XF 1.4 user group titles altered

[Degrinch]

I applied the security patch to my domain, and it appears my unregistered/unconfirmed group is now "GUEST" as well as having a few other user group names being modified.

I did not make these changes to group titles.
I am the only person with access to my ACP.

There are also a few other changes that have taken place to user group titles that I have not made. I use a password generator as well as additional characters applied to the password, coupled with server security settings and website login settings... well all things considered my password is next to impossible to crack.

What is the deal with this?

 

[Mike]

There's nothing that could do this from the security patch (especially if it's just the patch that you applied).

This mostly just makes me wonder if there was either a direct file modification in use that was overwritten, or something that was changed such that the cached values didn't match the real values (and were thus overwritten when the cache was rebuilt). I doubt anyone changed these values, though you can see if they did in the admin log section.

 

[Degrinch]

Ok. I have a question. What exactly did that update fix? What was the security risk that came from not updating?

 

[Paul B]

Presumably you are referring to this patch?

https://xenforo.com/community/threads/xenforo-1-4-12-released-security-fix.109641/

It resolved a potential XSS attack and involved a single helper file.

 

[Degrinch]

Thank you for your prompt response.
I am looking at my logs, and doing some other searching... It would appear there is more to this was not related to err in scripts/addon. Looking like it was very much intentional.