ljm42

absolutely

Woah, some of your plugins are from 2020 (!!) It is important to keep plugins up to date, it is likely that old code is messing with the display

If you are able to get to the Main page, see if the number of reads on the flash drive is increasing like crazy. If so, this should solve it: https://docs.unraid.net/unraid-os/release-notes/7.0.0/#excessive-flash-drive-activity-slows-the-system-down If you aren't able to get to the Main page, I'd go ahead and implement the fix without confirmation of the symptoms.

Sorry for the confusion, this looks benign. Please upgrade to the latest release and confirm that when you go to Tools > Unraid Patch it says that the patches are installed

Sorry for the trouble. Please make sure you have at least version 2025.01.31a of the Patch plugin, this will detect that the patch failed due to a conflict with Mover Tuning and advice that you reboot. Upon reboot, the Patch plugin will be installed first, before any other plugins. This will avoid conflicts with other plugins. If you have rebooted after installing the latest Patch plugin and continue to have issues, please post your diagnostics so we can review the logs.

The patches being released for 7.0.0 will never be applied to another version so there is nothing for them to be consistent with. Yes this is a valid statement. If additional patches are released for 7.0.0 the patch number will increment. We can look at having the plugin put that patch number in the syslog

Thanks for the feedback. We definitely considered this but any way we changed the version number (either by incrementing it or by tacking on characters) brings its own set of problems that outweighed any benefit. Users who need this information can visit Tools > Unraid Patch, and people providing support can look at the diagnostics (it is in the syslog, and on 7 you can look at system\installed_patches.txt in the diags)

Oh I see, you have the mover tuning plugin. It has already modified the mover script so when this installs it throws an error message about that one file. The rest of the patches installed fine, it is safe to ignore this. Need to see if there is a better way of handling issues from files that were modified by plugins

Thanks for pointing this out. If the mover tuning plugin has already modified this file then this will generate an error. Should be ok to ignore, need to see if we can improve this

I split this off to a new thread so we can do some back and forth. Thank you for the diagnostics and the details from the install. The good news is that should not have any adverse effects on your system, the bad news is that you don't have the updates. Would you be open to rebooting? That will get everything back to default. Depending on whether the patches are on your flash drive, they will either automatically be reapplied or you can go to Tools > Unraid Patch to install them. I'd appreciate seeing another diagnostics after that if you don't mind.

Hi folks, we are using a new method to distribute bug fixes, with the goal of getting the fixes out to you faster. See the new "Patches" section of the release notes for details: https://docs.unraid.net/unraid-os/release-notes/7.0.0/#patches Update: if you have the Mover Tuning plugin installed, the Unraid Patch plugin will throw an error when patching mover. It is safe to ignore, we're working on a way to improve that experience (see Update 2) Update 2: the latest version of Unraid Patch will detect this situation above and advise you to reboot. Upon rebooting, the patch plugin will patch the files first, before any other plugins are installed. This will avoid conflicts with other plugins.

Please see my previous posts, we're working on tweaks to give users more control.

Sorry for the confusion, I posted a more detailed reply here: https://forums.unraid.net/topic/185560-unraid-patch-plugin/page/2/#findComment-1516878 and updated the OP of that thread

Yes this is a net new process and we needed to get it out. We're working on tweaks to give users more control. We can work on the FCP message. To clarify, today if you are on a version that has a patch available (6.10.0-6.12.13) you need to visit Tools > Unraid Patch to install the patch without rebooting. There are currently no patches for 6.12.14+ or 7.0.0+ but we do recommend having the plugin installed as mentioned above.

The patch plugin was created to facilitate fixing certain security issues in the Unraid OS webGUI for older Unraid OS releases. We wanted to give users on older releases a quick and easy way to apply these fixes without having to update to the latest Unraid OS releases immediately. The plugin stores the patches on your flash drive in /boot/config/plugins/unraid.patch/[version] Visit Tools > Unraid Patch to install them without needing to reboot. On reboot they will automatically be reinstalled. To remove the patches and get back to stock, uninstall the plugin and reboot. The patch released yesterday solves a security problem with older versions of Unraid. Unraid 6.12.15 and 7.0.0 have the fixes built in, so strictly speaking they do not need to have the patch plugin installed at this time. However this can be a powerful tool to aide in not only installing critical security updates in a timely manner, but also fixing bugs without having to wait for a full release. For this reason we recommend having the plugin installed on all versions of Unraid.

The patches themselves can be found on your flash drive in /boot/config/plugins/unraid.patch/[version] Storing them by version means that patches for older releases are automatically ignored when you change versions, but remain available if you roll back. Their size is negligible

Yes this applies patches between releases. It does not change your Unraid version number.

Creating a ticket is preferred https://unraid.net/contact but you can also contact us via [email protected]

We are committed to providing security fixes going back one minor version. If your license allows access to the first stable release of a minor version you will have access to all stable releases of that minor version, i.e. free security updates if you are one minor version old. This is detailed in our docs. For example, 7.0 is our current release. We will provide security updates for the previous minor release of 6.12, but there should be no expectation of security updates for older releases. Today we are going far beyond our commitment and patching specific issues in much older releases as well. Still, we still highly recommend that everyone upgrade from these old releases to the current version of Unraid.

The source for the plugin itself is available here: https://github.com/unraid/unraid.patch The patches that it installs can be found on your flash drive in /boot/config/plugins/unraid.patch/[version]

Reserved

Reserved

Reserved

Hello plugin authors! We recently published a blog post about some security issues in earlier versions of Unraid and we want to make sure that plugins don’t have similar issues. Please review your plugins for the following potential issues: 1. GET vs POST Use GET sparingly. It is ok when displaying information, like `view.php?id=7` but never for taking action, like `delete.php?id=7`. Any scripts that take action on an input must get that input via POST. In PHP that means using the $_POST and $_GET superglobals specifically rather than the more generic $_REQUEST The CSRF token should never be passed on the querystring via GET. In most cases the webGUI will add it to POST methods automatically. 2. XSS Ensure that any variable is wrapped with `htmlspecialchars($variable)` right before it is output to the browser. This is critical for data that comes from the user via $_POST or $_GET, or from data that is read from config files, or any other place that a user/attacker could affect the contents. It is important to do this right before outputting the variable so there is no risk of running the variable through the htmlspecialchars function twice. Note: this is not strictly necessary if you have already taken steps to ensure the variably only contains integers, or is one of three specific strings, etc. But in general it is safest to always wrap variables before outputting them. 3. Reading config files If you read plugin settings via something like this: $config_file = "/boot/config/$plugin/$plugin.cfg"; $cfg = is_file($config_file) ? @parse_ini_file($config_file, true) : array(); Please consider switching to this: require_once "$docroot/plugins/dynamix/include/Wrappers.php"; // might not be necessary $cfg = parse_plugin_cfg($plugin); This will automatically merge the plugin's config file from the flash drive: /boot/config/plugins/$plugin/$plugin.cfg with a default config (if the plugin has defined one): $docroot/plugins/$plugin/default.cfg And in recent releases it will sanitize the values in the config files to make them safer.

This official Unraid Patch plugin will help protect your server by keeping the OS up to date with the latest patches. This plugin is available for Unraid 6.10.0 and higher, search Community Applications for "Unraid Patch". We plan to use this plugin to distribute bug fixes and security updates to the current release, and may occasionally release security updates for older releases. After installing, visit Tools > Unraid Patch and accept the disclaimer. The plugin submits your server's current version and license key, and gets back the appropriate patches to install. The patches are stored on your flash drive in: /boot/config/plugins/unraid.patch/[version] Visit Tools > Unraid Patch to install them without needing to reboot. On reboot they will automatically be reinstalled, no action needed. To remove the patches and get back to stock, uninstall the plugin and reboot. Note: A reboot is only required if one of the files being patched was already modified by another plugin. The Patch plugin will detect the conflict and advise a reboot. Upon rebooting, the Patch plugin will install first, and patch the files before any other plugin is installed. This will typically prevent conflicts will other plugins. Jan 20, 2025 Security Patch We released a patch to fix a subset of known security issues in older releases (6.10.0-6.12.13), see this blog post for details. Installing this plugin means you get the patch immediately, without having to upgrade or even reboot. But we still recommend upgrading to the current release of Unraid for all the fixes. Unraid 6.12.15 and 7.0.0 have the security fixes built in, so strictly speaking they do not need to have the patch plugin installed at this time. However this can be a powerful tool to aide in not only installing critical security updates in a timely manner, but also fixing bugs without having to wait for a full release. For this reason we recommend having the plugin installed on all versions of Unraid. ... Bug fix patches are now available for Unraid 7.0.0, see the release notes for details. These fixes will be included in the next full release of Unraid as well.