About 1.2.x branch, looking at the RoR changelog between 2.3.11 and 2.3.14, this needs some testing but I guess it should work.

There even seems to be some interesting fixes (RubyGems 1.5 compatibility (#8325 ?), session destroying issue when upgrading from 1.1.x version (#7688), ...).

RE: Rails 2.3.14 has been released. This release contains critical security fixes. - Added by Ivan Cenov over 13 years ago

I have a test installation of Redmine 1.2.1 with Rails 2.3.11 and run it by

ruby script\server -e production
It works as expected under Windows XP.
Today, I installed Rails 2.3.14 and executed above command, but Rails 2.3.11 is still loaded. Why does not Redmine see Rails 2.3.14? Something must be told somewhere in the Redmine configuration files?

Ivan

RE: Rails 2.3.14 has been released. This release contains critical security fixes. - Added by Etienne Massip over 13 years ago

Just have a look to your file config/environment.rb file, it's explained.

Also note that if you're using the Mongrel monkey patch of #7688 for compatibility with Rails ~> 2.3.11, you'll need to update its first line to include RoR versions 2.3.12 and 2.3.14.

RE: Rails 2.3.14 has been released. This release contains critical security fixes. - Added by Deoren Moor over 13 years ago

I've upgraded (removed 2.3.11 entirely) and haven't run into any issues so far.

I had to edit config/environment.rb and change this line:

RAILS_GEM_VERSION = '2.3.11' unless defined? RAILS_GEM_VERSION

to this:

#RAILS_GEM_VERSION = '2.3.11' unless defined? RAILS_GEM_VERSION

As an alternate approach, you can specify the latest version like so:

RAILS_GEM_VERSION = '2.3.14' unless defined? RAILS_GEM_VERSION

My web server's error log clued me into that.

    (1-7/7)