2.5.4 for XenForo 2.3
Security fixes
- SQL injection: Fixed vulnerabilities that could potentially allow unauthorized access to or modification of database information.
- Stored cross-site scripting (XSS): Fixed vulnerabilities that could allow malicious JavaScript to execute in other users' browsers.
- Cross-site request forgery (CSRF): Fixed insufficient request protections that could potentially allow unauthorized actions to be performed through an authenticated user's session.
- Improper access control and information disclosure: Fixed vulnerabilities that could expose restricted content, feedback information, and activity data to users without the necessary permissions.
- Improper authorization: Strengthened permission enforcement to prevent users from performing feedback-related actions they are not authorized to perform.
- Unsafe deserialization: Improved the handling of stored data to prevent unsafe object deserialization.
All users are strongly encouraged to update to this version as soon as possible.
Bug fixes
- Fixed negative feedback being incorrectly counted as neutral in statistics.
- Fixed pagination in the "Feedback left" list.
- Fixed errors when viewing feedback belonging to members whose accounts no longer exist.
- Prevented missing or invalid ratings from being saved as neutral feedback.
- Fixed suggestion title searches containing special characters.
- Restored resource and media results in deal-thread suggestions.
- Fixed username filtering in feedback lists and Latest Activity.
- Fixed member searches for usernames containing quotation marks.
- Fixed the Latest Activity username filter not applying immediately.
- Fixed valid deal URLs on board subdomains being rejected when the alternate URL option was enabled.
- Restored the copyright notice in the footer on XenForo 2.3.
- Fixed rating icons displaying incorrectly in some feedback lists.
- Fixed feedback widgets not appearing unless legacy sidebar options were enabled.
- Restored the Feedback System Admin CP menu for administrators with import or rebuild permissions.
- Fixed special characters being double-escaped when editing feedback reviews.
- Standardized the storage format of imported feedback reviews to match native reviews.
- Fixed errors on thread pages containing posts from guests or deleted members.
- Fixed the feedback button in threads not respecting the "restricted feedback" option.
- Fixed the "comment required" option not being respected when editing feedback.
- Corrected the visibility of the "add comment" form based on member permissions.
- Fixed validation errors not being handled correctly on the preferences page.
- Fixed issues when merging member accounts in the Admin CP.
- Ensured feedback statistics remain intact if member account deletion fails.
- Corrected IP address logging for feedback comments.
- Fixed user rating rebuilds not completing when mutual feedback was enabled.
- Fixed errors when editing feedback with unique deal URL enforcement enabled.
- Corrected resource deal URL normalization.
- Fixed recipient feedback totals not updating after feedback deletion.
- Improved error handling when editing comments that no longer exist.
- Corrected error handling when reporting feedback without the required permission.
- Fixed author data operations involving deleted members.
- Fixed internal feedback redirects losing the intended feedback reference.
- Prevented activity-logging errors from disrupting page rendering.
- Fixed incorrect links after submitting feedback, in per-member statistics, and in reported feedback activity.
- Fixed usernames containing apostrophes being incorrectly escaped in activity entries.
- Removed an obsolete image reference that caused unnecessary missing-file requests.
- Added six missing phrases.
- Improved the reliability of large administrative rebuild and import operations by limiting excessive processing delays.
- Corrected validation of the "items per page" setting to require a positive value.
- Fixed PHP 8.x notices and incorrect class references, including issues affecting the add-comment view.
- Prevented feedback from being submitted for nonexistent or ineligible members.
- Corrected spam-check handling to properly evaluate feedback submissions and enforce the resulting decisions.
- Fixed feedback editing unexpectedly modifying the recipient's comment.
- Corrected mutual feedback visibility and consistency during regular use and rating rebuilds.
Other changes
- Updated PHP requirements: Installing or upgrading the add-on now requires PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+, depending on the PHP branch. These minimum versions include important upstream security fixes.
- Improved statistics performance by applying filters directly in database queries.
- Reduced unnecessary JavaScript loading by removing an unused charting package.
- Optimized deal-thread suggestion responses by eliminating duplicate title data.
- Deal-thread suggestions are now available only to logged-in members, with updated request and response handling.
- Restricted deal URLs to HTTP(S) links on the board's domain and its subdomains, including imported records.
- Improved the upgrade process by processing review clean-up operations in resumable batches.
- Removed the obsolete "Data import mode" option. Import operations now automatically identify imported records.
- Removed obsolete XenForo 1 compatibility files and unused templates.
- Updated internal database queries to use bound parameters.
- Strengthened validation of imported data to improve import safety and reliability.
- Separated import-specific validation from regular feedback submission validation.
- Improved diagnostic logging to prevent debug information from appearing in rendered pages.
2.4.3 for XenForo 2.2
Security fixes
- SQL injection: Fixed vulnerabilities that could potentially allow unauthorized access to or modification of database information.
- Stored cross-site scripting (XSS): Fixed vulnerabilities that could allow malicious JavaScript to execute in other users' browsers.
- Cross-site request forgery (CSRF): Fixed insufficient request protections that could potentially allow unauthorized actions to be performed through an authenticated user's session.
- Improper access control and information disclosure: Fixed vulnerabilities that could expose restricted content, feedback information, and activity data to users without the necessary permissions.
- Improper authorization: Strengthened permission enforcement to prevent users from performing feedback-related actions they are not authorized to perform.
- Unsafe deserialization: Improved the handling of stored data to prevent unsafe object deserialization.
Additions and improvements
- Spam moderation: Feedback flagged for moderation now remains pending and hidden until approved. Added author notifications, an approval action in the Admin CP, automatic restoration of feedback totals upon approval, and spam checks when editing feedback.
- Import source host restrictions: Added a configurable allow-list for remote import sources. Unauthorized hosts are rejected, while permitted subdomains are supported.
- Administrator permissions: Added separate permissions for feedback rebuild and import tools, allowing administrators to control access independently.
- Deal links: Improved deal-thread links by generating them dynamically from stored thread references, keeping links valid after thread renames or URL changes.
- Suspicious activity notifications: Added configurable, rate-limited email notifications to alert staff about suspicious feedback activity.
- Deal-thread suggestions are now available only to logged-in members, with updated request and response handling.
- Restricted deal URLs to HTTP(S) links on the board's domain and its subdomains, including imported records.
- Improved username filtering to support comma- or semicolon-separated lists.
- Removed the obsolete "Data import mode" option. Import operations now automatically identify imported records.
- Strengthened validation of imported data to improve import safety and reliability.
- Updated internal database queries to use bound parameters.
- Improved diagnostic logging to prevent debug information from appearing in rendered pages.
- Restricted internal handlers to approved implementations.
- Updated PHP requirements: Installing or upgrading the add-on now requires PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+, depending on the PHP branch. These minimum versions include important upstream security fixes.
Bug fixes
- Fixed negative feedback being incorrectly counted as neutral in statistics.
- Fixed pagination in the "Feedback left" list.
- Fixed errors when viewing feedback belonging to members whose accounts no longer exist.
- Prevented missing or invalid ratings from being saved as neutral feedback.
- Restored resource and media results in deal-thread suggestions.
- Fixed username filtering in feedback lists and Latest Activity.
- Fixed valid deal URLs on board subdomains being rejected when the alternate URL option was enabled.
- Restored the copyright notice in the footer on XenForo 2.3.
- Fixed incorrect menu links in feedback-related pages.
- Fixed special characters being double-escaped when editing feedback reviews.
- Fixed errors on thread pages containing posts from guests or deleted members.
- Fixed the "comment required" option not being respected when editing feedback.
- Corrected the visibility of the "add comment" form based on member permissions.
- Fixed validation errors not being handled correctly on the preferences page.
- Fixed issues when merging member accounts in the Admin CP.
- Corrected feedback transfers when merging member accounts.
- Corrected IP address logging for feedback comments.
- Fixed user rating rebuilds not completing when mutual feedback was enabled.
- Fixed errors when editing feedback with unique deal URL enforcement enabled.
- Corrected resource deal URL normalization.
- Fixed recipient feedback totals not updating after feedback deletion.
- Improved error handling when editing comments that no longer exist.
- Fixed internal feedback redirects losing the intended feedback reference.
- Prevented activity-logging errors from disrupting page rendering.
- Fixed usernames containing apostrophes being incorrectly escaped in activity entries.
- Removed an obsolete image reference that caused unnecessary missing-file requests.
- Added six missing phrases.
- Improved the reliability of large administrative rebuild and import operations by limiting excessive processing delays.
- Corrected validation of the "items per page" setting to require a positive value.
- Fixed PHP 8.x notices and incorrect class references, including issues affecting the add-comment view.
- Corrected mutual feedback visibility and consistency during regular use and rating rebuilds.
- Corrected feedback comment attribution to ensure comments are associated with the appropriate author.
- Fixed suspicious activity notification emails not being sent correctly.
- Fixed the Find Thread selector unexpectedly collapsing the feedback form.
- Fixed feedback widgets appearing empty on some pages.
- Fixed JavaScript console errors when focusing form fields.
Upgrade notes
- PHP requirements: Ensure your server is running PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+, depending on the PHP branch, before installing or upgrading.
- Content Security Policy (CSP): If your board uses a Content Security Policy, add https://www.gstatic.com to the script-src directive to allow the required scripts to load.
- Remote imports: Configure the new "Allowed import source hosts" option before using remote import functionality.
- Administrator permissions: Review and assign the new rebuild and import permissions to the appropriate administrators.
- Obsolete build files: Manually remove stale Entity/build.json and Option/build.json files as part of the upgrade, if present.