กรุณาปิด โปรแกรมบล๊อกโฆษณา เพราะเราอยู่ได้ด้วยโฆษณาที่ท่านเห็น
Please close the adblock program. Because we can live with the ads you see


ข่าว XenForo 2.1.15, 2.2.16 Patch 1 and XenForo Media Gallery 2.1.9, 2.2.6 Released (Includes Security Fixes)

Security Fix

Today we are advising all customers running XenForo that a potential security vulnerability has been identified. All affected customers should either upgrade to XenForo 2.1.15 or XenForo 2.2.16.

If you are a XenForo Cloud customer, a fix has been rolled out automatically, and no further action is required to address this issue.

If you are running a pre-release version of XenForo 2.3, you should follow the instructions in the announcement thread for the XenForo 2.3.0 Release Candidate 1 release.

The issue relates to a potential cross-site request forgery and code injection vulnerability which could lead to a remote code execution (RCE) or cross-site scripting (XSS) exploit.

XenForo extends thanks to independent security researcher, Egidio Romano (EgiX), working with SSD Secure Disclosure.

We recommend doing a full upgrade to resolve the issue, but a patch can be applied manually to any version. See below for further details.

Applying a patch manually

To patch this issue manually you will need to edit one file manually and upload some changed files.

Step 1: Edit

src/XF.php



Find the following line in this file:

PHP:
$parts = explode(':', $string, 3);

Replace that line with the following:

PHP:
if (!$string) return '';

if (strpos($string, ':') === false)
{
$pattern = '#^\\\?'
. str_replace('%s', '([A-Za-z0-9_\\\]+)', preg_quote(ltrim($formatter, '\\')))
. '$#';
if (!preg_match($pattern, $string, $matches))
{
throw new \InvalidArgumentException(sprintf(
'Class %s does not match formatter pattern %s',
$string,
$formatter
));
}

// already a class
return $string;
}

$parts = explode(':', $string, 3);

Note: This file cannot be patched automatically as it contains install-specific data. You must apply this change manually to any XenForo installation running XenForo 2.1 or 2.2 to effectively fix the issue.

Step 2: Upload XF files

  • Download either
    2115-patch.zip
    (for XenForo 2.1) or
    2216-patch.zip
    (for XenForo 2.2).
  • Extract the .zip file
  • Upload the contentsof the
    upload
    directory to the root of your XenForo installation

Step 3: Upload XFMG files (for XenForo Media Gallery customers only)

  • Download either
    xfmg219-patch.zip
    (for XenForo Media Gallery 2.1) or
    xfmg226-patch.zip
    (for XenForo Media Gallery 2.2).
  • Extract the .zip file
  • Upload the contentsof the
    upload
    directory to the root of your XenForo installation


Note: If you decide to patch the files instead of doing full upgrades, your "File health check" will report these files as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.

As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area or upgrade from your Admin control panel (Tools > Check for upgrades...).
 

ไฟล์แนบ

XenForo 2.1.15 Patch 1 & 2.2.16 Patch 1 Released

About 30 seconds after we released 2.1.15 and 2.2.16 we were notified of a very old bug that was surfaced by the new changes.

Great Job Reaction GIF


The issue relates to editing node-like permissions.

As such, we have released Patch 1 for both versions to address this.

The patches above have been modified and include two additional files:
  • src/XF/Admin/Controller/Node.php
  • src/XF/Admin/Controller/Permission.php
You should re-apply the patch if you are unable to upgrade.
 



กรุณาปิด โปรแกรมบล๊อกโฆษณา เพราะเราอยู่ได้ด้วยโฆษณาที่ท่านเห็น
Please close the adblock program. Because we can live with the ads you see
กลับ
ด้านบน