XenCentral Feedback System 2 2.5.4

Hello everyone!

This is an important release containing several security fixes and other improvements. All users are strongly encouraged to update to this version as soon as possible. Special thanks to @PlayerOne for helping identify these issues.

We've moved our customer portal to https://portal.xencentral.com/. To regain access to your licenses and downloads, please reset your password using your registered email address.

Release notes:

2.5.4 for XenForo 2.3​

• SQL injection: Fixed vulnerabilities that could potentially allow unauthorized access to or modification of database information.
• Stored cross-site scripting (XSS): Fixed vulnerabilities that could allow malicious JavaScript to execute in other users' browsers.
• Cross-site request forgery (CSRF): Fixed insufficient request protections that could potentially allow unauthorized actions to be performed through an authenticated user's session.
• Improper access control and information disclosure: Fixed vulnerabilities that could expose restricted content, feedback information, and activity data to users without the necessary permissions.
• Improper authorization: Strengthened permission enforcement to prevent users from performing feedback-related actions they are not authorized to perform.
• Unsafe deserialization: Improved the handling of stored data to prevent unsafe object deserialization.

All users are strongly encouraged to update to this version as soon as possible.

• Fixed negative feedback being incorrectly counted as neutral in statistics.
• Fixed pagination in the "Feedback left" list.
• Fixed errors when viewing feedback belonging to members whose accounts no longer exist.
• Prevented missing or invalid ratings from being saved as neutral feedback.
• Fixed suggestion title searches containing special characters.
• Restored resource and media results in deal-thread suggestions.
• Fixed username filtering in feedback lists and Latest Activity.
• Fixed member searches for usernames containing quotation marks.
• Fixed the Latest Activity username filter not applying immediately.
• Fixed valid deal URLs on board subdomains being rejected when the alternate URL option was enabled.
• Restored the copyright notice in the footer on XenForo 2.3.
• Fixed rating icons displaying incorrectly in some feedback lists.
• Fixed feedback widgets not appearing unless legacy sidebar options were enabled.
• Restored the Feedback System Admin CP menu for administrators with import or rebuild permissions.
• Fixed special characters being double-escaped when editing feedback reviews.
• Standardized the storage format of imported feedback reviews to match native reviews.
• Fixed errors on thread pages containing posts from guests or deleted members.
• Fixed the feedback button in threads not respecting the "restricted feedback" option.
• Fixed the "comment required" option not being respected when editing feedback.
• Corrected the visibility of the "add comment" form based on member permissions.
• Fixed validation errors not being handled correctly on the preferences page.
• Fixed issues when merging member accounts in the Admin CP.
• Ensured feedback statistics remain intact if member account deletion fails.
• Corrected IP address logging for feedback comments.
• Fixed user rating rebuilds not completing when mutual feedback was enabled.
• Fixed errors when editing feedback with unique deal URL enforcement enabled.
• Corrected resource deal URL normalization.
• Fixed recipient feedback totals not updating after feedback deletion.
• Improved error handling when editing comments that no longer exist.
• Corrected error handling when reporting feedback without the required permission.
• Fixed author data operations involving deleted members.
• Fixed internal feedback redirects losing the intended feedback reference.
• Prevented activity-logging errors from disrupting page rendering.
• Fixed incorrect links after submitting feedback, in per-member statistics, and in reported feedback activity.
• Fixed usernames containing apostrophes being incorrectly escaped in activity entries.
• Removed an obsolete image reference that caused unnecessary missing-file requests.
• Added six missing phrases.
• Improved the reliability of large administrative rebuild and import operations by limiting excessive processing delays.
• Corrected validation of the "items per page" setting to require a positive value.
• Fixed PHP 8.x notices and incorrect class references, including issues affecting the add-comment view.
• Prevented feedback from being submitted for nonexistent or ineligible members.
• Corrected spam-check handling to properly evaluate feedback submissions and enforce the resulting decisions.
• Fixed feedback editing unexpectedly modifying the recipient's comment.
• Corrected mutual feedback visibility and consistency during regular use and rating rebuilds.

• Updated PHP requirements: Installing or upgrading the add-on now requires PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+, depending on the PHP branch. These minimum versions include important upstream security fixes.
• Improved statistics performance by applying filters directly in database queries.
• Reduced unnecessary JavaScript loading by removing an unused charting package.
• Optimized deal-thread suggestion responses by eliminating duplicate title data.
• Deal-thread suggestions are now available only to logged-in members, with updated request and response handling.
• Restricted deal URLs to HTTP(S) links on the board's domain and its subdomains, including imported records.
• Improved the upgrade process by processing review clean-up operations in resumable batches.
• Removed the obsolete "Data import mode" option. Import operations now automatically identify imported records.
• Removed obsolete XenForo 1 compatibility files and unused templates.
• Updated internal database queries to use bound parameters.
• Strengthened validation of imported data to improve import safety and reliability.
• Separated import-specific validation from regular feedback submission validation.
• Improved diagnostic logging to prevent debug information from appearing in rendered pages.

2.4.3 for XenForo 2.2

• SQL injection: Fixed vulnerabilities that could potentially allow unauthorized access to or modification of database information.
• Stored cross-site scripting (XSS): Fixed vulnerabilities that could allow malicious JavaScript to execute in other users' browsers.
• Cross-site request forgery (CSRF): Fixed insufficient request protections that could potentially allow unauthorized actions to be performed through an authenticated user's session.
• Improper access control and information disclosure: Fixed vulnerabilities that could expose restricted content, feedback information, and activity data to users without the necessary permissions.
• Improper authorization: Strengthened permission enforcement to prevent users from performing feedback-related actions they are not authorized to perform.
• Unsafe deserialization: Improved the handling of stored data to prevent unsafe object deserialization.

All users are strongly encouraged to update to this version as soon as possible.

• Spam moderation: Feedback flagged for moderation now remains pending and hidden until approved. Added author notifications, an approval action in the Admin CP, automatic restoration of feedback totals upon approval, and spam checks when editing feedback.
• Import source host restrictions: Added a configurable allow-list for remote import sources. Unauthorized hosts are rejected, while permitted subdomains are supported.
• Administrator permissions: Added separate permissions for feedback rebuild and import tools, allowing administrators to control access independently.
• Deal links: Improved deal-thread links by generating them dynamically from stored thread references, keeping links valid after thread renames or URL changes.
• Suspicious activity notifications: Added configurable, rate-limited email notifications to alert staff about suspicious feedback activity.
• Deal-thread suggestions are now available only to logged-in members, with updated request and response handling.
• Restricted deal URLs to HTTP(S) links on the board's domain and its subdomains, including imported records.
• Improved username filtering to support comma- or semicolon-separated lists.
• Removed the obsolete "Data import mode" option. Import operations now automatically identify imported records.
• Strengthened validation of imported data to improve import safety and reliability.
• Updated internal database queries to use bound parameters.
• Improved diagnostic logging to prevent debug information from appearing in rendered pages.
• Restricted internal handlers to approved implementations.
• Updated PHP requirements: Installing or upgrading the add-on now requires PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+, depending on the PHP branch.

• Fixed negative feedback being incorrectly counted as neutral in statistics.
• Fixed pagination in the "Feedback left" list.
• Fixed errors when viewing feedback belonging to members whose accounts no longer exist.
• Prevented missing or invalid ratings from being saved as neutral feedback.
• Restored resource and media results in deal-thread suggestions.
• Fixed username filtering in feedback lists and Latest Activity.
• Fixed valid deal URLs on board subdomains being rejected when the alternate URL option was enabled.
• Restored the copyright notice in the footer on XenForo 2.3.
• Fixed incorrect menu links in feedback-related pages.
• Fixed special characters being double-escaped when editing feedback reviews.
• Fixed errors on thread pages containing posts from guests or deleted members.
• Fixed the "comment required" option not being respected when editing feedback.
• Corrected the visibility of the "add comment" form based on member permissions.
• Fixed validation errors not being handled correctly on the preferences page.
• Fixed issues when merging member accounts in the Admin CP.
• Corrected feedback transfers when merging member accounts.
• Corrected IP address logging for feedback comments.
• Fixed user rating rebuilds not completing when mutual feedback was enabled.
• Fixed errors when editing feedback with unique deal URL enforcement enabled.
• Corrected resource deal URL normalization.
• Fixed recipient feedback totals not updating after feedback deletion.
• Improved error handling when editing comments that no longer exist.
• Fixed internal feedback redirects losing the intended feedback reference.
• Prevented activity-logging errors from disrupting page rendering.
• Fixed usernames containing apostrophes being incorrectly escaped in activity entries.
• Removed an obsolete image reference that caused unnecessary missing-file requests.
• Added six missing phrases.
• Improved the reliability of large administrative rebuild and import operations by limiting excessive processing delays.
• Corrected validation of the "items per page" setting to require a positive value.
• Fixed PHP 8.x notices and incorrect class references, including issues affecting the add-comment view.
• Corrected mutual feedback visibility and consistency during regular use and rating rebuilds.
• Corrected feedback comment attribution to ensure comments are associated with the appropriate author.
• Fixed suspicious activity notification emails not being sent correctly.
• Fixed the Find Thread selector unexpectedly collapsing the feedback form.
• Fixed feedback widgets appearing empty on some pages.
• Fixed JavaScript console errors when focusing form fields.

• PHP requirements: Ensure your server is running PHP 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+, depending on the PHP branch, before installing or upgrading.
• Content Security Policy (CSP): If your board uses a Content Security Policy, add https://www.gstatic.com to the script-src directive to allow the required scripts to load.
• Remote imports: Configure the new "Allowed import source hosts" option before using remote import functionality.
• Administrator permissions: Review and assign the new rebuild and import permissions to the appropriate administrators.
• Obsolete build files: Manually remove stale Entity/build.json and Option/build.json files as part of the upgrade, if present.

Hello everyone!

XenCentral Feedback System 2.4.7.1 for XenForo 2.3 and 2.3.9.1 for XenForo 2.2 can now be downloaded.

Release notes:

• Smarter Deal-URL / thread suggestions — When suggesting deal threads, the lookup now correctly includes the deal thread, so valid threads are not missed.
• Cleaner, encoding-safe imports — Imported feedback content is now converted to safe UTF-8 and sanitized through XenForo's native cleanString/escapeString.
• Feedback stats — The feedback stats block in the postbit is now forced to be visible on narrow and mobile layouts (≤650px).
• Several other minor fixes.

The releases are available in Customer's Portal https://shop.xencentral.com/clientarea.php

Thank you!

Hello everyone!

XenCentral Feedback System 2.4.0.4 Release Candidate 1 for XenForo 2.3 can now be downloaded.

Release notes:
1) Limiting the latest feedback on the index page is fixed so that boards with too much feedback will not have performance issues.
2) View more button is added in the member profile Feedback tab and the Feedback profile.
3) MySQL minor fixes.

The release is available in Customer's Portal https://shop.xencentral.com/clientarea.php

Thank you!

Hello everyone!

XenCentral Feedback System 2.4.0.2 for XenForo 2.3 can now be downloaded. This is a beta version and is not designed for production use. Please test it and submit any issues you encounter via our ticketing system at https://shop.xencentral.com/submitticket.php

The release is available in Customer's Portal https://shop.xencentral.com/clientarea.php

Thank you!

Hello everyone!

The release overview:

1. Updating of is verified status is now done with MySQL instead of finders.
2. Exclude negative feedback from hiding in mutual feedback option implemented.
If this option is enabled and mutual feedback option is enabled too, the negative feedback will be shown, even if the feedback is not mutual and does not have corresponding feedback as an answer.
3. Thread suggestions query fix.
4. Small internal logic optimizations.
5. Code optimisations, repeating phrases calls are removed.

The release is available in Customer's Portal https://shop.xencentral.com/clientarea.php

Thank you!

Hello everyone!

The release overview:

1. CSS fixes for user profile feedback tab in mobile view.
2. We now hide threads in thread suggestion drop-down where both users do not participate, if check thread starter option is enabled.
3. Logical fixes when Unique deal url and Allow thread starter options are enabled.
4. iTrader importer fixes.
5. Cron is implemented to clean up the activities older than 1 day.
6. Feedback rebuild after User delete is in the jobs now, so it will not cause high server load.
7. Feedback information is not showing in postbit is fixed.

The release is available in Customer's Portal https://shop.xencentral.com/clientarea.php

Thank you!

Hello everyone!

The release overview:

1. Disable flash option is removed from stats page.

2. Null check is added to make sure options have appropriate 'group' offset.

3. Dump id on error option is added. This is useful if the admin rebuilds the feedback from the Rebuild caches page. If this option is enabled, it will show the error feedback id that can be used to fix the appropriate database row. Don’t forget to disable this option after the feedback stats are rebuilt.

4. vBulletin iTrader importer is fixed with valid comment id offset and the database tables prefix is optional now.

The release is available in Customer's Portal https://shop.xencentral.com/clientarea.php

Thank you!

Hello everyone!

The release includes a query optimization for Repository\Tools::getThreadSuggestions method.

The release is available on Customer's Portal https://shop.xencentral.com/clientarea.php

Thank you!

Hello everyone!

The release overview:

1. Allow alternate URL. An option is added to allow both www and non-www versions of Board URL to be accepted as Deal URL.

2. An error is fixed when mutual feedback is disabled, but conversations still have Private Content title and content.

The release is available in Customer's Portal https://shop.xencentral.com/clientarea.php

Thank you!

Hello everyone!

This is a bug-fix release.

An issue is fixed when the deal URL was not populated for the user that does not have any received feedback.

The release is available in Customer's Portal https://shop.xencentral.com/clientarea.php

Thank you!