                                                                   Revision: 1.0
--------------------------------------------------------------------------------
Package            fix4.2.8-fx.cbsa

Version            4.2.8-fx

Required version   4.2.8

Support models     Server
                   Server Advanced
                   Server 192
                   Virtual Machine

--------------------------------------------------------------------------------
WHAT THIS PACKAGE DOES

 This package fix Evolution system version 4.2.8-p.
 This update is generally done manually by the user following the instructions
 in the INSTALLATION section.

 Since 4.2.8-f15 it also includes the security fixes of php2shell and
 pg2shell, the same as fix-php2shell.cbsa and fix-pg2shell.cbsa, so they no
 longer have to be installed apart:

  - pg2shell (CVE-2025-8714 and CVE-2026-18408): a crafted project or backup
    could run shell commands on the Evolution Box when it is imported or
    restored. The PostgreSQL client is upgraded to the fixed version, and
    projects are restored with its meta-commands disabled.

  - php2shell (CVE-2026-109618 and CVE-2026-109619): PHP is upgraded to the
    fixed version, and the upload progress of PHP sessions is turned off
    (CVE-2026-115560).

 It can be installed on a box that already has those packages: it leaves the
 fixes in place.

--------------------------------------------------------------------------------
NOTES

 Please clear your browser cache after installing this update.

 The package carries the fixed PHP and PostgreSQL client, so it installs them
 without internet access.
 
--------------------------------------------------------------------------------
LIMITATIONS

 Nothing.

--------------------------------------------------------------------------------
CHANGES IN THIS RELEASE

[4.2.8-f16]
- Improve: Zoom in the page editor of the Evolution editor: zoom in, zoom out,
  fit to the window and a zoom selector in the toolbar.

[4.2.8-f15]
- Security: A crafted project or backup can no longer run shell commands
  through the PostgreSQL client when it is imported or restored (pg2shell,
  CVE-2025-8714 and CVE-2026-18408). The client is upgraded to the fixed
  version, and projects are restored with its meta-commands disabled.
- Security: PHP is upgraded to the version that fixes php2shell
  (CVE-2026-109618 and CVE-2026-109619), and the upload progress of PHP
  sessions is turned off (CVE-2026-115560).

[4.2.8-f14]
- Fix: The active project database update was skipped on evo5/evo6 systems
  after the NTP installation step.

[4.2.8-f13]
- Fix: NTP server not working

[4.2.8-f12]
- Fix: Error at removed character limit on folder names

[4.2.8-f11]
- Improve: Removed character limit on folder names

[4.2.8-f10]
- Fix: Error in automatic task modules that perform ping functions.

[4.2.8-f9]
- Fix: Problem creating the same group address in two gateways. The second
  address is not receiving values.

[4.2.8-f8]
- Fix: The module's modal spans the entire width of the viewport.

[4.2.8-f7]
- Fix: Use yyyy-MM-dd format for SQL date literals

[4.2.8-f6]
- Fix: Remove restrict sqlexec in process point name

[4.2.8-f5]
- Fix: Remove restrict bacnet format in process point name

[4.2.8-f4]
- Fix: Importing ESF duplicates process points if you change the group address
name

[4.2.8-f3]
- Fix: Translator of the annual planner module to Portuguese

[4.2.8-f2]
- Fix: Last ProcessPoint value queue wait for the values, improve performance

[4.2.8-f1]
- Fix: It is not possible to write correctly in the template replacement table.


--------------------------------------------------------------------------------
INSTALLATION

[EVO5 Systems]

  1. Open a web navigator
  2. Enter the address http://<device_IP>/webmin or http://evo5/webmin
  3. Enter the user and password. If the username and password are not known,
     check the product manual or contact with Futurasmus.
  4. In the side menu, navigate to "Others" -> "Custom commands".
  5. Press the button next to "Evolution Package to upload" and search the
     update package file.
  6. Press the "Evolution Package Installer" button. Installation will begin.
     - The installation process can take several minutes. Do not close the
       browser tab or your Evolution system until you have finished.
     - If the system does not have the required previous version installed,
       the installation will be canceled.
     - If the system does not meet the conditions in the LIMITATIONS section,
       the following message will appear and the installation will be canceled.

       ***************************************************
       **                                               **
       **                                               **
       **       YOUR HARDWARE IS NOT COMPATIBLE!        **
       **                                               **
       **                                               **
       ***************************************************

  7. When the installation process is complete, it will display the result.
  8. In the side menu, navigate to "System" -> "Bootup and Shutdown".
  9. At the bottom of the page that opens, press the "Reboot System" button.
 10. Press "Reboot System" button again. The system will restart.

[Other systems]

 1. Open a web navigator
 2. Enter the address http://<device_IP>:8181/upload.php
 3. Enter the user and password. If the username and password are not known,
    check the product manual or contact with Futurasmus.
 4. Press "Select file" button and search the update package file.
 5. Press "INSTALL" button. Installation will begin.
    - The installation process can take several minutes. Do not close the
      browser tab or your Evolution system until you have finished.
    - If the system does not have the required previous version installed,
      the installation will be canceled.
    - If the system does not meet the conditions in the LIMITATIONS section,
      the following message will appear and the installation will be canceled.

      ***************************************************
      **                                               **
      **                                               **
      **       YOUR HARDWARE IS NOT COMPATIBLE!        **
      **                                               **
      **                                               **
      ***************************************************

 6. When the installation process is complete, it will display the result in
    the text field of the web page. After a few seconds the system will
    restart.

