XenForo Announcements

Today, we are releasing XenForo 2.1.13 to address a potential security vulnerability. We recommend that all customers still running XenForo 2.1 upgrade to 2.1.13 or use the attached patch file as soon as possible. The issue relates to HTML attribute injection which can be triggered when rendering editor content, such as when a post is edited or quoted. XenForo extends thanks to security researcher @PaulB, the team at @NamePros and @Xon for reporting the issues. We recommend doing a full upgrade to resolve the issues, but a patch can be applied manually. See below for further details. Applying a patch manually Download the 2113patch.zip file attached to this message. It will contain the following file...

XenForo 2.2.10 Released XenForo 2.2.10 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability. This version contains a fix for an issue whereby outgoing requests from the server running XenForo could be tricked into accessing web-accessible resources on the local network. The scope to exploit this issue is limited within the core and first-party add-ons. 2.2.10 will be one of the last releases of the 2.2.x series before we move 2.3.0 to beta, but we do have a handful of things coming late to 2.2.x before that happens, including some enhanced cookie consent features to comply with the...

XenForo 2.2.9 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability. In addition to the usual bug fixes and improvements, we've continued to improve compatibility with PHP 8.1 and added support for self-hosted licenses to more easily sign outgoing emails with DKIM as per this recent suggestion by @digitalpoint. One-click upgrade to XenForo 2.2.9 Directly from your admin control panel If you are a XenForo Cloud customer, your upgrade will be scheduled automatically. Some of the changes in XF 2.2.9 include: Fix fatal error when viewing debug page on PHP 8.1 Revert previous change so that...

XenForo Enhanced Search 2.2.2 Released XenForo Enhanced Search 2.2.2 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo Enhanced Search 2.2 upgrade to this release to benefit from increased stability. One-click upgrade to XenForo Enhanced Search 2.2.2 Directly from your admin control panel If you are a XenForo Cloud customer, you have already received this update. Some of the changes in XFES 2.2.2 include: PHP 8.1 compatibility. Avoid a shard error if a user searches for a query that exceeds the max_clause_count value. XenForo Enhanced Search requires XenForo 2.2 or later. Purchasing XenForo Enhanced Search can be purchased with a new license via...

XenForo Resource Manager 2.2.4 Released XenForo Resource Manager 2.2.4 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo Resource Manager 2.2 upgrade to this release to benefit from increased stability. One-click upgrade to XenForo Resource Manager 2.2.4 Directly from your admin control panel If you are a XenForo Cloud customer, your upgrade will be scheduled automatically. Some of the changes in XFRM 2.2.4 include: Allow resource creators to watch their own resources when resource teams are enabled Allow reassigning a resource to users who may not have permission to view it Fix placeholder values being incorrectly escaped The following public...

XenForo Media Gallery 2.2.4 Released XenForo Media Gallery 2.2.4 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo Media Gallery 2.2 upgrade to this release to benefit from increased stability. One-click upgrade to XenForo Media Gallery 2.2.4 Directly from your admin control panel If you are a XenForo Cloud customer, your upgrade will be scheduled automatically. Some of the changes in XFMG 2.2.4 include: Do not attempt watermarking if a valid source image can not be created Pass thumbnail width/height to the thumbnails to avoid layout shift. Efforts to more consistently render smilies and emojis in the XFMG latest comment widget. We also render more...

XenForo 2.2.8 Released XenForo 2.2.8 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability. XenForo 2.2.8 brings initial PHP 8.1 support to XenForo. We do not currently recommend upgrading to PHP 8.1 in production but would encourage, where possible, running XF 2.2.8 and PHP 8.1 together on your staging sites/servers if possible. One-click upgrade to XenForo 2.2.8 Directly from your admin control panel If you are a XenForo Cloud customer, your upgrade will be scheduled automatically. Some of the changes in XF 2.2.8 include: Do not wrap iconic inputs when directly adjacent to other inline...