Skip to main content
OJS for Everyone Logo
OJS for EveryoneThe Practical GuidebookRSYN Research LLP

OJS Migration Guide: Moving from OJS 3.5.0.x to OJS 3.5.0.4

Role: Site Administrator
Time: 20–40 minutes
Source: OJS 3.5.0.0, 3.5.0.1, 3.5.0.2, or 3.5.0.3
Target: OJS 3.5.0.4

LTS Candidate

OJS 3.5.0.4 is a strong candidate for Long-Term Support (LTS) designation by PKP. Once confirmed, older 3.x versions will enter a one-year end-of-life window. Upgrading to 3.5.0.4 now places your installation on the most stable and supported path.

What Changed in OJS 3.5.0.4​

OJS 3.5.0.4 is a patch release within the 3.5.0 series. It includes bug fixes, security patches, and minor improvements — there are no breaking schema changes when upgrading from 3.5.0.x.

Security Fixes​

  • Hardened file upload validation to reject malicious file extensions
  • Fixed a reflected XSS vulnerability in the search interface (reported via PKP security advisory)
  • Updated third-party JavaScript dependencies with known CVEs
  • Strengthened CSRF token validation on several form endpoints

Bug Fixes​

AreaFix
Submission wizardFixed missing metadata fields for certain locale configurations
Review assignmentFixed a race condition when assigning multiple reviewers simultaneously
DOI registrationFixed CrossRef bulk deposit failing on journals with special characters in ISSN
StatisticsFixed COUNTER 5 TR_J1 report returning duplicate rows for multi-galley articles
Email notificationsFixed "Send a copy to self" option not being respected
Plugin managerFixed "Install from file" failing for zip archives larger than 20 MB
Galley viewerFixed PDF.js viewer not rendering on HTTPS sites with strict CSP headers
OAI-PMHFixed deleted records not returning correct datestamp in ListIdentifiers response
User managementFixed bulk user export including inactive accounts unintentionally

Improvements​

  • Job queue worker stability improvements under high submission load
  • Extended REST API — new GET /submissions/{id}/publications/{pubId}/galleys endpoint
  • Improved accessibility (WCAG 2.1 AA compliance) on reviewer interface
  • Updated default email templates for invitation workflows

Pre-Migration Checklist​

  • Full database backup: mysqldump -u ojsuser -p ojs > ojs_backup_$(date +%Y%m%d).sql
  • Files directory backup: tar -czf ojs-files-$(date +%Y%m%d).tar.gz /var/www/ojs-files
  • Config backup: cp config.inc.php config.inc.php.bak
  • Check PHP is 8.1+ (php -v)
  • Note any custom theme or plugin overrides
  • Put site into maintenance mode or schedule a maintenance window

Migration Steps​

Step 1 — Verify Current Version​

cd /var/www/html/ojs
grep -r "release" dbscripts/xml/version.xml | head -3

Or check Administration → System Information.

Step 2 — Download OJS 3.5.0.4​

cd /tmp
wget https://pkp.sfu.ca/software/ojs/download/ojs-3.5.0-4.tar.gz
tar -xzf ojs-3.5.0-4.tar.gz
SHA-256 verification

Always verify the integrity of downloaded archives:

sha256sum ojs-3.5.0-4.tar.gz
# Compare with the hash published on pkp.sfu.ca/software/ojs/download/

Step 3 — Back Up Configuration​

cp /var/www/html/ojs/config.inc.php /tmp/config_3504_bak.inc.php

Step 4 — Replace Application Files​

rsync -av --delete \
  --exclude='config.inc.php' \
  --exclude='public/' \
  --exclude='cache/' \
  --exclude='.htaccess' \
  /tmp/ojs-3.5.0-4/ /var/www/html/ojs/

# Restore config
cp /tmp/config_3504_bak.inc.php /var/www/html/ojs/config.inc.php

Step 5 — Run the Upgrade Script​

cd /var/www/html/ojs
php tools/upgrade.php upgrade

Expected output for a patch upgrade:

Checking for schema changes ... found schema changes
Upgrading database ...
Database successfully upgraded.
Successfully upgraded Open Journal Systems.

Step 6 — Clear Caches​

php lib/pkp/tools/cacheClear.php

Step 7 — Update File Permissions​

chown -R www-data:www-data /var/www/html/ojs

Step 8 — Verify Plugins​

Check that plugins remain functional after the patch:

  1. Go to Website → Plugins
  2. Disable and re-enable any plugin that shows errors
  3. Check the Plugin Upgrade Guide for 3.5.0.4 compatibility notes

Post-Migration Verification Checklist​

  • Site loads at the main URL without PHP errors
  • Administrator login works
  • New submission can be created end-to-end
  • Published article galley files download correctly
  • DOI registration endpoint responds (if applicable)
  • Email sending works (test from Settings → Website → Emails)
  • Statistics dashboard loads without errors
  • Job queue is processing (php lib/pkp/tools/jobs.php run)

Plugin Compatibility in OJS 3.5.0.4​

All plugins compatible with OJS 3.5.0.x should continue to function in 3.5.0.4 without modification. However, review the following:

PluginStatus in 3.5.0.4Notes
ORCID Profile✅ CompatibleEnsure OAuth redirect URIs are still registered
CrossRef Export✅ CompatibleReconfigure if CrossRef API credentials changed
Google Analytics✅ Compatible—
Funding✅ Compatible—
PDF.js Viewer✅ FixedCSP header fix in this release; re-enable if previously broken
Custom Block Manager✅ Compatible—
Hypothesis✅ Compatible—
ROR✅ Compatible—

For a complete plugin compatibility matrix, see the Plugin Upgrade Guide.

Rollback Procedure​

If 3.5.0.4 causes unexpected issues:

# 1. Restore application files from your pre-upgrade archive or re-deploy 3.5.0.3
rsync -av --delete \
  --exclude='config.inc.php' \
  --exclude='public/' \
  --exclude='cache/' \
  /path/to/ojs-3.5.0-3/ /var/www/html/ojs/

# 2. Restore config
cp /tmp/config_3504_bak.inc.php /var/www/html/ojs/config.inc.php

# 3. Restore database (schema differences are minimal but exist)
mysql -u ojsuser -p ojs < ojs_backup_YYYYMMDD.sql

# 4. Clear caches
php lib/pkp/tools/cacheClear.php

Further Reading​