The hotfix system

As some of you might have noticed, I committed some code yesterday that deals with automatically checking for updates. The commit message also speaks of the “hotfix extension system”. So, what the hell is that then?

As the extension system was taking shape, we had an idea about fixing bugs using extensions. There’s nothing that prevents an extension from fixing a problem as opposed to just adding new functionality. So we came up with the idea of hotfix extensions. If we discover an issue in PunBB 1.3.*, we will have the option of releasing a hotfix extension instead of releasing a new version, provided the issue can be dealt with as an extension (there are certain exceptions). Some of the advantages to this are:

  • Speed. Distributing a hotfix for a straight-up XSS or SQL injection vulnerability is a lot easier than packaging up a brand new release.
  • Security. The faster we can fix something and the faster this fix can be applied to as many installs as possible, the better.
  • Convenience. Installing a hotfix is ridiculously easy. PunBB tells you when there’s a new one and then you go to admin/extensions and click install.

Every once in a while, we will release a new version that incorporates the hotfixes that have been released for previous versions. The database update script will then automatically uninstall any hotfixes it supercedes.

Another cool thing is that since hotfixes are tied to a specific PunBB version, that means we can support an older version through hotfixes even when there are newer versions available. Someone might download PunBB 1.3.1, hack it to pieces and then be hesitant to upgrade to 1.3.3.

There’s still some work left on the extension system as a whole (more hooks as well as some minor additions to the manifest standard), but things are shaping up nicely.