# Important Emoncms Security Update

**URL:** <https://community.openenergymonitor.org/t/important-emoncms-security-update/5704>\
**Category:** Emoncms\
**Created:** [20 November 2017 10:45 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704 "2017-11-20T10:45:40Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [20 November 2017 10:45 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/1 "2017-11-20T10:45:40Z")

</div>

After an emoncms security review we have found a security issue in the user module associated with the ‘remember-me’ feature that maintains a persistent login.

We have now fixed the issue and the update is now available in the emoncms stable and master branch, starting from v9.8.18+

This update is also available via the standard EmonPi/EmonBase update procedure, just click on ‘setup \> emonPi Update’ in local emoncms to start the update process.

We would recommend updating as soon as possible. If you wish to delay updating, disabling the remember me feature in emoncms settings.php is an interim fix, though less recommended. To disable the remember me feature, set:

$enable\_rememberme = false;  
In emoncms/settings.php

Best regards

Trystan

Note: The latest release is now v9.8.25 (8th of December 2017)

---

<div class="post-metadata">

**Author:** ![Gwil](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/gwil/32/29028_2.png) [@Gwil](https://community.openenergymonitor.org/u/Gwil)\
**Post date:** [20 November 2017 11:37 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/2 "2017-11-20T11:37:15Z")

</div>



---

<div class="post-metadata">

**Author:** ![pb66](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/pb66/32/27_2.png) [@pb66](https://community.openenergymonitor.org/u/pb66)\
**Post date:** [20 November 2017 12:27 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/3 "2017-11-20T12:27:08Z")

</div>

Also remember to run “update and check” from the admin page if updating emoncms manually. the emonpi update routine includes this step automatically.

 ![2017-11-20](https://community.openenergymonitor.org/uploads/default/original/2X/7/744adab0ad2686bb89a752d2bcbbc61039e1df73.png)

---

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [20 November 2017 21:30 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/4 "2017-11-20T21:30:47Z")

</div>

**Device module**

If your using the emoncms device module and have come across an ‘undefined’ error while initialising a device, there is a temporary patch to make it work with the latest version of emoncms, available here: [https://github.com/emoncms/device/tree/set\_processlist\_patch](https://github.com/emoncms/device/tree/set_processlist_patch)

```
cd /var/www/emoncms/Modules/device
git checkout set_processlist_patch

```

We are launching a new version of the device module soon, this patch fixes the initialisation issue until the new version is available.

---

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [24 November 2017 11:24 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/5 "2017-11-24T11:24:24Z")

</div>

**’Undefined’ error on login attempt**

If your updating from a version of emoncms prior to the 22nd of April 2017 (v9.8.3 or below) you may find a ‘Undefined’ error on login attempt. This is due to a missing ‘startingpage’ field in the user table. The database can be updated without login by adding the settings line:

```
$updatelogin = true;

```

to the end of your settings.php file and then running database update by going to the following url:

```
http://localhost/emoncms/admin/db

```

Remember to remove the $updatelogin = true; line once complete.

---

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [24 November 2017 18:19 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/6 "2017-11-24T18:19:45Z")

</div>

emoncms v.9.8.21 now shows a more helpful error message in place of ‘undefined’ which should help with debugging certain login/register issues.

---

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [27 November 2017 15:44 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/7 "2017-11-27T15:44:29Z")

</div>

The latest version of emoncms is now v9.8.24 merging several bug fixes fixed in the master branch over the last week which are now available in the stable branch, see emoncms release notes:

[https://github.com/emoncms/emoncms/releases/tag/9.8.24](https://github.com/emoncms/emoncms/releases/tag/9.8.24)

---

<div class="post-metadata">

**Author:** ![borpin](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/borpin/32/193_2.png) [@borpin](https://community.openenergymonitor.org/u/borpin)\
**Post date:** [29 November 2017 19:58 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/8 "2017-11-29T19:58:07Z")

</div>

Am I right in thinking this is only available on the ‘master’ branch and not ‘stable’?  
{edit}  
My bad. I checked the tags and it seemed to be 9.7.x on stable. In fact the syntax of the tags has changed so there is no longer a ‘v’ at the start so they no longer sort logically.

---

<div class="post-metadata">

**Author:** ![Jon](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/jon/32/1876_2.png) [@Jon](https://community.openenergymonitor.org/u/Jon)\
**Post date:** [29 November 2017 20:00 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/9 "2017-11-29T20:00:42Z")

</div>

I updated my emonPi on Nov 27 (via **stable** ) and it is now v9.8.24.

---

<div class="post-metadata">

**Author:** ![borpin](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/borpin/32/193_2.png) [@borpin](https://community.openenergymonitor.org/u/borpin)\
**Post date:** [7 December 2017 07:29 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/10 "2017-12-07T07:29:18Z")

</div>

> [@TrystanLea](#):
>
> The latest version of emoncms is now v9.8.24

I know I have said it before, but there should be a separate announcement in the forum for _every_ update. Currently if you go into the forum, you will just see the thread title of v9.8.18 as being the latest. These announcement posts should be Pinned and Locked and any discussion, created as a linked discussion.

I also think that a link on how to upgrade for both stand alone and prebuilt setups should be included in the announcement.

With the move to a separate version file, it should be possible for an instance of Emoncms to be able to have an alert on any page that an update is required.

---

<div class="post-metadata">

**Author:** ![johnbanks](https://community.openenergymonitor.org/letter_avatar_proxy/v4/letter/j/c6cbf5/32.png) [@johnbanks](https://community.openenergymonitor.org/u/johnbanks)\
**Post date:** [8 December 2017 19:58 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/11 "2017-12-08T19:58:48Z")

</div>

How do you update emoncms via SSH rather than using the web interface/Admin?  
Thx

---

<div class="post-metadata">

**Author:** ![borpin](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/borpin/32/193_2.png) [@borpin](https://community.openenergymonitor.org/u/borpin)\
**Post date:** [8 December 2017 20:34 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/12 "2017-12-08T20:34:34Z")

</div>

Is it an emonpi image or a self install?

---

<div class="post-metadata">

**Author:** ![johnbanks](https://community.openenergymonitor.org/letter_avatar_proxy/v4/letter/j/c6cbf5/32.png) [@johnbanks](https://community.openenergymonitor.org/u/johnbanks)\
**Post date:** [8 December 2017 20:46 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/13 "2017-12-08T20:46:25Z")

</div>

Originally it was an SD image.

---

<div class="post-metadata">

**Author:** ![borpin](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/borpin/32/193_2.png) [@borpin](https://community.openenergymonitor.org/u/borpin)\
**Post date:** [8 December 2017 21:13 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/14 "2017-12-08T21:13:53Z")

</div>

The documentation is here [https://github.com/emoncms/emoncms/tree/master/docs](https://github.com/emoncms/emoncms/tree/master/docs) but is woefully out of date.

If all you do is run emoncms on the SD card, then I’d be inclined to pick up a new Stretch image, backup the data, put the new image on a new card (so you can roll back if necessary) and then upload the backed up data.

There are some threads here on backing up data; it rather depends on how old your image is and how long since it was updated.

---

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [8 December 2017 22:43 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/15 "2017-12-08T22:43:52Z")

</div>

Ok I will try and give that a go, I will pin only the latest release announcement, or if an announcement such as the recent security one is of higher importance leave that pinned as well.

---

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [8 December 2017 22:54 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/16 "2017-12-08T22:54:08Z")

</div>



---

<div class="post-metadata">

**Author:** ![TrystanLea](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/trystanlea/32/31_2.png) [@TrystanLea](https://community.openenergymonitor.org/u/TrystanLea)\
**Post date:** [8 December 2017 22:54 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/17 "2017-12-08T22:54:26Z")

</div>



---

<div class="post-metadata">

**Author:** ![johnbanks](https://community.openenergymonitor.org/letter_avatar_proxy/v4/letter/j/c6cbf5/32.png) [@johnbanks](https://community.openenergymonitor.org/u/johnbanks)\
**Post date:** [9 December 2017 14:02 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/18 "2017-12-09T14:02:24Z")

</div>

Thx …  
Trystan’s latest announcement (release of v9.8.25) includes the all important info …

SSH/Git update procedure example:

```auto
cd /var/www/emoncms
git pull

```

---

<div class="post-metadata">

**Author:** ![borpin](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/borpin/32/193_2.png) [@borpin](https://community.openenergymonitor.org/u/borpin)\
**Post date:** [9 December 2017 15:57 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/19 "2017-12-09T15:57:49Z")

</div>

And then remember to check for database updates from the administration page.

---

<div class="post-metadata">

**Author:** ![borpin](https://community.openenergymonitor.org/user_avatar/community.openenergymonitor.org/borpin/32/193_2.png) [@borpin](https://community.openenergymonitor.org/u/borpin)\
**Post date:** [9 December 2017 15:59 UTC](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704/20 "2017-12-09T15:59:48Z")

</div>

> [@TrystanLea](#):
>
> Ok I will try and give that a go, I will pin only the latest release announcement, or if an announcement such as the recent security one is of higher importance leave that pinned as well.

Great but can it appear (and stay) at the top of the ‘latest’ page please? I nearly missed this…

[Next page](https://community.openenergymonitor.org/t/important-emoncms-security-update/5704.md?page=2)