Unmaintained Steam Authentication & Integration 1.6.3

* Adjusted default case for no location set in Steam
* Updated to latest official Steam OpenID login buttons
* Fixed potential bug with banner not showing under the "Sign up now!" button

Thank you @kghector for the security report!

* Fixed XSS exploit with SteamProfile badge

An XSS exploit was found that could potentially inject unsafe scripts into forum pages. It is recommended that you upgrade to this release immediately.

Due to the nature of this exploit I'm providing a fix for the 1.6 branch (for XenForo 1.5+) as well as the 1.5 branch of Steam Authentication (for XenForo 1.3.x and 1.4.x).

The 1.5 branch file is attached to this post.

* Fixed criteria bug for steam association

This should fix issues with user group promotions that revert on their own based on steam authentication status and possibly some trophies as well.

*** NOTE: This update requires XenForo 1.5.0 Beta 1 or newer ***

* Fixed undefined index bug with jsonproxy.php
* Added support for two-step verification

I've also added a check that will prevent an install if you aren't running the correct XenForo version. This check, however, will not revert uploaded files. If you accidentally tried to update this addon before updating to XenForo 1.5, just upload the files from the last compatible version of Steam Auth (ex Steam Auth 1.5.2) and everything should go back to working order.

* Fixed Steam login bug with the hostname and OpenID
* Clarified alternate login button option

Went back to the original logic for getting the hostname as it's more reliable and should work fine for the open id realm.

* Fixed logic bug in jsonproxy.php

Found a bug that was lingering around for a little while, thought I included it in 1.5.0 but realized that was the one thing left out. It affects the Steam Profile badges if the game banners are disabled.

* Consolidated jsonproxy.php and removed jsonproxystats.php
* Cleaned up code and added documentation
* Fixed span tags (Thanks, Skiphs!)
* Added Steam ID 32-bit helper {xen:helper steamid3, $value}
* Added Steam CDN options for additional HTTPS support
* Added Steam as an External Account to User's Extra tab in ACP
* Added additional visitor panel button options
* Added an option to force the cron to update game image links
* Improve template conditionals (Thanks, jenky!)
* Update template modifications for login bar and login helper
to make sure they work with different styles (Thanks, jenky!)
* Fix Steam Profile bug with Quick reply (Thanks, jenky!)
* Moved Steam Integration options order in ACP (under Google)

== Upgrade Steps ==

== If your current version is < 1.5.0 ==
1. Delete root/js/steam directory (optional)
2. Upload the upload directory to your forum (overwrite any files)
3. Upgrade the addon using the provided "addon-Steam.xml" file

* Fixed bug "Fatal error: Call to undefined method" in user criteria

Thanks for reporting the bug Sam Forbis and Skiphs. I moved that function to a Model for pagination and missed that the criteria needed that function as well.

* Added HTTPS support through XenForo's Image Proxy
* Added an alternative option for login bar to match XenForo
* Added option to display login bar in the sidebar visitor panel
* Added login bar to the Xenforo login page
* Now hiding banned users' SteamProfiles and omitting them from statistics
* Paginated Steam games list in ACP (will eventually add search features)

Upcoming Features
--------------------------------
* Code cleanup
* Searchable game list in ACP (easier to find Appid's for your excludes/includes!)
* Options to display more than 25 top users/games/etc.
* Looking into the possibility of making a stats widget for 3rd party addons (no promises yet)

READ THIS FIRST

Due to the changes to External Accounts in XenForo 1.3, Updates from this version on will only support XenForo 1.3.0+. If you attempt to install Steam Auth 1.4.x on an older version of XenForo, it will break Steam Auth. You have been warned.
--------------------------------------------------

* Reintroduced template options back into addon configuration page
* Added option to disable grabbing avatar from steam upon user registration

If you were running Steam Authentication 1.4.0 or 1.4.1 be sure to go to the template modifications section and make sure all template modifications are checked on. The options to display SteamProfile are back in the addon settings like before and can be controlled there, but all templates need to be checked on for those options to work.