Migrating a Very Old OJS (2.3 or Earlier) to OJS 3.5

Some journals still run OJS 2.3 or even older. These versions predate most of the security work in OJS. Moving them to OJS 3.5 is the most involved OJS migration, and it brings your journal fully up to date.

What your journal gets with OJS 3.5

Your journal moves to the OJS 3 workflow, with everything added in OJS 3.4 and 3.5:

For authors

• A rebuilt submission wizard, made more accessible and easier to use, that shows authors all their details and files for a final check before they submit.
• Authors can save a submission for later and get an email with a link to finish it.
• Titles can carry simple formatting (italics, bold, superscript and subscript), so species names and chemical formulas display properly.
• Authors can suggest reviewers when they submit, if the journal turns this on.

For editors

• Redesigned dashboard and workflow pages, with saved views of the submissions list, a summary panel, and review progress shown for each submission.
• An editorial history for each submission, and each editor’s workload shown when you assign one.
• A minimum number of reviews can be required for a submission.
• Editorial decisions made step by step, with emails you can preview, edit, attach files to and send in the language you choose.
• Several templates for the same email, so editors can load the wording that fits.
• A review round can be cancelled after it’s created, and a submission can be moved back out of review, copyediting or production.
• Reviewers can be notified of the decision on a submission they reviewed.
• A weekly email reminds editors of their pending tasks.

For journal managers

• DOIs built into OJS, with one page to manage them and see the deposit status of each item.
• Usage statistics that support COUNTER Release 5, with institutional and geographic statistics.
• Journal managers can control user enrolment in their own journal.
• An optional data availability statement in the submission metadata.
• Invitations: journal managers invite people to take a role, and they accept by email.
• ORCID integration built into OJS, and several affiliations per author, linked to the ROR registry of research organisations.
• An Editorial Masthead page listing the people in the roles you choose.
• Highlights on the journal homepage, each with an image and a button.
• Basic JATS XML support, and ALTCHA as a spam check for forms.

For the journal’s future

• Long-term support: PKP designated OJS 3.5.0-5 (June 2026) a long-term support release, so OJS 3.5 is the version PKP commits to maintaining for longer.

More detail: new features in OJS 3.4 and 3.5.

Why very old versions are risky

Versions before 2.3.7 have published flaws that are serious on any public website:

• CVE-2012-1468: a user with the author role could run code on the server by uploading a file with an executable extension.
• CVE-2012-1467: a logged-in user could delete or rename files on the server through the bundled iBrowser image library.
• CVE-2012-1469: cross-site scripting through several fields, including the abstract and bio statement.

None of these old versions get fixes of any kind today.

How the upgrade works with us

You and your editors stay focused on the journal; we take care of the upgrade. Your part is just two steps: send us your journal address, and approve the quote. We do the rest:

1. Tell us your journal address. Use the calculator on our upgrade page, the chat or a free call.
2. Free check and a clear quote. We look at your journal and tell you the price and the timeline.
3. Backup and test upgrade. We back everything up and upgrade a private copy, then check it.
4. Data repair and new theme. We repair any data problems we find, and set up an OJS 3 theme with your logo and colours for you to approve.
5. Live upgrade. At a quiet time agreed with you; the journal is usually offline for under 2 hours.
6. Handover and free fixes. You check the journal; anything we missed is fixed free for 14 days.

Why choose a professional for your OJS upgrade

An OJS upgrade changes the database, the files and the code at the same time. With very old journals, the data itself varies a lot from journal to journal, which is why every step happens on a private copy. When something goes wrong, it’s usually one of these:

• An upgrade that stops halfway can leave the journal offline, with a database that neither the old nor the new version will open.
• No complete, tested backup means there is no way back. The database, the files folder (where every article PDF lives) and the code all have to be saved.
• Themes and plugins made for older versions can break pages or stop the site from loading.
• The server often needs a newer PHP version first. Changing it on a live server can take the journal down before the upgrade even starts.
• Quiet damage: emails that stop sending, DOI deposits that fail, or indexing settings that change. These can go unnoticed for weeks.

Our OJS upgrade service is built around these risks. Here’s what it includes:

• A free check of your journal before you pay: version, server, theme, plugins and any custom code.
• One clear price for your upgrade, agreed in writing before we start.
• A full backup of the database, the files folder and the code.
• The upgrade done and tested on a private copy first: submissions, review, emails, DOIs and the public pages.
• Your theme and plugins checked, and updated or replaced where they need it.
• The live upgrade at a quiet time, with the journal usually offline for under 2 hours.
• 14 days of free fixes after the upgrade.

Price and time

Because the data in very old journals varies a lot, we quote these after a free check. Send us your journal address through our OJS upgrade service page.

Feature lists come from PKP’s release notes for OJS 3.4 and 3.5; security details from the public CVE records and PKP’s release notes; PHP dates from the PHP project. Checked in October 2026. New issues are found over time. This guide is independent and not endorsed by PKP.

Questions

Can a journal on OJS 1 or 2.2 still be migrated?

We look at each one in a free check. It tells you what your data needs, and you get a clear quote before any work starts.

How long does it take?

It depends on the data. We give you a clear quote and timeline after the free check.

Will our articles, users and DOIs be kept?

Yes. Articles, issues, files, users and DOIs move across. We check them on the test copy before the live upgrade, and again afterwards.

Can we upgrade OJS ourselves?

You can, if someone in your team knows OJS, PHP and databases well. The risk is real, though: an upgrade that fails halfway can take the journal offline, and without a full, tested backup there is no way back. Our upgrade service includes the backup, a test run on a private copy and 14 days of free fixes.