Welcome to the Freeway Forums

A new version of Freeway is now available to resolve a number of issues. It is Freeway 1.4.2.197 Sathish. You can download it here:

http://www.openfreeway.org/download.html

For existing store owners, please upgrade your store using the patch on the download page.

We have chosen to release this patch prior to the main new functionality to ensure the security of Freeway stores. The security issues resolved are as follows:

Multiple Remote/Local File Include
Linked XSS vulnerability

Thanks to Digital Security Research Group [DSecRG] desc.ru for advising of the security issues. A technical description of these issues can be found here: http://www.openfreeway.org/download/change-log.html

New Features

There are very useful additions to Freeway in this release as well as the security patch:

* Single Page checkout
* Subscription type for store memberships
* Improved Products Imports and Exports
* Improved Freeway news
* Manual price adjustments in POS

The Joomla extension has also been updated as well.

Freeway 1.5

We are working hard on a range of new extensions for Freeway 1.5 including:

* The localisation process will be overhauled
* Finally killing any legacy for register_globals (in testing)
* Template management update
* A plugin process for new extensions
* Improvements to the Admin Tool interface
* Complex price breaks co-operation
* Tiny MCE as the Default HTML editor

Due to the security release we have moved the release date for 1.5 back for three months to 1st November 2008. Developer releases with new functionality will be steadily added over this time.

Get ready for the Event notifier for Outlook calendars and the Mobile Device eCommerce solution Alpha release. The hire extension and some others will also be released during the next period as well.

About this release name

This release is named after Sathish, our test team leader for the Freeway Project. Sathish has recently returned to work after a very bad car accident. As with Ayyasamy, there would be no Freeway without Sathish. We hope you continue to recover well Sathish and pass on our best wishes.

With thanks,

Damian Hickey
Freeway Team Leader
_________________
ZacWare, Level 1 iLab, 80 Jephson Street, Toowong 4066, Queensland, Australia

There is at least one elegant solution to every real problem.

Last edited by Damian Hickey on 13.08.2008; edited 1 time in total

Great job. When you say follow the upgrade script on the download page, do you mean the patch, or do we actually download the #197 file and follow a script?

Hi there,

Thanks for pointing this out. I have removed confusing references. Here are the instructions for the Security Patch.

Download

Download the security patch from:
http://www.openfreeway.org/fileadmin/user_upload/freeway_security_fix_13_08_08.zip

To apply the Security patch:

1.) Backup the Freeway store and verify the backup

2.) Unzip the freeway_security_fix_13_08_08.zip

3.) Overwrite your store with the files from the zip

4.) Execute the .sql file against your database with phpMyAdmin etc.

If you have modified your Freeway files, it is better to manage the change in Subversion using the diff tools.

Cheers,

Damo
_________________
ZacWare, Level 1 iLab, 80 Jephson Street, Toowong 4066, Queensland, Australia

There is at least one elegant solution to every real problem.

Excellent. I have installed the Security patch. Does this mean that I am now upgraded to Version #197 or was that just a security patch. Also, is there a way within Freeway to check which version that I have installed. I know that I could do SVN, but is there something in the admin that will tell me?

After applying the patch, you are going to be at the same level as Subversion release 197.

Cheers,

Damo
_________________
ZacWare, Level 1 iLab, 80 Jephson Street, Toowong 4066, Queensland, Australia

There is at least one elegant solution to every real problem.

Damian,

I am confident this is simple and perhaps I should know the "how, what and where", but unfortunately, it is not the case for me. :ooops:

Point 4 of your instructions (which are appreciated) assumes one knows how to "execute the .sql file against your database" in phpMyAdmin.

I know that functionality exists on my server, however, I don't know how, in all honesty to "execute" the file.

Please be patient with providing the requisite steps thru the MAZE of the phpMyAdmin functionality to perform said execution.

I noted that there is a file "upgrade_171_195.sql" and that there was a folder (called install) with sql files in it. What specifically am I doing with them and which one

I have already overwritten the files on the server but have not "executed" against the database. Using Subversion is out of the question and way over my head as well.

Thanks in advance,

Gina

I too, do not understand what "execute the .sql file against your database" means. Enlightenment will be appreciated. Thanks.

Hi Guys,

If you have our freeway release ‘Freeway 1.4.1.171 [Ayyasamy]’ already and want to upgrade the release ‘Freeway 1.4.2.197 Sathish’, you have to run the sql file upgrade_171_195.sql.

Otherwise, if you want to use the fresh Freeway, you have to install the freeway. For that install the sql files within that install folder helps you.

Cheers,
_________________
Ramesh.P.

If I have the current svn 199 then I also have this security patch correct? or do I need to run the sql on mysql still?

Hi Thetechguy,

You don’t need to run the sql file upgrade_171_195.sql.

Cheers,
_________________
Ramesh.P.

I did all the steps listed above and when i log in to my freeway admin im still getting an alert : "this is not a test...." asking me to upgrade. does this mean i wasn't able to do i correctly?

I tried checking my version and I'm already using the current one:

Your Version is current
You are currently using version : Freeway 1.4.2.197

Please help.

Hi Workaholic,

It looks like you have found a bug. We will fix and update it pronto.

Now you can ignore and continue the other things.

Cheers,
_________________
Ramesh.P.