From: William Grosso Date: 2006-08-10T03:14:42+09:00 Subject: Re: [ANN] Rails 1.1.5: Mandatory security patch (and other tidbits) Me too. I'm on Windows, if that matters (does it work on other platforms) ? Bill Tom Jordan wrote: > I'm getting a Zlib::BufError when it gets to actionpack > > On 8/9/06, David Heinemeier Hansson wrote: >> We're still hard at work on Rails 1.2, which features all the new >> dandy REST stuff and more, but a serious security concern has come to >> our attention that needed to be addressed sooner than the release of >> 1.2 would allow. So here's Rails 1.1.5! >> >> This is a MANDATORY upgrade for anyone not running on a very recent >> edge (which isn't affected by this). If you have a public Rails site, >> you MUST upgrade to Rails 1.1.5. The security issue is severe and you >> do not want to be caught unpatched. >> >> The issue is in fact of such a criticality that we're not going to dig >> into the specifics. No need to arm would-be assailants. >> >> So upgrade today, not tomorrow. We've made sure that Rails 1.1.5 is >> fully drop-in compatible with 1.1.4. It only includes a handful of bug >> fixes and no new features. >> >> For the third time: This is not like "sure, I should be flooshing my >> teeth". This is "yes, I will wear my helmet as I try to go 100mph on a >> motorcycle through downtown in rush hour". It's not a suggestion, it's >> a prescription. So get to it! >> >> As always, the trick is to do "gem install rails" and then either >> changing config/environment.rb, if you're bound to gems, or do "rake >> rails:freeze:gems" if you're freezing gems in vendor. >> >> P.S.: If you run a major Rails site and for some reason are completely >> unable to upgrade to 1.1.5, get in touch with the core team and we'll >> try to work with you on a solution. >> -- >> David Heinemeier Hansson >> http://www.loudthinking.com -- Broadcasting Brain >> http://www.basecamphq.com -- Online project management >> http://www.backpackit.com -- Personal information manager >> http://www.rubyonrails.com -- Web-application framework >> >> > >