📙 You will learn
How to upgrade from Upgrade from 2.8.7 to 2.8.8.
Prerequisites
Audience: IT Professional and/or End User
Difficulty: Advanced
Time needed: Approximately 60 minutes
Tools required: Tomcat, MySQL or MS SQL Server
Note |
---|
ALWAYS PERFORM A FULL BACKUP OF YOUR DATABASE BEFORE ATTEMPTING ANY UPGRADE! MySQL Server: You can run the MS SQL Server: Using SSMS, right-click on the database, select Tasks → Back Up…, then choose the location & name of the backup file and click OK. |
If you have any questions or concerns or if you wish to upgrade from an older version of ThreadFix, please reach out to our support team here: support@threadfix.it
ThreadFix Deployment Update
Follow these steps to deploy the updated version of ThreadFix:
Stop the Tomcat instance on which ThreadFix is running.
Move your current ThreadFix deployment directory from your Tomcat webapps folder into a backup directory.
webapps directory location: //TOMCAT_HOME/webapps
Copy the updated ThreadFix folder from your new artifact into your webapps directory.
webapps directory location: //TOMCAT_HOME/webapps
Copy the following files from your backed up ThreadFix directory to the newly updated ThreadFix directory:
(FROM: <previous-threadfix-deploy>/WEB-INF/classes/, TO: <new-threadfix-deploy>/WEB-INF/classes/, except as noted below)
custom.properties
ESAPI.properties (See REQUIRED update below)
Be sure that
Log4jfactory
is no longer referenced as theESAPI.Logger
in yourESAPI.properties
.Replace the update the current ESAPI.Logger value with the one provided here:
ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory
jdbc.properties
jms.properties
threadfix.license
If you've updated any of these in your previous deployment, copy them as well:
<threadfix-deploy>/WEB-INF/security.xml
If upgrading from 2.8.5, see REQUIRED update below:
Replace bean definition in
security.xml
file:<bean id="velocityEngine" class="org.springframework.security.saml.util.VelocityFactory" factory-method="getEngine"/>
With:
<bean id="velocityEngine" class="com.denimgroup.threadfix.service.saml.CustomSamlVelocityFactory" factory-method="getEngine"/>
<threadfix-deploy>/WEB-INF/classes/security/samlKeystore.jks (and/or any other Java keystore that you've saved in this directory)
Note: If upgrading from 2.8.5, do not copy log4j.xml. As of version 2.8.5.1, log4j.xml was replaced with logback.xml, so there’s no need to copy log4j.xml from your previous artifact.
Any changes that you had made in log4j.xml will need to be made in logback.xml if you want them to persist.