XenForo 2 v2.2.16 Patch 2

XenForo 2.1.7 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo 2.1 upgrade to this release to benefit from increased stability.

Most importantly, this release fixes a security vulnerability in XenForo. Only XenForo 2.1.0 and above are affected.

The issue is a XSS vulnerability. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access.

The vulnerability affects content displayed in the "Approval queue" and requires specially crafted text to be entered into a relevant field for the content type (such as a thread title).

XenForo extends thanks to @rdn for reporting the issue.

We also give an honourable mention to @TickTackk who reported a "self XSS" issue to us related to the Froala rich-text editor that we use. While we do not consider this to be a security issue, we have fixed it and appreciate the time taken to report it.

While we recommend doing a full upgrade to resolve this issue, you can also patch the issue yourself with a simple template edit.

The template in question is approval_queue_macros.

To patch your existing installation, please follow these steps:

1. Download the patched template which is in a file named 217patch.txt (attached to the bottom of this post).
2. Log in to your Admin control panel, expand the Appearance navigation and click the "Templates" link.
3. In the "Filter" field at the top of the list, type approval_queue_macros and open the template.
4. Open the 217patch.txt file and copy the entire contents of this and paste it into the approval_queue_macros template, overwriting the existing content.
5. Click "Save and exit".
6. Repeat the steps above for all of your installed styles.

Note that if you upgrade to 2.1.7 or a newer version, you may undo/revert these template edits.

For instructions on how to resolve the issue by upgrading, and to see what else has changed in XenForo 2.1.7, please read on.

Download XenForo 2.1.7
or
Upgrade directly from within your control panel

Some of the changes in XF 2.1.7 include:

• Ensure that some jobs do not attempt to complete or otherwise change state inside a transaction.
• Ensure correct URL is used in the bookmark label filter when friendly URLs are not enabled.
• Display correct username styling when viewing users linked to an IP.
• In alerts and the news feed, ensure the "your post" link in the reaction item is clickable.
• Ensure Gravatar rebuild job respects the options sent to it.
• Prevent users from deleting their own accounts
• Check for guest posts in post reaction items
• Ensure login button when viewing a forum as a guest wraps properly.
• Only try to hide the global action indicator if it's actually present.
• Do not redirect back to the login page after a connected account request
• Properly check for tag container inside tagger
• Do not escape outbound email test subject phrase
• Correctly handle add-ons created with incorrect casing when the namespace already exists.
• Add additional wording to make it clear that the rejection reason will be shown to users awaiting approval.
• Remove hard-coded height from payment inputs
• Add missing phrase for 'could_not_find_subscriber_id_for_this_purchase_request'
• Display PHP's memory_limit within server environment report.
• Force choice builder to use temporary variable with set tags
• Remove Google+ URL from the Google connected account template.
• Allow disabling pointer events for nested tooltips
• Remove unused parameter when fetching reaction phrase
• Update promotion history interface for clarity
• Fix post copier attachment regex

The following public templates have had changes:

• alert_post_reaction
• approval_item_user
• connected_account_associated_google
• core_button.less
• core_tooltip.less
• forum_view
• payment_initiate.less
• reaction_item_post
• thread_edit

Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.

As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area.

Note: add-ons, customizations and styles made for XenForo 1.x are not compatible with XenForo 2.x. If your site relies upon these for essential functionality, ensure that a XenForo 2 version exists before you start to upgrade. We strongly recommend you make a backup before attempting an upgrade.

Current Requirements

Please note that XenForo 2.1.x has higher system requirements than XenForo 1.x.

The following are minimum requirements:

• PHP 5.6 or newer (PHP 7.3 recommended)
• MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
• All of the official add-ons require XenForo 2.1.
• Enhanced Search requires at least Elasticsearch 2.0.

XenForo 2.1.4 Released | XenForo 2.1.4 Released **** | Add-ons Released

XenForo 2.1.4 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo 2.1 upgrade to this release to benefit from increased stability.

Some of the changes in XF 2.1.4 include:

• Fix some slightly over-zealous image removal code in the editor if image uploads are not supported.
• Improve performance of embed metadata rebuild.
• Fix regression relating to markdown being parsed in built-in block BBCodes
• Implement the russian ruble symbol
• Detect UTF-8 Byte Order Marker to prevent incorrect Windows-1252 fallback
• Standardize on \w for BB code tag matching, rather than a mishmash of [a-z0-9] and [a-z0-9_]
• Add support for user_id token in notices
• Don't enforce minimum tag requirements when using the quick lock/stick moderator actions
• Update draft last_update field when draft is updated.
• Make show current activity privacy checkbox dependent on show online status checkbox when editing a user
• Prevent guests from entering user upgrade checkout flow
• Use isIgnored methods in widget classes where available
• Ensure deleteChildAction option of XF:TreeStructured behaviour is passed through to child entities
• Workaround for image dragging bug in Firefox.
• Prevent additional content reports being considered a state change from Open->Open
• Show the 'unignore' button for users that can no longer be ignored
• Ensure tags containing quotes are escaped properly in the token input.
• Increase the maximum query length for the auto-completer to 15 characters (from 10).
• Allow IP hostnames in email addresses
• Update currency symbols for KZT and UAH
• Don't treat 6to4 IPv6 addresses as local
• Change the news feed item thread link to link to the thread rather than the post.
• Adjust in-editor vertical alignment to be the same as it is in the published post.
• Apply missing maxEntity field for warning_message column in various entity classes
• Prevent line break being inserted between two tables when rendering BBCode in editor
• Prevent caching of inline thread edit overlay to ensure accurate state
• Increase thread quick reply message container selector specificity
• When editing a phrase, only display the "Master value" row if the phrase exists in the "Master language".
• When using the schema manager and changing an existing column to a non-int type, remove the unsigned property if set.
• When rendering push templates, attempt to maintain the receiving user's style (or the site default).
• Move restoration of original language and style after push template render to finally block
• Delete reply ban alerts sent to unbanned user rather than from banning moderator
• Attempt to detect and block batch install of encrypted archives
• Make global '$xf' variable available to push templates
• Add workaround to prevent error when searching content in the admin panel based on value of custom field with numeric ID
• Handle string IDs in the abstract field map class when updating field associations.
• Fix issue with being able to delete emojis in the editor by reverting back to a previous version of the editor.
• Ensure the unapproved counts are recalculated correctly and take content visibility into account.
• Update inline_mod_actions event listener description to suggest using the global app object rather than public.
• Skip custom field max length checks for field types which tend to have a fixed length.
• Prevent unfurl block overlapping aligned image
• Fix issue causing high-numbered pages on bookmarks list to appear empty
• When an email address is changed, move user out of email bounced state if email confirmation is not required
• Wrap markForumReadByUser query in a separate transaction and attempt retry on deadlock
• Ensure message_count field is updated in cached entities when posts inserted/deleted
• Only hide the editor button for smilies if there are no smilies AND no option to use emoji.
• Remove defunct currency 'Lithuanian litas'
• Make \XF\Repository\AbstractField display group agnostic
• Fix n+1 queries on moderator list
• Correctly handle deleting directories with symlinks
• Run add-on onActiveChange method in a separate CLI process after transaction committed
• Use the term "login" rather than "log in" on the admin login form.
• Twitch VOD URLs were only embeddable if they had a start time in the URL. Allow base Twitch VOD URLs to be embedded.
• Standardize metadata fetcher header keys to be lower case. This allows Twitter profile URLs to be unfurled.
• Add new alert action for watched forum content alerts
• When indexing profile post comments, reduce the number of queries.
• When setting http client defaults, do not overwrite existing headers that have been passed in.
• For the new threads widget, adjust what is queried for in expanded mode.
• Remove the forced index hint for latest threads widget and add a new (post) date limit option.
• For some node types, display them as table-cells which will ensure vertical alignment.

The following public templates have had changes:

• account_bookmarks
• account_ignored
• bb_code.less
• editor.less
• node_list.less
• reaction_item_post
• thread_list_macros
• thread_view
• widget_new_threads

Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.

As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area.

Note: add-ons, customizations and styles made for XenForo 1.x are not compatible with XenForo 2.x. If your site relies upon these for essential functionality, ensure that a XenForo 2 version exists before you start to upgrade. We strongly recommend you make a backup before attempting an upgrade.

Current Requirements

Please note that XenForo 2.1.x has higher system requirements than XenForo 1.x.

The following are minimum requirements:

• PHP 5.6 or newer (PHP 7.3 recommended)
• MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
• All of the official add-ons require XenForo 2.1.
• Enhanced Search requires at least Elasticsearch 2.0.