Xenforo 2.2.16 full nulled by tuoitreit.vn Patch 2

XenForo 2.2.2 Released​

Maintenance time! XenForo 2.2.2 has hatched, fledged and is ready to fly the nest directly to your community via one-click upgrade.

In addition to the changes listed below, 2.2.2 has some invisible changes to improve performance, stability and compatibility with the newly released PHP 8, which we look forward to supporting fully in future.

All licensed customers may download new XenForo releases, and in order to to benefit from increased stability offered by this new version, we strongly recommend that all sites running running earlier versions of XenForo 2.2 upgrade using the one-click system in their admin control panel.

XenForo 2.2.1 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability.

Most importantly, this release fixes two potential security vulnerabilities in XenForo.

The issues are XSS vulnerabilities. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access.

XenForo extends thanks to security researcher Vincent ibn Winnie for reporting the issues.

We recommend doing a full upgrade to resolve the issues, but a patch can be applied manually. See below for further details.

Applying a patch manually​

Download the 221patch.zip file attached to this message. It will contain the following file:

1. src/XF/BbCode/Renderer/Html.php

Extract the zip file to your computer and upload the contents to the root of your XenForo installation. This should overwrite the files on your server with the new version.

Note: If you decide to patch the files instead of doing a full upgrade, your "File health check" will report these three files as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.

For instructions on how to resolve the issue by upgrading, and to see what else has changed in XenForo 2.2.1, please read on.
The following public templates have had changes:

• alert_post_pre_reg
• app_nav.less
• attachment_macros
• content_vote_macros
• message.less

Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.

As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area or upgrade from your Admin control panel (Tools > Check for upgrades...).

Current Requirements​

Please note that XenForo 2.2 has higher system requirements than earlier versions.

The following are minimum requirements:

• PHP 7.0 or newer (PHP 7.4 recommended)
• MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
• All of the official add-ons require XenForo 2.2
• Enhanced Search requires at least Elasticsearch 2.0.

Today, after a refreshingly short beta and release candidate phase, we are excited to announce that XenForo 2.2.0 is now prepared, seasoned, baked and served, replacing XenForo 2.1.11 as our primary supported XenForo version.

This release adds a collection of great new features to XenForo, including the ability to repurpose forums as article repositories, a new way to encourage guest users to register, a progressive web app and a completely redesigned rich text editor. Check out the following list for some highlights:

• Forum and thread types system
• Updated rich text editor
• User profile banners
• Username change requests
• Search forums
• Forum SEO controls
• Writing before registering support
• Progressive web app
• Activity summary emails
• Style archive import and export
• REST API additions
• Profile post attachments

This is not an exhaustive list of what's new in 2.2, and you can read more about the above and other new changes/improvements features in the Have you seen...? forum.

We have also added preliminary support for the upcoming major release of PHP 8.0.

As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area or upgrade from your Admin control panel (Tools > Check for upgrades...).

Alongside the release of XenForo 2.2.0 Release Candidate 2, we are also releasing updated versions of each of our official add-ons:

• XenForo Media Gallery 2.2.0 Release Candidate 2
• XenForo Resource Manager 2.2.0 Release Candidate 2
• XenForo Enhanced Search 2.2.0 Release Candidate 2

This past Monday was a bank holiday in the UK, so as far as the working week goes, today is Tuesday, which means it's time for Beta 5. This release fixes a number of bugs found since the previous release.

We strongly recommend anyone testing 2.2 during this beta period upgrade as each beta version is released.

More specific details regarding bugs fixed in this release can be found in the resolved bugs forum.

Today, we continue the beta stage of XenForo 2.2 with Beta 4. This release fixes a number of bugs found since the previous release.

We strongly recommend anyone testing 2.2 during this beta period upgrade as each beta version is released.

More specific details regarding bugs fixed in this release can be found in the resolved bugs forum.

It's been a week since our last beta release, so today, in the interest of maximising the time customers get to test the software before it becomes our supported version, we're rolling up all the changes we've made since then and calling it XenForo 2.2.0 Beta 3. We have been concentrating mostly on the core code during this time, so this release includes changes solely to XenForo itself with the exception of a bug fixed in Enhanced Search.

We strongly recommend anyone testing 2.2 during this beta period upgrade as each beta version is released.

Specific details regarding bugs fixed in this release can be found in the resolved bugs forum.

This is beta software. It is not officially supported.
We do not recommend running it in production.

Please remember that this is beta software. It contains known bugs and incomplete functionality. We do not recommend running beta software in a production environment, and support is limited at this time to questions here on the community forums.

Add-ons and custom styles may be broken after upgrading to 2.2. You must test your add-ons thoroughly or look for updates. Be especially careful with add-ons that cover similar features to ones that are added to 2.2; these may conflict with the core XenForo data. If data conflicts are found, they will need to be resolved in a new add-on release or by removing the add-on before upgrading to 2.2.

If you choose to run beta software, it is your responsibility to ensure that you make a backup of your data. We recommend you do this before attempting an upgrade. If in doubt, always do a test upgrade on a copy of your production data.

Today, we are releasing XenForo 2.1.9 and XenForo 2.0.13 to address a potential security vulnerability that may affect any customer who makes use of our PayPal payment handler.

As well as user upgrades, this may affect add-ons you have installed which process payments using our PayPal payment handler.

We recommend that all affected customers running XenForo 2.1 or XenForo 2.0 upgrade to 2.1.9 or 2.0.13 or use one of the attached patch files as soon as possible.

Specifically, the issue relates to a specially crafted callback (or IPN) which is then processed successfully using PayPal's sandbox validation endpoint instead of their live system. If successful, a purchase could be completed without your PayPal account actually receiving any funds.

XenForo 2.1.8 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo 2.1 upgrade to this release to benefit from increased stability.

Some of the changes in XF 2.1.8 include:

• Attempt to merge reactions when merging posts
• Only hydrate autoIncrement relation fields if there is no value in the parent entity. If the field has a value in the parent, an exception is now thrown.
• Use \ZipArchive:
  
  VERWRITE flag when creating add-on zip to maintain compatibility with newer libzip versions
• Ensure more consistent sorting is used for class extensions, code event listeners and template modifications.
• Fix method checking when looking for API methods with versions appended.
• Use optimal batch sizing when rebuilding templates and phrases.
• Don't allow moderators to delete / edit warnings they have given if they have no permission to.
• Update GitHub OAuth implementation to use header authorisation.
• Handle rebuilding the active warning points in the User rebuild job.
• Supress warnings when closing file pointer after copying file
• Ensure a boolean value is returned when checking viewing permissions for conversations.
• When importing deletion log entries, ensure the username and reason do not exceed the allowed max lengths.
• Update register navigation item to ensure registration is enabled
• Add widget data attributes to expanded new thread widget
• Only fetch member stat results once on the overview page
• Allow connected account providers to provide additional auth params
• Only enqueue a reaction score rebuild when a reaction's score has changed, and simply rebuild scores for all reactions
• Correctly identify Android version in the attachment manager
• Upgrade jQuery to 3.4.1.
• Validate parent IDs correctly when inserting tree structured data.
• Prevent spam cleaner error when deleting a thread started by a spammer which has a redirect thread pointing to it.
• Add a content template for user reports to improve extensibility.
• Prioritize quick reply editor when multi-quoted quotes are inserted.
• Add a minimum width to user change log cells
• Add account email check to various places before sending mail
• Offset the select-to-quote tooltip whenever touchevents are supported.
• When rendering an unfurl do not double escape the proxied version of the URL.
• Force max length constraint when handling a user ban reason.
• Re-implement shortening of display text for very long URLs.
• Log moderator attachment deletions to the moderator log.
• Display error when trying to add template modification when not in development mode.
• Workaround an issue with multiple color pickers which could prevent some color pickers from behaving as expected.
• When previewing, ensure that sticky form submit rows stay stuck to the right place.
• When importing paid subscriptions from vBulletin ensure user group changes are correctly logged.
• Add a separate 'following' phrase for members others follow
• Check preg_last_error() when processing template modifications
• Improve news feed handler attachment handling
• Prevent an error related to cache clearing of entity relations with an empty condition.
• Reverse some changes related to template editing syntax highlighting which may actually break syntax highlighting entirely in some cases.
• Echo a list of allowed extensions back in the error message given when a file that does not have an allowed extension is uploaded.
• Include file and line number in exception XML response
• Throw an error exception when a ban fails to apply
• Handle failed bans in the warning point change service
• Ensure that emoji conversions are done as expected for all characters.
• Prevent a URL parsing error when following an HTTP request redirect to a path that starts with a "/" and contains a ":".
• Improve styling of responsive data lists, particularly with checkboxes that have headings
• Allow attachment data manipulation before copying files
• Implement search source method to determine if a query is empty
• Do URL canonicalization on the contact page and ensure that we link to misc/contact consistently (no trailing slash).

The following public templates have had changes:

• core.less
• core_button.less
• core_collapse.less
• core_datalist.less
• core_fa.less
• core_input.less
• core_list.less
• core_utilities.less
• font_awesome_setup
• member_about
• post_edit
• report_content_user
• setup.less
• setup_fa.less
• thread_edit
• thread_move
• widget_new_threads

Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.

As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area.

Note: add-ons, customizations and styles made for XenForo 1.x are not compatible with XenForo 2.x. If your site relies upon these for essential functionality, ensure that a XenForo 2 version exists before you start to upgrade. We strongly recommend you make a backup before attempting an upgrade.

Current Requirements

Please note that XenForo 2.1.x has higher system requirements than XenForo 1.x.

The following are minimum requirements:

• PHP 5.6 or newer (PHP 7.3 recommended)
• MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
• All of the official add-ons require XenForo 2.1.
• Enhanced Search requires at least Elasticsearch 2.0.

Note that when upgrading from XenForo 1.x, all add-ons will be disabled and style customizations will not be maintained. New versions of add-ons will need to be installed and customizations will need to be redone. We strongly recommended that you make a backup before attempting an upgrade. Once upgraded, you will not be able to downgrade without restoring from a backup.