XenForo 2.1.7 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo 2.1 upgrade to this release to benefit from increased stability.
Most importantly, this release fixes a security vulnerability in XenForo. Only XenForo 2.1.0 and above are affected.
The issue is a XSS vulnerability. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access.
The vulnerability affects content displayed in the "Approval queue" and requires specially crafted text to be entered into a relevant field for the content type (such as a thread title).
XenForo extends thanks to @rdn for reporting the issue.
We also give an honourable mention to @TickTackk who reported a "self XSS" issue to us related to the Froala rich-text editor that we use. While we do not consider this to be a security issue, we have fixed it and appreciate the time taken to report it.
While we recommend doing a full upgrade to resolve this issue, you can also patch the issue yourself with a simple template edit.
The template in question is
To patch your existing installation, please follow these steps:
For instructions on how to resolve the issue by upgrading, and to see what else has changed in XenForo 2.1.7, please read on.
Download XenForo 2.1.7
or
Upgrade directly from within your control panel
Some of the changes in XF 2.1.7 include:
The following public templates have had changes:
As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area.
Note: add-ons, customizations and styles made for XenForo 1.x are not compatible with XenForo 2.x. If your site relies upon these for essential functionality, ensure that a XenForo 2 version exists before you start to upgrade. We strongly recommend you make a backup before attempting an upgrade.
Current Requirements
Please note that XenForo 2.1.x has higher system requirements than XenForo 1.x.
The following are minimum requirements:
Full details of how to install and upgrade XenForo can be found in the XenForo 2 Manual.
If you are already running XF 2.1 or above we strongly recommend upgrading directly from within your control panel.
Note that when upgrading from XenForo 1.x, all add-ons will be disabled and style customizations will not be maintained. New versions of add-ons will need to be installed and customizations will need to be redone. We strongly recommended that you make a backup before attempting an upgrade. Once upgraded, you will not be able to downgrade without restoring from a backup.
Most importantly, this release fixes a security vulnerability in XenForo. Only XenForo 2.1.0 and above are affected.
The issue is a XSS vulnerability. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access.
The vulnerability affects content displayed in the "Approval queue" and requires specially crafted text to be entered into a relevant field for the content type (such as a thread title).
XenForo extends thanks to @rdn for reporting the issue.
We also give an honourable mention to @TickTackk who reported a "self XSS" issue to us related to the Froala rich-text editor that we use. While we do not consider this to be a security issue, we have fixed it and appreciate the time taken to report it.
While we recommend doing a full upgrade to resolve this issue, you can also patch the issue yourself with a simple template edit.
The template in question is
approval_queue_macros.To patch your existing installation, please follow these steps:
- Download the patched template which is in a file named
217patch.txt(attached to the bottom of this post). - Log in to your Admin control panel, expand the Appearance navigation and click the "Templates" link.
- In the "Filter" field at the top of the list, type
approval_queue_macrosand open the template. - Open the
217patch.txtfile and copy the entire contents of this and paste it into theapproval_queue_macrostemplate, overwriting the existing content. - Click "Save and exit".
- Repeat the steps above for all of your installed styles.
For instructions on how to resolve the issue by upgrading, and to see what else has changed in XenForo 2.1.7, please read on.
Download XenForo 2.1.7
or
Upgrade directly from within your control panel
Some of the changes in XF 2.1.7 include:
- Ensure that some jobs do not attempt to complete or otherwise change state inside a transaction.
- Ensure correct URL is used in the bookmark label filter when friendly URLs are not enabled.
- Display correct username styling when viewing users linked to an IP.
- In alerts and the news feed, ensure the "your post" link in the reaction item is clickable.
- Ensure Gravatar rebuild job respects the options sent to it.
- Prevent users from deleting their own accounts
- Check for guest posts in post reaction items
- Ensure login button when viewing a forum as a guest wraps properly.
- Only try to hide the global action indicator if it's actually present.
- Do not redirect back to the login page after a connected account request
- Properly check for tag container inside tagger
- Do not escape outbound email test subject phrase
- Correctly handle add-ons created with incorrect casing when the namespace already exists.
- Add additional wording to make it clear that the rejection reason will be shown to users awaiting approval.
- Remove hard-coded height from payment inputs
- Add missing phrase for 'could_not_find_subscriber_id_for_this_purchase_request'
- Display PHP's memory_limit within server environment report.
- Force choice builder to use temporary variable with set tags
- Remove Google+ URL from the Google connected account template.
- Allow disabling pointer events for nested tooltips
- Remove unused parameter when fetching reaction phrase
- Update promotion history interface for clarity
- Fix post copier attachment regex
The following public templates have had changes:
- alert_post_reaction
- approval_item_user
- connected_account_associated_google
- core_button.less
- core_tooltip.less
- forum_view
- payment_initiate.less
- reaction_item_post
- thread_edit
As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area.
Note: add-ons, customizations and styles made for XenForo 1.x are not compatible with XenForo 2.x. If your site relies upon these for essential functionality, ensure that a XenForo 2 version exists before you start to upgrade. We strongly recommend you make a backup before attempting an upgrade.
Current Requirements
Please note that XenForo 2.1.x has higher system requirements than XenForo 1.x.
The following are minimum requirements:
- PHP 5.6 or newer (PHP 7.3 recommended)
- MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
- All of the official add-ons require XenForo 2.1.
- Enhanced Search requires at least Elasticsearch 2.0.
Full details of how to install and upgrade XenForo can be found in the XenForo 2 Manual.
If you are already running XF 2.1 or above we strongly recommend upgrading directly from within your control panel.
Note that when upgrading from XenForo 1.x, all add-ons will be disabled and style customizations will not be maintained. New versions of add-ons will need to be installed and customizations will need to be redone. We strongly recommended that you make a backup before attempting an upgrade. Once upgraded, you will not be able to downgrade without restoring from a backup.
