XenForo 2.1.7 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo 2.1 upgrade to this release to benefit from increased stability.
Most importantly, this release fixes a security vulnerability in XenForo. Only XenForo 2.1.0 and above are affected.
The issue is a XSS vulnerability. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access.
The vulnerability affects content displayed in the "Approval queue" and requires specially crafted text to be entered into a relevant field for the content type (such as a thread title).
XenForo extends thanks to @rdn for reporting the issue.
We also give an honourable mention to @TickTackk who reported a "self XSS" issue to us related to the Froala rich-text editor that we use. While we do not consider this to be a security issue, we have fixed it and appreciate the time taken to report it.
While we recommend doing a full upgrade to resolve this issue, you can also patch the issue yourself with a simple template edit.
The template in question is approval_queue_macros.
To patch your existing installation, please follow these steps:
- Download the patched template which is in a file named 217patch.txt (attached to the bottom of this post).
- Log in to your Admin control panel, expand the Appearance navigation and click the "Templates" link.
- In the "Filter" field at the top of the list, type approval_queue_macros and open the template.
- Open the 217patch.txt file and copy the entire contents of this and paste it into the approval_queue_macros template, overwriting the existing content.
- Click "Save and exit".
- Repeat the steps above for all of your installed styles.
Note that if you upgrade to 2.1.7 or a newer version, you may undo/revert these template edits.
For instructions on how to resolve the issue by upgrading, and to see what else has changed in XenForo 2.1.7, please read on.
