Hello everyone!
This is an important release containing several security fixes and other improvements. All users are strongly encouraged to update to this version as soon as possible.
Support/updates renewal
Visit the Multisite System purchase page on Contra to renew your support and updates. Please use your registered email address when placing your order. Once your payment is successfully processed, you'll get immediate access to the latest add-on packages directly on Contra.
Release notes:
XenCentral Multisite System 2.5.0 RC1 introduces a substantial update to cross-domain authentication and session management, improves compatibility with modern browsers, and addresses numerous issues across multisite functionality.
This release also includes security hardening, improved administration, better domain routing, registration fixes, and performance and stability enhancements.
Administrators are encouraged to test the release in a staging environment and review their domain, authentication, and permission configurations before deploying it to production.
Main improvements
This is an important release containing several security fixes and other improvements. All users are strongly encouraged to update to this version as soon as possible.
Support/updates renewal
Visit the Multisite System purchase page on Contra to renew your support and updates. Please use your registered email address when placing your order. Once your payment is successfully processed, you'll get immediate access to the latest add-on packages directly on Contra.
Release notes:
XenCentral Multisite System 2.5.0 RC1 introduces a substantial update to cross-domain authentication and session management, improves compatibility with modern browsers, and addresses numerous issues across multisite functionality.
This release also includes security hardening, improved administration, better domain routing, registration fixes, and performance and stability enhancements.
Administrators are encouraged to test the release in a staging environment and review their domain, authentication, and permission configurations before deploying it to production.
Main improvements
- Redesigned cross-domain login and logout for improved reliability, compatibility, and security.
- Added cross-domain support for persistent login sessions ("Stay logged in").
- Introduced security enhancements following independent reviews.
- Improved compatibility with modern browsers and recent XenForo and PHP versions.
- Resolved issues affecting domain routing, registrations, administration, content filtering, sitemaps, statistics, notifications, and widgets.
- Improved overall stability, performance, and error handling.
Before upgrading
- Back up your database and files before upgrading. This release includes database structure updates.
- Verify PHP compatibility. PHP 8.2.35 or newer is required. For newer PHP branches, use PHP 8.3.36+, 8.4.27+, or 8.5.12+.
- Review domain management permissions and configuration.
- Review any custom domain matching expressions and content replacement rules.
- Cross-domain login requires domains with fixed board URLs. Placeholder-based URLs are not supported.
- Review your cookie notice to account for the additional functional cookie used for login session management.
- Existing login sessions will remain active, although some previously generated authentication links may no longer be valid.
Cross-domain login
- Redesigned cross-domain authentication to provide a more reliable login experience across participating domains.
- Improved compatibility with browsers that restrict third-party cookies, including Safari, Firefox, and Chrome.
- Strengthened authentication validation and session protection.
- Improved handling of existing user sessions across domains.
- Added support for two-step verification and connected-account authentication.
- Improved handling of configurations involving multiple domains.
- Improved compatibility with domain-specific authentication settings.
- Added safeguards for interrupted or incomplete authentication processes.
Cross-domain sessions and logout
- Added cross-domain support for the "Stay logged in" option.
- Improved persistent session handling across participating domains.
- Redesigned cross-domain logout for more consistent session termination.
- Improved account and session validation during logout.
- Improved compatibility with different account and authentication states.
- Added automatic session restoration where supported.
- Optimized session restoration to reduce unnecessary requests.
- Improved handling of authentication-related pages, background requests, and search engine traffic.
Performance and registration
- Reduced unnecessary background requests associated with cross-domain authentication.
- Improved page loading efficiency for multisite configurations.
- Corrected secondary user group assignment during registration.
- Fixed registration completion behavior affecting existing group memberships.
- Improved registration domain tracking for connected-account registrations.
- Restored standard XenForo registration behavior when Product On/Off is disabled.
Forum and thread routing
- Improved cross-domain routing for forum and thread pages, including replies, previews, and RSS feeds.
- Updated redirect behavior to better accommodate changes in domain configuration.
- Improved routing consistency for disabled domains and domains displaying all forums.
- Corrected redirects for XenForo installations using subdirectories.
- Improved compatibility with search engine indexing and domain-specific URLs.
Admin control panel
- Simplified domain management controls.
- Improved validation of domain matching and content replacement rules.
- Refined administrative permission requirements for domain management and content replacements.
- Improved handling of outdated or invalid configuration values.
- Improved compatibility with existing option overrides.
- Improved reliability when editing and saving domain settings.
Domain matching and configuration
- Improved domain matching accuracy and consistency.
- Enhanced handling of hostname variations and matching expressions.
- Improved compatibility with optional matching groups and custom domain configurations.
- Added additional validation for generated domain URLs.
- Improved handling of disabled domains in domain matching rules.
- Removed obsolete matching behavior.
Other improvements
- Improved domain-specific news feed filtering.
- Restored missing activity from older threads and profile posts.
- Corrected navigation tab and submenu visibility.
- Improved domain-specific staff access handling.
- Updated trending content widgets to respect domain-specific forum configurations.
- Improved sitemap scheduling and rebuild management.
- Enhanced compatibility with different domain and content visibility configurations.
Bug fixes
Pages, navigation, and content
- Fixed page errors involving default styles and languages.
- Improved compatibility with legacy content replacement configurations.
- Corrected canonical links and forum URL generation.
- Fixed navigation and content rendering inconsistencies.
- Improved domain-specific search results and caching.
- Corrected content replacement rendering in supported templates.
- Improved error handling for missing or incorrectly configured domains.
Administration and configuration
- Fixed domain editor issues involving Resource Manager and Media Gallery categories.
- Corrected option management behavior on XenForo 2.3.
- Improved option and configuration validation.
- Fixed issues affecting simultaneous domain configuration updates.
- Improved domain deletion cleanup and related cache management.
- Resolved compatibility issues involving custom and legacy configurations.
Notifications and widgets
- Fixed duplicate or missing push notifications.
- Restored compatibility with existing push subscriptions.
- Corrected statistics widgets on domains displaying all forums.
- Fixed members-online and statistics widget compatibility issues.
- Improved featured resource and media filtering.
- Improved domain-specific statistics performance and memory usage.
- Restored standard XenForo statistics behavior when the add-on is disabled.
Sitemaps and feeds
- Fixed sitemap generation, file counts, and delivery issues.
- Added support for custom sitemap file storage.
- Improved recovery from interrupted sitemap rebuilds.
- Restored compatibility with XenForo indexing preferences.
- Corrected RSS feeds on domains displaying all forums.
- Improved news feed filtering and database compatibility.
- Improved sitemap scheduling reliability.
General compatibility and stability
- Fixed PHP 8 compatibility warnings.
- Resolved database-related errors affecting various multisite features.
- Improved scheduled task execution across different hosting configurations.
- Restored standard XenForo permission and error messages where appropriate.
- Improved session and cookie handling.
- Removed obsolete components and unnecessary legacy behavior.
- Applied additional stability, validation, and compatibility improvements.
Security improvements
This release includes multiple security enhancements identified through internal testing and independent security reviews.- Strengthened cross-domain authentication and session management.
- Improved validation of login, logout, and account-related operations.
- Enhanced administrative access controls and permission checks.
- Improved protection for generated URLs and user-facing content.
- Strengthened configuration validation and error handling.
- Applied additional safeguards to registration and account management processes.
- Improved compatibility with current browser security requirements.
Cookie and session management
- Introduced a functional cookie to support persistent cross-domain authentication and session restoration.
- The cookie identifies the original login domain and is retained for up to 30 days.
- It is removed during logout.
- Cookie naming follows the configured XenForo cookie prefix.
- Administrators should update their cookie notices where applicable.
Administrator notes
- Cross-domain authentication continues to integrate with standard XenForo account activity logging.
- Authentication and session management have been updated. Custom integrations relying on previous authentication behavior should be reviewed.
- Cross-domain login settings and administrative descriptions have been updated.
- Domains with disabled authentication-related features are excluded from the corresponding cross-domain processes.
- Domain management and content replacement features require appropriate administrator permissions.
- Administrators should review custom domain rules and configuration overrides after upgrading.
- Review server and proxy logging policies to ensure sensitive authentication data is handled appropriately.
Known limitations
- Domain separation does not replace XenForo permissions. Use XenForo node permissions to restrict access to private content.
- Some shared content areas, including certain pages, categories, member pages, and third-party add-on listings, may not be restricted by domain.
- Domain-specific search filtering requires Site-specific search to be enabled.
- Placeholder-based board URLs are not supported for cross-domain authentication.
- Cross-domain authentication operates on configured board URL hostnames.
- Unavailable or incorrectly configured domains may interrupt cross-domain authentication.
- Some browser privacy settings and caching configurations may affect automatic session restoration.
- Certain cookie policies may limit cross-domain authentication behavior.
- Sitemap rebuilding may be initiated by page requests according to the configured rebuild interval.