1.15 security updates

Afox

I know that it is possible to add a third party repo with PHP 8.x to Debian 11 but from security perspective this can´t be the best solution as those versions are not covered officially by their security team. And I am not willing to take this risk.

Again, Debian is not just any OS and if osticket sticks to its 2 version policy then one of those should still support PHP 7.4.

RBGE

Afox I'm afraid it is just another OS... and PHP 7.4.x is still rapidly approaching EOL, regardless of who adds fixes to it. While the PHP 8 repo may not be covered 'officially' by the Debian security team, it is maintained by one of them (see https://tracker.debian.org/pkg/php7.4 and look for Ondřej Surý signing the PHP packages you're currently using!), and the actual PHP development team!

Again, you'll find a lot of actively maintained systems stop supporting EOL packages, not just osTicket - that's life, especially given that cyber security is now a primary concern for most organisations. Basically, your options are now:

keep using osTicket 1.15.x until Debian 12 comes out, expected in January 2023, and then upgrade
use the PHP 8 repo linked in my previous message
import the fixes from 1.16.x into 1.15.x yourself (unless you're a developer, this may not be feasible)
move to a different distro (something tells me you really don't want this option 😇 )

First option may be easier, and if it were me I'd use the second, but it's obviously all up to you.

Afox

I don´t feel comfortable running an EOL software in the www. I don´t quite understand why osticket dropped support for PHP 7.4 and instead created two consecutive versions that both require at least PHP 8.0. In my opinion this was/is a mistake and should be fixed.

RBGE

Afox Because it's end of life in two weeks - period. Given the small development team (see https://enhancesoft.com/who-we-are/ ), I'd suspect the limited resources they have are spent maintaining current branches. The fact some people outside of the PHP development team are applying fixes themselves (only critical ones) changes nothing I'm afraid. Bear in mind PHP 8.0 was released in 2020, and 8.2 is due for release very soon - at that stage, 7.4.x will have been superseded by 3 later versions.

This is exactly the same way osTicket 1.15.x would still be EOL if you applied the fixes yourself. As mentioned earlier, the PHP 8 repo is maintained by one of the people maintaining the PHP 7.4 package you're currently using, so it's not a security risk to use this over the current 7.4 packages.

Afox

I stick with my statement. Debian stable is not any OS and osticket should make itself compatible with it.

RBGE

Afox Well, it is open source so by all means feel free..... there may even be other Debian users willing to chip in.

Afox

No, in my opinion it is clearly ostickets turn.

KevinTheJedi

Afox

When you make changes that are specific to PHP 8.x some of those changes are NOT backwards compatible. We will not hack our code to support older versions of PHP, especially EOL versions like PHP 7.x. Your thinking is entirely incorrect here.

Maybe you should try to fork the osticket repo and maintain 1.15.x yourself to see how it goes if you think otherwise.

Also, be glad we now support 2 versions, we used to only support 1 version at a time. 😉

Cheers.

Afox

It´s not me who set two consecutive versions supporting only PHP 8.x without any legacy support. So why should I or any other person fix your mistake?

KevinTheJedi

Afox

You must not have a good grasp of software development if you think dropping PHP 7.x support was a mistake. It’s EOL. Simple as that. It’s not up to us to support unsupported versions of PHP. You are really setting yourself up for more security vulnerabilities and issues than it’s worth.

Cheers.

Afox

It is and was still supported to date and as you released osticket 1.16 there was way to go until EOL. And as said the Debian team will take care of those security aspects. I find it more unsafe to use software not officially supported.

KevinTheJedi

Afox Like PHP 7.x…

Afox

As said Debian has a security team that takes care fo the security aspect. I sent a mail to Ondřej Surý to ask for advice in a situation like this but, again, this doesn´t change the fact that you should maintain one legacy and one most recent branch instead of 2 fairly recent branches.

KevinTheJedi

Afox

I'm not going to argue anymore. You can fork it and maintain it yourself if it's such a big deal to you. Good luck 🙂

Cheers.

ntozier

As a side note since you are running Debian one of the devs Sury runs https://deb.sury.org/
You could easily add his ppa to install a newer version of PHP on your server.