1.15 security updates

Afox

I don´t feel comfortable running an EOL software in the www. I don´t quite understand why osticket dropped support for PHP 7.4 and instead created two consecutive versions that both require at least PHP 8.0. In my opinion this was/is a mistake and should be fixed.

RBGE

Afox Because it's end of life in two weeks - period. Given the small development team (see https://enhancesoft.com/who-we-are/ ), I'd suspect the limited resources they have are spent maintaining current branches. The fact some people outside of the PHP development team are applying fixes themselves (only critical ones) changes nothing I'm afraid. Bear in mind PHP 8.0 was released in 2020, and 8.2 is due for release very soon - at that stage, 7.4.x will have been superseded by 3 later versions.

This is exactly the same way osTicket 1.15.x would still be EOL if you applied the fixes yourself. As mentioned earlier, the PHP 8 repo is maintained by one of the people maintaining the PHP 7.4 package you're currently using, so it's not a security risk to use this over the current 7.4 packages.

Afox

I stick with my statement. Debian stable is not any OS and osticket should make itself compatible with it.

RBGE

Afox Well, it is open source so by all means feel free..... there may even be other Debian users willing to chip in.

Afox

No, in my opinion it is clearly ostickets turn.

KevinTheJedi

Afox

When you make changes that are specific to PHP 8.x some of those changes are NOT backwards compatible. We will not hack our code to support older versions of PHP, especially EOL versions like PHP 7.x. Your thinking is entirely incorrect here.

Maybe you should try to fork the osticket repo and maintain 1.15.x yourself to see how it goes if you think otherwise.

Also, be glad we now support 2 versions, we used to only support 1 version at a time. 😉

Cheers.

Afox

It´s not me who set two consecutive versions supporting only PHP 8.x without any legacy support. So why should I or any other person fix your mistake?

KevinTheJedi

Afox

You must not have a good grasp of software development if you think dropping PHP 7.x support was a mistake. It’s EOL. Simple as that. It’s not up to us to support unsupported versions of PHP. You are really setting yourself up for more security vulnerabilities and issues than it’s worth.

Cheers.

Afox

It is and was still supported to date and as you released osticket 1.16 there was way to go until EOL. And as said the Debian team will take care of those security aspects. I find it more unsafe to use software not officially supported.

KevinTheJedi

Afox Like PHP 7.x…

Afox

As said Debian has a security team that takes care fo the security aspect. I sent a mail to Ondřej Surý to ask for advice in a situation like this but, again, this doesn´t change the fact that you should maintain one legacy and one most recent branch instead of 2 fairly recent branches.

KevinTheJedi

Afox

I'm not going to argue anymore. You can fork it and maintain it yourself if it's such a big deal to you. Good luck 🙂

Cheers.

ntozier

As a side note since you are running Debian one of the devs Sury runs https://deb.sury.org/
You could easily add his ppa to install a newer version of PHP on your server.