XF 2.3 Applying security patch instead of upgrading to 2.3.9

[nocte]

Regarding this thread:

Thread 'XenForo 2.3.9 (inc XFMG) & 2.2.18 Released (Security Fix)'

Thursday at 6:53 PM

XenForo 2.3.9 Released​

Today we are releasing XenForo 2.3.9 to address some potential security vulnerabilities that were recently reported to us. This version only includes security fixes and any bug fixes we previously said would make it to 2.3.9 have now been delayed until 2.3.10.

It is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.3 upgrade to this release to benefit from increased stability.

The issues identified are as follows:

• Prevention of a possible stored XSS (cross-site...

• XenForo
• Replies: 3
• Forum: Announcements

• 
• 

The patch also contains template changes (file src/addons/XF/_data/templates.xml).

1. Are these template changes strictly necessary?
2. Do I have to rebuild master data in order to apply the template changes?

These things are not explained in the announcement.

 

[Chris D]

This is true, it is not mentioned.

A master rebuild should be done.

 

[Alvin63]

I haven't seen the upgrade to 2.3.9 appear in ACP yet ............ is it on it's way?

 

[Chris D]

Assuming your license is not expired it should display. If not you might need to go to "Tools > Check for upgrades" in your admin control panel.

 

[Alvin63]

Yes that did it - thank you.

 

[Alvin63]

That was weird. I upgraded it and a button came up saying rebuild master data. So I did that and it said your upgrade to 2.3.8 (8 not 9) was successful. 2.3.9 is still showing as available to upgrade. I'll try again.

 

[Alvin63]

Worked the second time.

 

[nocte]

This is true, it is not mentioned.

A master rebuild should be done.

Thanks Chris!

Unfortunately there seem to be problems with applying the patch to XF 2.3.7:

Thread '2.3.9 patch does not work on 2.3.7'

Yesterday at 1:01 PM

This is what i get on rebuild master data after uploading the patch files from https://xenforo.com/community/threads/xenforo-2-3-9-inc-xfmg-2-2-18-released-security-fix.235659/ to a XF 2.3.7 installation.

user@web /home/forum/web $ php cmd.php xf:rebuild-master-data
PHP Fatal error:  Uncaught ErrorException: [E_WARNING] The use statement with non-compound name 'array_key_exists' has no effect in /home/forum/web/src/XF/Container.php:6
Stack trace:
#0 /home/forum/web/src/vendor/composer/ClassLoader.php(576): XF::handlePhpError(2, '...', '...', 6)
#1...

• nocte
• Replies: 13
• Forum: Other XenForo discussions and feedback