Dataverse installation admins: patch release 5.11.1 is out!

[leo...@g.harvard.edu]

This release is in response to a couple of very serious bugs in the previous 5.11 release. It is very important to avoid running the unpatched 5.11 in any production environment. If you are running an earlier version,  5.11 should be skipped when you upgrade (we have pulled the 5.11 .war file off GitHub by now). If you are running 5.11, please upgrade to 5.11.1 asap! This is all explained in the release note: https://github.com/IQSS/dataverse/releases/tag/v5.11.1

Finally, and most importantly, if you ran the version 5.11 for any period of time, please contact us (or me directly) so that we can help you make sure no damage has been done to your data; unless you have already been talking to us off course. (In simple terms, it was possible in some situations for users and/or admins to delete some things that should normally be off limits). 

This issue was detected fairly promptly so we sincerely hope it hasn't caused any serious damage to other installations. But we will do our best to assist any affected installations in recovery if needed.

Sincerely, 

-Leonid Andreev

Dataverse Project

[Sherry Lake]

Hello Leonid,

What if we used the war file that Gustavo sent on Friday?

Do we still need to update with this war file? 

We have been upgraded at V5.11 since July 20. Anything I need to check on? I ran the postgres commands in the release notes. Nothing matched the query. 

Thanks.

Sherry Lake UVA

--
You received this message because you are subscribed to the Google Groups "Dataverse Users Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dataverse-commu...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dataverse-community/7c55391c-70bf-4f5a-8163-aae09925d1can%40googlegroups.com.

[leo...@g.harvard.edu]

Hi Sherry, 

The temporary patch we made on Friday contained an incomplete fix. It patched the worst/most dangerous issue, but not some lesser ones. So please upgrade to the official 5.11.1; and until then, please avoid deleting any Draft versions when logged in as an admin user (that's where things can still go wrong). 

I'm very happy to hear that the queries from the release note didn't find anything. That means you are safe (just wait to delete any Drafts until you upgrade, to stay safe :). 

Cheers,

-Leonid

[leo...@g.harvard.edu]

In the release note for 5.11.1, when describing the file delete bug, it said 

"First, if you delete a file from a published version of a dataset that has restricted files, the file will be deleted from the file system..."

- no, the dataset does not need to have restricted files; that part just crept in from the description of the second issue. 

So instead of the above it should say

"... if you delete a file from a published version, the file may get deleted from ..."
(somebody is fixing it now)

Either way, it is a very serious bug that can cause data loss. So, you don't want to run unpatched 5.11 on your system.