Xenforo 核心升级包 无授权

Xenforo 核心升级包 无授权 2.3.10 Patch

没有下载权限
概览 更新 (35) 历史 讨论 (37)

Xenforo 核心升级包 无授权 2.3.10 Patch - change log

Some of the changes in XF 2.3.10 include:
Ensure "View Older Results" link appears on last page of search results
Ensure "No such recipient" bounce responses are classified as hard bounces
Ensure "Account Closed" bounce responses are classified as hard bounces
Ensure "Recipient not found" bounce responses are classified as hard bounces
Ensure "mailbox is disabled" bounce responses are classified as hard bounces
Ensure "not configured to receive" bounce responses are classified as hard bounces
Prevent inet_pton() ValueError when IP address contains null bytes
Use original Email object for error logging after DKIM signing to prevent undefined method error
Skip array values during custom field multiselect validation to prevent Array to string conversion warning
Normalize discouragement delay min/max values to prevent mt_rand() ValueError
Suppress dns_get_record() warning during DKIM verification to prevent job crash on DNS failure
Prevent alerts from being sent to banned users
Correct OAuth2 token revocation to properly invalidate both access and refresh tokens
Respect direction parameter for multi-column sort ordering in Finder
Re-enable passkey button when WebAuthn registration or authentication is aborted
Add missing bookmark_id index to xf_bookmark_label_use table
Prevent accumulating whitespace in GenerateFinders CLI command on repeated runs
Avoid exception-based flow control in getFinder for entity class resolution
Set explicit working directory for sub-processes to prevent failure when CWD is inaccessible
Prevent type error when custom field type changes with preserved values
Include purchasable ID in Stripe product and plan ID generation
does not round-trip after editing a post Implement ContainableInterface and DatableInterface on various child content entities Create template when generating a route with xf-make:route As always, new releases of XenForo are free to download for all customers with active licenses. You may now upgrade from your admin control panel or grab the new version from the customer area. Current requirements Please note that XenForo 2.3 has higher system requirements than earlier versions. The following are minimum requirements: PHP 7.2 or newer (PHP 8.3 recommended) MySQL 5.7 and newer (Also compatible with MariaDB/Percona etc.) All of the official add-ons require XenForo 2.3. Enhanced Search requires at least Elasticsearch 7.2.
  • 点赞
反应： stqf

Xenforo 核心升级包 无授权 2.2.19 Patch - change log

XenForo 2.2.19 has also been released. Please refer to the release notes above.

We recommend doing a full upgrade to resolve the issue, but a patch can be applied manually. See below for further details.
  • Download 2219-patch.zip
  • Extract the .zip file
  • Upload the contents of the upload directory to the root of your XenForo installation
Note: If you decide to patch the files instead of doing full upgrades, your "File health check" will report these files as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.

Xenforo 核心升级包 无授权 2.3.9 patch - change log

Some users may struggle to apply the patch on pre-2.3.8 installs. If you are patching 2.3.7 or earlier you may try this patch.

Xenforo 核心升级包 无授权 2.3.8 - change log

If you are a XenForo Cloud customer, your upgrade will be scheduled automatically.

Some of the changes in XF 2.3.8 include:

The following public templates have had changes:
  • _help_page_privacy_policy
  • account_reactions
  • account_visitor_menu
  • attachment_macros
  • bb_code_tag_attach
  • core.less
  • core_action_bar.less
  • embed_resolver_thread
  • helper_attach_upload
  • lightbox.less
  • login_password_confirm
  • member_about
  • member_macros
  • member_recent_content
  • member_tooltip.less
  • message.less
  • message_macros
  • news_feed_attached_images
  • passkeys_macros
  • report_view
  • setup.less
  • share_page_macros
  • tag_macros
  • tag_search
  • two_step_totp

Xenforo 核心升级包 无授权 2.3.7 Full Package - changelog

Some of the changes in XF 2.3.7 include:

Xenforo 核心升级包 无授权 2.3.7 Patch - changelog

XenForo 2.3.7 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.3 upgrade to this release to benefit from increased stability.

In addition to the usual fixes and improvements, XenForo 2.3.7 also includes a critical security fix to ensure the security of Passkeys that have been added to your account. We'd very much like to thank Jai Niresh J for reporting this issue via Eric and team at Hypixel Inc.. Between them they also reported a less severe issue related to local account page caching on shared systems.

This version also tightens up the kinds of methods that can be called from within templates, evolving from a loose "prefix" match to a stricter "first word" match of methods that can be called through callbacks and variable method calls. This fix is courtesy of Cyanide who we extend huge thanks to in taking the time to report this to us.

We'd also like to take this opportunity to notify all third party developers that writing database queries inside templates is not recommended. While this is still allowed in XenForo 2.3.7, the behaviour is now considered deprecated and will be prevented in XenForo 2.3.8. Code which currently triggers this will insert an error into the Server error log and must be fixed prior to the release of XenForo 2.3.8. Where possible, data must be queried and processed and passed into the template rather than being written inside the template itself.

Finally, we'd like to thank @TickTackk for reporting a path disclosure issue in exceptions thrown due to open_basedir restrictions.

If you are a XenForo Cloud customer, a fix has been rolled out automatically, and no further action is required to address this issue.

We recommend doing a full upgrade to resolve the issue, but a patch can be applied manually. See below for further details.

  • Download 237-patch.zip
  • Extract the .zip file
  • Upload the contents of the upload directory to the root of your XenForo installation
Note: If you decide to patch the files instead of doing full upgrades, your "File health check" will report these files as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.

As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area or upgrade from your Admin control panel (Tools > Check for upgrades...).

Xenforo 核心升级包 无授权 2.3.6 - changelog

Some of the changes in XF 2.3.6 include:

Xenforo 核心升级包 无授权 2.3.5 - changelog

XenForo 2.3.5 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.3 upgrade to this release to benefit from increased stability.

In addition to the usual bug fixes, XenForo 2.3.5 includes a critical security fix for any customers making use of OAuth2 where client applications may be able to request unauthorized scopes. This will affect any customer using OAuth2 clients on any version of XenForo 2.3 prior to 2.3.5.

Directly from your admin control panel

If you are a XenForo Cloud customer, your upgrade will be scheduled automatically.

Some of the changes in XF 2.3.5 include:


The following public templates have had changes:

  • code_editor.less
  • connected_account_associated_x
  • connected_account_macros
  • core_button.less
  • editor_insert_gif
  • helper_js_global
  • login
  • passkeys_macros
  • post_article_macros
  • share_page_macros
  • style_variation_macros
Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.

As always, new releases of XenForo are free to download for all customers with active licenses. You may now upgrade from your admin control panel or grab the new version from the customer area.


Please note that XenForo 2.3 has higher system requirements than earlier versions.

The following are minimum requirements:

  • PHP 7.2 or newer (PHP 8.3 recommended)
  • MySQL 5.7 and newer (Also compatible with MariaDB/Percona etc.)
  • All of the official add-ons require XenForo 2.3.
  • Enhanced Search requires at least Elasticsearch 7.2.

Xenforo 核心升级包 无授权 2.2.17 - changelog

Today, we are releasing XenForo 2.2.17 to address a potential security vulnerability. We recommend that all customers running XenForo 2.2 upgrade to 2.2.17 or use the patch instructions below as soon as possible.

Notes:
a. XenForo 2.3.1 and above is not affected by this issue. If you are still running XenForo 2.3.0 you should upgrade to the latest release or apply the patch below.
b. The few XenForo Cloud customers still running XenForo 2.2 have been patched automatically.

Xenforo 核心升级包 无授权 2.3.4 - changelog

XenForo 2.3.4 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.3 upgrade to this release to benefit from increased stability.

Some of the changes in XF 2.3.4 include:

  • Include embed.php in hashes.json
  • Fix error thrown when feed entry is missing an ID
  • Use AbstractCollection for type hint on addContentToBookmarks method
  • Fix deprecated usage of str_replace with API scopes
  • Improve PHP 8.4 compatibility
  • Output hsla in the color picker when an alpha channel is present
  • Ensure URLs are valid when analyzing image usage
  • Coerce nestable group to a number before peforming strict comparison
  • Gracefully handle guest username and style variation containing invalid UTF-8
  • Attempt to work-around abysmal Firefox form field retention heuristics
  • Gracefully handle when an avatar cannot be processed
  • Allow changing style variation when the previously selected style is forced to the default style
  • Increase date input width further to accomodate Firefox icon clipping
  • Fix editor autofocus behavior when in BBCode mode
  • Add a note about some permissions not being applicable to guests
  • Fix triggering Facebook embeds for document
  • Fix calculation of local load time from navigation timing API
  • Fix behavior of preview buttons
  • Consider read-only number-box inputs as disabled
  • Make required and recommended function checks more robust
  • Allow null unique ID when enqueuing a job later
  • Make report creation notifications easier to extend
  • Attempt to work around aggressive Firefox auto-complete heuristics when editing a user
  • Fix broken JS handlers when loading comments via AJAX
  • Fix an issue with editing newly translated phrases
  • Split ExifReader library out of attachment manager bundle
  • Attempt to work around aggressive Firefox auto-complete heuristics on control panel index
  • Fix number input buttons when step is set to any
  • Fix some icon usage analysis issues when editing and deleting editor drop-downs and BBCodes
  • Only record icon usage for active BBCodes and editor dropdowns
  • Omit itemid microdata attribute when there is no valid user
  • Ensure all control panel functionality is covered by permissions
  • Handle invalid multiquote input more gracefully
  • Attempt to avoid featured content carousel pager text overlap
  • Only try to remove double quotes from URL strings once
  • Set default color picker color to white instead of transparent
  • Fix some issues with the JS icon renderer and BBCode previews
  • Handle invalid session IDs more gracefully
  • Do not mark unhidden usernames as aria-hidden
  • Fix direction of back arrow on RTL languages
  • Improve text node handling in XF.setupHtmlInsert
  • Ignore Thumbs.db in style archive validator
  • Fix structured list icon end cell padding
  • Fix an issue with deferred resize event listener after autofocus
  • Skip any file duplicates when importing banned emails
  • Mark multiple consecutive asterisks as an invalid term word on MySQL full-text searches
  • Make the default table collation configurable
  • Fix calculation of report closure notifiable users
  • Ensure PayPal products are created with a unique ID.
The following public templates have had changes:

  • PAGE_CONTAINER
  • approval_queue_macros
  • carousel.less
  • core_input.less
  • fancybox.less
  • helper_attach_upload
  • lightbox.less
  • message_macros
  • profile_post_macros
  • structured_list.less
Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.
顶部