Joomla! 3.4.7 security update released

Joomla! 3.4.7 has just been released to further improve (harden) the security fixes made in Joomla! 3.4.6 released just one week ago. It essentially fixes a session hardening issue and SQL injection.

However, as noted in this article, Joomla 3.4.7 changed the way session variables are being handled (details here). As such, some of your extensions might no longer work after upgrading to Joomla 3.4.7. Would suggest you update to Joomla 3.4.6 first and do some testing to make sure all extensions are working before you update to Joomla 3.4.7.

Will my extensions continue to work?

There are 3 scenarios:

• Scenario 1 - You're already using JSession: In this case you're perfectly safe because the API of JSession hasn't been changed. The session encoding has been implemented transparently, so no changes to your code are required.
• Scenario 2 - You're using $_SESSION to read or write your own, extension-specific data: In this case your extension will continue to work. The new code doesn't touch any other data in the global $_SESSION variable.
• Scenario 3 - You're using $_SESSION to read or write general data shared with Joomla or other extensions: In this case your extension will break because the internal structure of $_SESSION has been changed. An easy fix is to use JSession to replace direct usages of $_SESSION.

In case you get the error: You are not allowed to access this link directly

How to fix: Logging out and back in again will fix this issue.

What is the cause: Joomla changed the session storage mechanism. Some parts of your session data were migrated to ensure the update process was successful. Only the data necessary to finish the update was migrated and some data related to user permissions wasn't migrated successfully.