28 July 2009, 23:53

Today we moved from Mahara 1.0.11 to Mahara 1.1.5. We have implemented an automatic script to follow the Upgrading Mahara guide.

At the last stage (upgrade the database) Mahara 1.15 automatically detects that upgrade is required and provide the link on home page to upgrade the database.  Now, I remember before this it was (admin/upgrade.php) asking for Admin Credential.

And now it just process the request as someone click the link. I think this should be secured by login (only admin can run this).

29 July 2009, 18:36

Hi - for the upgrade from 1.0 to 1.1, we couldn't enforce the admin login, because user tables were being changed in such a way that running the 1.1 code on the 1.0 database would crash when trying to log in. Thus, it's unprotected.

I'm not entirely convinced about us having a link on the homepage to run the upgrade. But, if admins can't log in, then they can't get to the admin page to run the upgrade. Also, if following the upgrade instructions, people should be doing upgrades after closing the site from other users (using more than just mahara's rudimentary auto-closing, e.g. .htaccess), and in theory aren't dropping the new code in place and then going for a coffee . So the link just makes things easier for admins.