How do I stop the new "Security Notifications" that civi pops up for upgrades

Question

As we keep an eye on these upgrade for clients, the last thing we need is for them to worry about it while we check out their customisations for compatability etc.

How to get rid of them?

Answer 1

Disabling security notifications hides the notice from your users, but it won't hide your sites from attackers. Turning off the warning supports a scenario where those sites are at risk longer.

Here's how we handle it for our hosting clients -

• Create a recurring item in your calendar for the CiviCRM security release dates, first and third Wednesday each month. (We do the same for Drupal security releases.)
• Be subscribed to the CiviCRM Security Advisories announce list.
• If a release occurs on that date, run the upgrade through your testing, then deploy/apply to production.

Since CiviCRM stores personal data, I believe every organisation using CiviCRM has a responsibility to ensure there are processes in place to ensure security updates are applied promptly as part of a wider programme to protect your customers and their contacts.

Answer 2

Marsh's answer is correct for Civi 4.6. For versions 4.7+, go to Administer menu » Administration Console » System Status and press "Hide" next to the version check message. You can choose to hide the message for a week, a month, or forever.

Note that hiding a non-security update will NOT hide a security update, but hiding a security update will hide both.

If you're looking for a way to hide upgrade messages from the command line, or when there's no update available, use an API command, something like this:

#Drupal or Backdrop
drush cvapi StatusPreference.create name="checkVersion" ignore_severity=2
#WordPress 
wp civicrm api StatusPreference.create name="checkVersion" ignore_severity=2

Change the 2 to a 5 to hide security updates as well as non-security updates.

Answer 3

Whilst this may not be a good idea if you don't have infrastructure to keep on top of upgrades & security issues, the setting can be found in:

Administer > System Settings > Misc.

the notifications are set in the dababase in the civicrm_setting table (along with lots of other useful little settings :))

From the "name" column, we can ascertain that:

global $civicrm_setting;
// Disable new version messages
$civicrm_setting['CiviCRM Preferences']['versionAlert'] = 0;
// Disable Security Messages
$civicrm_setting['CiviCRM Preferences']['securityUpdateAlert'] = 0;

will disable all of the notifications.

See Chris' answer - it's important to have the infrastructure to take care of upgrades!

Answer 4

You can disable this from: CiviCRM > Administer > System Settings > Undelete, Logging, ReCAPTCHA (on version 4.3.x ) and from CiviCRM > Administer > System Settings > Misc (Undelete, PDFs, Limits ....) (on version 4.4.x)