I was working on a 5.1 installation for a client and installed Update Status to convince them that we needed to update the site. 5.9 was the current release, and it showed up being out of date.

Today, 5.10 was released, and Update Status lists my 5.1 installation as being up to date. I assume that this bug also exists in 6.x, since the 6.x Update module is based on Update Status.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

dww’s picture

Assigned: Unassigned » dww
Priority: Normal » Critical

Wow, evil. :( I can reproduce this on a local test site. Debugging now, stay tuned.

dww’s picture

Status: Active » Needs review
FileSize
1.25 KB
1.24 KB

Ok, here's the deal. There are a few spots in the code where we're comparing versions. The check currently looks like this:

if ($projects[$project]['existing_version'] == $version) {

At this point, $projects[$project]['existing_version'] is "5.1", and $version is "5.10". With core version strings as they are, PHP is happy to interpret these stings as floating point numbers, and decided that 5.1 == 5.10. :( Stupid untyped languages. ;)

Attached patch solves it. I'll probably commit to udpate_status contrib immediately. Luckily, it should be *pretty* rare that anyone's still on 5.1. But, we should probably release a 5.x-2.3 since there have been a few other bug fixes since 5.x-2.2, as well. I've also provided a patch for update.module in core, which indeed has the same bug.

dww’s picture

Status: Needs review » Needs work

Actually, I just noticed some other places we're doing this kind of comparison. Furthermore, drumm pointed out that === is probably better for this than a strcmp(). Rerolling, stay tuned.

coreyp_1’s picture

Still, your initial patch came after only a few minutes. I'm amazed! A much too small contribution is on its way... :)

dww’s picture

Status: Needs work » Needs review
FileSize
2.99 KB
2.62 KB

This should be everything. There are other comparisons on stuff like patch-level or major version, but none of those can themselves contain a '.', so I think we're safe. If we wanted to really be sure, we could do all those, as well, just to be paranoid.

chx’s picture

Status: Needs review » Needs work
dww’s picture

Status: Needs work » Needs review

chx didn't mean to change the status...

dww’s picture

Project: Update Status » Drupal core
Version: 5.x-2.2 » 6.x-dev
Component: Code » update.module

#5 needs to land in core now. It'd be nice if someone else reviewed/tested and marked RTBC, since it's my patch.

dww’s picture

p.s. Forgot to mention, I committed this to DRUPAL-5--2 in update_status contrib: http://drupal.org/cvs?commit=133683

Damien Tournoud’s picture

I can confirm that my 6.40 installation was incorrectly marked as up-to-date... evil.

I spotted a few more places where a comparison occurs between versions.

dww’s picture

Ahh yeah, good point -- I was only searching for '==', forgot to check for '!=', too.
Here's a patch for update_status contrib for the != to !== changes.

#10 looks good for core, but I'd still appreciate another reviewer/tester on this.

dww’s picture

Here's a patch for update_advanced, too. They joy just keeps spreading. ;)

dww’s picture

FYI: committed #11 to update_status DRUPAL-5--2, and #12 to update_advanced HEAD.

dww’s picture

Oh, and there was one more bug in update_status contrib -- the same one as the patch for update_advanced in #12. Also committed: http://drupal.org/cvs?commit=133823

NancyDru’s picture

Surprise, Derek! I'm almost ashamed to admit it, but I do still have two sites on 5.1 because they are so low on my priority list since they work just fine as is.

dww’s picture

Well, update_status 5.x-2.3 is now out with all these fixes. But, somehow I doubt that the folks running 5.1 core will upgrade to 5.x-2.3 update_status. ;) You can lead a horse to water...

NancyDru’s picture

Oh, I will upgrade on the sites where I use it, but those two sites run fine and the customer is not willing to pay for weekly updates to all the contribs, or even the core update frequency we've had since 5.2 came out. I tracks the status and give them monthly cumulative reports. I am going to update core on them soon even if they don't pay.

Damien Tournoud’s picture

Version: 6.x-dev » 7.x-dev
Status: Needs review » Reviewed & tested by the community

I think #10 is ready for core. Applies cleanly to both 7.x and 6.x.

c960657’s picture

You may consider using PHP's built-in version_compare() that is made especially for these kinds of comparisons.

Dries’s picture

Status: Reviewed & tested by the community » Fixed

Committed to CVS HEAD and DRUPAL-6.

Anonymous’s picture

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.