Follow-up: PowerFolder Server 28.2.101 and 26.4.101

• Follow-up to the security update: 28.2.101 and 26.4.101 supersede 28.2.100 and 26.4.100. If you have already installed .100 you are protected against the attack — please update anyway.
• How you notice it affects you: on .100 the server can reject requests from desktop clients and from other servers in the cluster, visible as "Access denied". Operations in server administration are affected too, for example enabling accounts.
• The cause was a security check that went too far. Under certain circumstances it also rejected valid requests. This is corrected in .101.
• Every security fix from .100 is included unchanged. .101 adds to them, it takes nothing back.
• The block on /wopi/ can be lifted after installing, as described.

Download

• 28.2.101 · Linux, full package: PowerFolder-Server_v28.2.101.tar.gz — SHA-256 38eff0c95a989caf7f51869c6a685bdbe117daf1ba62382d791a07413cdd7268
• 28.2.101 · Windows, installer: PowerFolder-Server_v28.2.101_Installer.exe — SHA-256 3509cd345b25f8b0217900a24a1c5beacc08a66e2aba347e60eaff44384cf975
• 26.4.101 · Linux, full package: PowerFolder-Server_v26.4.101.tar.gz — SHA-256 74b0b1fbdaeb7bd7f71697ab8b41f26d219b2b424084a10155599bf707e20180
• 26.4.101 · Windows, installer: PowerFolder-Server_v26.4.101_Installer.exe — SHA-256 c73387c2fc1c1af34bbaea0e63ccb872ab7dfb31ca94062130e6824232cc167d

Verify the file before installing with certutil -hashfile <file> SHA256 (Windows) or sha256sum <file> (Linux).

Installation

The steps are the same as for the update to .100 — they are in the announcement of 11 November. Coming from .100 on Linux, replacing PowerFolder-Server.jar from the archive is enough: stop the service (systemctl stop powerfolder), replace the file, start the service. Keep libs/ — it holds your database driver. On Windows, run the installer. Your data in ~/.PowerFolder and ~/PowerFolders is left untouched; a backup beforehand is still right.

What else .101 changes

• A refused registration no longer makes the client sign in again.
• Server administrators are no longer forwarded to other servers within the cluster.
• A missing net.trusted.proxies setting is reported once per program start instead of continuously.

For questions please use support.powerfolder.com.