On October 25th, 2016 the Joomla team issued a security release for the 3.x series of Joomla. Joomla 3.6.4 fixes a high-severity security vulnerability that can allow remote users to create new accounts, modify existing accounts, and elevate their privileges to that of a Super Administrator on any Joomla site not patched. These issues combined potentially give attackers enough power to get complete control of your Joomla website. The affected Joomla versions are from 3.4.4 through 3.6.3.
The latest release of Joomla contains maintenance and security patches but also adjusts the way Joomla updater works.
To update Joomla 3.6.1 you'll first need to update the core extension that manages updates.
To achieve that follow this instruction:
Remember to run a backup before attempting any updates!
Go to Extensions > Manage > Update. Find the Joomla! Update Component Update and apply this update
Once that component update has been applied, you can update Joomla core in the normal way, using Components > Joomla! Update
Invalid security token error message?
When you update a system running Joomla 3.6.1, you may see the following warning:
The most recent request was denied because it contained an invalid security token. Please refresh the page and try again.
To fix this issue, we just need to run a database check. Navigate to Extensions > Manage > Database and click the 'Fix' button in the top left hand corner.
That's it! You're now successfully running Joomla 3.6.2.
Are you using Akeeba backup?
Some users have reported problems with Akeeba backup when the 'Backup on update' plugin runs before the update. Should you experience this scenario, run a backup manually and then disable the 'System - Backup on upgrade' Akeeba plugin before completing the Joomla update.
Joomla Update Emails notify you an update is available
Joomla! version 3.x contains a system plugin which by default emails every super-administrator in the system notifying them when a core Joomla! update is available. The emails are not sent by the Joomla! software project but rather by the Joomla! system installed on your web server. By default, this plugin emails Superadministrator accounts once per day until the update has been applied.
In Joomla! 3.6.1 there was a bug which caused multiple emails to be sent in a short space of time. As we keep superadministrator accounts on all our JoomlaCare Managed Service customers, we received a lot of these emails - over 300 for one customer alone!
How to disable Joomla! Update Notifications
To disable these update notifications emails, while logged into your Joomla! administrator area navigate to Extensions > Plugins and search for 'Update Notification'. Then unpublish the 'System - Joomla! Update Notification' plugin in the Plugin Manager on your site. This stops the emails. When an update becomes available, you will still see a notification in the administrator area after you login.
Should I update my Joomla site?
Yes!.. but backup first! It's a good idea to keep your Joomla! software up to date because updates often contain new features as well as important security updates and fixes. However, it's important to ensure that any of the other extensions you have installed, for example components, templates, plugins, modules and language packs are compatible with the update. If you're not sure about that you can check with each extension provider. It's also always a great idea to ensure you have a validated backup before you do any sort of updating, so you have a fall back if something goes wrong. We recommend the Akeeba backup extension for Joomla backups.
What Joomla versions are compatible?
As of writing this article, the latest major release of Joomla is version 3. If your Joomla website is version 1.0.x, 1.5.x, 1.6.x, 1.7.x or 2.5.x then you can't complete a simple upgrade, many of the extensions associated with these versions are incompatible with Joomla 3 and will also need updating. In fact, the jump to Joomla 3 is so significant we need to migrate the core content, user accounts, menu items, and everything else into a new Joomla 3 system and then install and import data from any extra extensions you have in use for example Virtuemart, Kunena forum, Image Galleries, Membership components or other extensions. In all likelihood you will also need to implement a new template, which will give your website a responsive design - allowing it to be viewed well on small screen devices.
For moving between versions of Joomla 3, an upgrade is the way to go. Be sure to have a valid backup before proceeding or talk to a Joomla Expert for a free review if you're unsure!
The latest release of Joomla contains maintenance and security patches but also adjusts the way Joomla updater works.
