Важно, в данном обновлении была устранена уязвимость, проблема связана с потенциальной подделкой межсайтовых запросов и инъекцией кода, что может привести к удаленному выполнению кода (RCE) или межсайтового скриптинга (XSS) (так как более ранние версии здесь не публиковались, мануал с патчами не имеет смысла и не публикуется).
Подробнее на английском.
The issue relates to a potential cross-site request forgery and code injection vulnerability which could lead to a remote code execution (RCE) or cross-site scripting (XSS) exploit.
XenForo extends thanks to independent security researcher, Egidio Romano (EgiX), working with SSD Secure Disclosure.
XenForo extends thanks to independent security researcher, Egidio Romano (EgiX), working with SSD Secure Disclosure.
Так же было исправлено ряд серьёзных ошибок, более подробно на английском под спойлером.
Fix some issues with xf-dev:class-use-function to better support classes with class attributes and comments, or existing use function declarations.
Fix persistent action indicator when using back/forward navigation
Add _deleteFromSource method to support performing tasks right before entity deletion
Skip logging IPs when updating avatars during registration
Fix docblock return hint for \XF\Util\Ip::checkIpsAgainstBinaryRangeList
Add missing security locked phrase
Expose additional parameters to the reported_thread_title phrase
Ensure sticky threads are passed to the fetchExtraContentForThreadsFullView method
Adjust the phrasing of mail encryption options
Update purchase requests on user merge
Set aria-label for tooltips with no children
Skip processing email bounces and unsubscribes when email has been disabled in config.php
Gracefully handle errors when editing bookmarks
Clean up temp files after job completion
Add proper ordering to the shared IPs tab
Add an index hint to the newest members widget
Avoid generating invalid SQL with XF\Db\Schema\Column::values()
Prevent disabled accounts from using the admin control panel
Include a plain confirmation URL in the email sent to users awaiting email confirmation
Fix persistent action indicator when using back/forward navigation
Add _deleteFromSource method to support performing tasks right before entity deletion
Skip logging IPs when updating avatars during registration
Fix docblock return hint for \XF\Util\Ip::checkIpsAgainstBinaryRangeList
Add missing security locked phrase
Expose additional parameters to the reported_thread_title phrase
Ensure sticky threads are passed to the fetchExtraContentForThreadsFullView method
Adjust the phrasing of mail encryption options
Update purchase requests on user merge
Set aria-label for tooltips with no children
Skip processing email bounces and unsubscribes when email has been disabled in config.php
Gracefully handle errors when editing bookmarks
Clean up temp files after job completion
Add proper ordering to the shared IPs tab
Add an index hint to the newest members widget
Avoid generating invalid SQL with XF\Db\Schema\Column::values()
Prevent disabled accounts from using the admin control panel
Include a plain confirmation URL in the email sent to users awaiting email confirmation
Текущие системные требования
Минимальные системные требования:
Минимальные системные требования:
