Goldnat AI Connect for XenForo - Admin 1.4.36

Security — three URL-fetching tools hardened

Three admin tools fetch files from a user-supplied URL:
uploadUserAvatar, uploadSiteLogo, uploadStyleAsset. Up to 1.4.35 all three used PHP file_get_contents() directly, with no built-in protection against internal network addresses, unsafe redirects,
oversized downloads, or slow-loris timeouts.

1.4.36 switches all three to XF's built-in
XF\Http\Reader::getUntrusted() — the same hardened fetcher XF uses internally for Gravatar fetch, image proxy, and oEmbed. It provides:

• Private/reserved IP rejection (127.0.0.0/8, 169.254/16, RFC1918).
• Private TLD rejection.
• Scheme/port whitelist (http/https on 80/443 only).
• Per-hop redirect validation.
• Configurable time (30s) and size limits (50 MB for user avatars, 5 MB for logos/style assets).

Using XF's hardened Reader rather than rolling our own means we inherit any future XF SSRF improvements automatically.

Eight versions, mostly security hardening on fields that agents can write to.
The headline feature is a new 4-tool bundle for analysing the AI Connect audit log itself.

If you already own this add-on, the upgrade is free.


Security — defense-in-depth on agent-writable config

v1.4.35 (Oct 26) — censorWords: extended silent-drop detection to partial drops.
If an agent submits 5 words and only 3 get stored (because XenForo rejected 2),
the tool now returns validation_failed with a count mismatch report instead of
silently reporting success.

v1.4.34 (Oct 25) — smtp_port: strict range validation (1-65535) at the tool
boundary before writing to options. censorWords: detection of total silent-drop.

v1.4.33 (Oct 25) — banner_css_class: strict W3C ident whitelist
(/^-?[a-zA-Z_][a-zA-Z0-9_-]*$/) in applyUsergroupParams. createUsergroup /
updateUsergroup now catch and surface invalid class attempts as validation_failed.

v1.4.32 (Oct 23) — Defense-in-depth sanitisation on 6 agent-writable config fields:
• setEmailTransportConfig — SMTP host, user, from addresses
• setOption — generic option writer
• editPhrase — phrase content
• createUsergroup / updateUsergroup — all usergroup fields
• createWidget / updateWidget — widget title
• setStyleProperty — style property values

v1.4.29 (Sep 24) — SECURITY: testEmailConfig stopped leaking the SMTP password.
The tool used to return XF:ptions()->emailTransport verbatim — the full config
array including smtpLoginPassword in plain text — which was inconsistent with
getEmailTransportConfig that already masked it. Now returns only the transport
name (string); error path logs the exception server-side and returns a generic
secret-free message.


New feature — Audit Log Analytics (4 tools)

v1.4.30 (Sep 24) — A new AdminAnalyticsTrait bundle so an agent can analyse the
AI Connect audit log for admins:

analyzeAuditActivity — totals, failure rate, read/write split, top tools, top users, daily volume
getAuditFailures — recent failed tool calls with error details
getUserAuditActivity — one user's audit profile
detectAuditAnomalies — users/tools with high failure rate + volume spikes

All 4 tools are read-only, aggregate queries over the Core audit table, gated
on the admin option permission.


🏗 Reliability

v1.4.31 (Oct 4) — 3 client-reported bugs fixed + R2 / abstract-filesystem
compliance for attachment-related ACP operations.

v1.4.28 (Sep 22) — PSR12 code-style compliance (0 phpcs warnings).


Launch bundle — $99 until 31 October 2026

For a limited time, Pro + Admin + Moderation ship as the XenForo Complete Pack
at $99 one-time (vs $177 if purchased separately). After Oct 31 the pack
reverts to $129.

Admin on its own: $59 — currently $39 as a launch price, until Oct 31.
A purchase includes one year of update eligibility from the date of purchase.


Existing customers

If you already own Admin, this upgrade is free. Your existing licence covers
v1.4.35 directly.


Requirements

• XenForo 2.2+
• PHP 7.2+
• AI Connect 1.2.41 or later — this add-on extends it and will not install standalone

Download: via your account at https://goldnat.ai/account/licenses