WordPress.org

Ready to get started?Download WordPress

Forums

Timthumb Vulnerability Scanner
Not updating to 2.8.4 or 2.8.5 (12 posts)

  1. Vince LaMonica
    Member
    Posted 2 years ago #

    Interesting issue: I have sites that have 2.8.2 and when attempting to update, TimThumb Scanner doesn't actually do it. Actually, it does: it installs 2.8.2:

    https://skitch.com/vjl323/gwuka/timthumb-scanner

    Note that the first item, before the screenshot was taken, was 2.8.3 [as distributed by the WooThemes plugin, woo-tumblog]. When I ran "upgrade selected files" for both files, the 2.8.3 version went down to 2.8.2 and the 2.8.2 in the theme slidette, remained the same.

    I deactivated and reactivated the script; no change. I even deinstalled and reinstalled, and no change. Using v1.43 of the scanner. I've noticed this issue on several sites I run. I also noticed that the Google Code depository shows that 2.8.5 is the latest version, not 2.8.4. Any tips you can provide would be most welcome! :)

    Kind regards,

    /vjl/

    http://wordpress.org/extend/plugins/timthumb-vulnerability-scanner/

  2. Peter Butler
    Member
    Plugin Author

    Posted 2 years ago #

    A couple of points:

    The script that was keeping the version up to date (which should now have been returning version 2.8.5) had an issue, and wasnt keeping up. That's been fixed, so you should start seeing 2.8.5 as the latest available version (although, depending on when you lat ran the scanner, it may be a day or so before the latest version value updates. Deactivating/reactivating should force an update).

    As for your other issue - that's trickier - it's possible that the plugin didn't download the latest version like it was supposed to. The plugin comes bundled with 2.8.2, but the latest version SHOULD be downloaded as soon as the plugin sees that there's a new one available. However - that process isn't foolproof.

    Try deactivating and reactivating, and let me know if that makes any difference.

    THanks!

  3. Vince LaMonica
    Member
    Posted 2 years ago #

    Hi Peter,

    Thanks for the quick reply! I did deactivate and reactivate and it didn't grab the latest. I can see it replace the TimThumb.php files with 2.8.2.

    I will go ahead and try again on one of the sites I was seeing the issue [it was actually on all of them, but they are hosted on the same server of mine], and see if it grabs 2.8.5.

    [a few minutes goes by]

    Ok, well, the good news is it does see that 2.8.5 is the current version. But it is still not grabbing it. https://skitch.com/vjl323/gwiud/timthumb-scanner shows the current results [refreshing or rescanning the site shows 2.8.2 still].

    Is there a debug mode I can turn on to be able to help figure out why it's not going out to Google code to grab the latest?

    Thanks!

    /vjl/ [p/s - come next week, i'm signing up for Locker; very impressed with what it offers and what you have offered free via this plugin]

  4. ward00
    Member
    Posted 2 years ago #

    ditto - I have the same exact problem. I use Woo themes, using their updater, I also was not able to upgrade from 2.8.2

  5. salsa23
    Member
    Posted 2 years ago #

    I have the latest version of the plugin and it does say that 2.8.5 is the latest version but it is not updating beyond 2.8.2 either.

  6. DuzAwe
    Member
    Posted 2 years ago #

    Same here

  7. Lauravl
    Member
    Posted 2 years ago #

    Has someone have the solution?

  8. WayneM1
    Member
    Posted 2 years ago #

    Same here.
    I deactivated, deleted, re-installed the plugin.
    Ran the scan.
    Detected a ver 2.8.2 timthumb (which is supposed to be safe)
    Clicked to upgrade the selected file.
    Judging by the date of the file, it looks like it replaced it with a ver new 2.8.2 file.
    So, the upgrade to 2.8.5 is not working.

  9. novakpeter
    Member
    Posted 2 years ago #

    It is the same for me.

  10. Peter Butler
    Member
    Plugin Author

    Posted 2 years ago #

    Hey Guys -

    Really sorry about this - I got wrapped up in some other work and wasn't able to get back to the plugin. I've identified and fixed the problem, along with a couple of other new features, and I'll be releasing an update by the end of the day.

    Thanks for your patience!

  11. novakpeter
    Member
    Posted 2 years ago #

    Thank you. It is really one of the most useful plugins out there! I can imagine only one feature it could have moreover - it could hook central updating system, so you could update timthumb from blog, plugins and themes updates. This way you would never forget to update...:-)

  12. Peter Butler
    Member
    Plugin Author

    Posted 2 years ago #

    Alright guys, you should start seeing requests to update the plugin on your sites shortly, as the new version is live. The new version should fix the issue where the timthumb src file would not update (so vulnerable/outdated instances would not update either). This version also includes a daily scanner, which runs by default - you can turn it off on the options panel of the timthumb scanner page.

    As always, it would be a huge help to me if you could alert me to any bugs or annoyances you find in the plugin, so I can get them taken care of asap.

    Thanks!

Topic Closed

This topic has been closed to new replies.

About this Plugin

About this Topic