# 1.1 security fix backports still available?

**URL:** <https://www.ruby-forum.com/t/1-1-security-fix-backports-still-available/108088>\
**Category:** Rails\
**Created:** [June 28, 2007, 11:42pm UTC](https://www.ruby-forum.com/t/1-1-security-fix-backports-still-available/108088 "2007-06-28T23:42:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![sjmadsen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/b3f665/32.png) [@sjmadsen](https://www.ruby-forum.com/u/sjmadsen)\
**Post date:** [June 28, 2007, 11:42pm UTC](https://www.ruby-forum.com/t/1-1-security-fix-backports-still-available/108088/1 "2007-06-28T23:42:01Z")

</div>

I have a new client with an app running on 1.1.2 and I’m trying to  
verify if his vendor/rails already has the critical security fix from  
last August. Unfortunately, the backport patches to earlier 1.1  
releases linked from

> **[Rails 1.1.6, backports, and full disclosure](https://rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure)**
>
> The cat is out of the bag, so here’s the full disclosure edition of the current security vulnerability. With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3), you can trigger the evaluation of Ruby code through the URL because of a bug in the...

have moved (or been removed).

It’s probably simple enough to update him to 1.1.6 in the short term,  
and get him on 1.2 later, but for right now, I’d rather ensure his code  
is secure and schedule the bigger upgrade(s) for later.

Does anyone know where I can find those backport patches? I’ve scoured  
Google and much to my surprise, no one seems to have mirrored them.