Security Patch for the PHP Service in TrueConf Server
Due to the discovery of critical vulnerabilities in the PHP module used by the TrueConf Server web service (all versions up to and including 5.5.7), we strongly recommend applying the following patch on your PC or virtual machine running the TrueConf Web Manager service for Windows or trueconf-php for Linux.
The release of updated TrueConf Server versions 5.5, 5.4, and 5.3 featuring a new PHP version will be announced separately in the near future.
Recommendations for Windows Server
1. Set memory_limit=-1 in the C:\Program Files\TrueConf Server\php\php.ini file.
2. Add the following new line to the [Session] section in the C:\Program Files\TrueConf Server\php\php.ini file:
|
1 |
session.upload_progress.enabled = 0 |
3. Add the following lines to the C:\Program Files\TrueConf Server\httpconf\opt\rewrite.conf file (if the file does not exist, it must be created):
|
1 2 3 4 |
RewriteEngine On RewriteCond %{REQUEST_METHOD} ^(POST|PUT|PATCH)$ [NC] RewriteCond %{HTTP:Content-Type} ^multipart/form-data [NC] RewriteRule ^ - [F] |
4. Run the following commands:
|
1 2 |
net stop TrueConfWebManager net start TrueConfWebManager |
Recommendations for Linux
1. Set memory_limit=-1 in the /opt/trueconf/server/etc/php/php.ini file.
2. Add the following new line to the [Session] section in the /opt/trueconf/server/etc/php/php.ini file:
|
1 |
session.upload_progress.enabled = 0 |
3. Add the following lines to the /opt/trueconf/server/etc/backend/opt/rewrite.conf file (if the file does not exist, it must be created):
|
1 2 3 4 |
RewriteEngine On RewriteCond %{REQUEST_METHOD} ^(POST|PUT|PATCH)$ [NC] RewriteCond %{HTTP:Content-Type} ^multipart/form-data [NC] RewriteRule ^ - [F] |
4. Run the following commands:
|
1 2 |
sudo systemctl set-property trueconf-php MemoryMax=4G sudo systemctl restart trueconf-php |
Lev Yakupov
Date published: 22.10.2026
Lev Yakupov
Date published: 22.10.2026
Follow us on social networks