Today, we are pleased to release XenForo 1.5.8. This release fixes a number of bugs and issues that were found since the release of 1.5.7. As this is a maintenance release, the vast majority of the focus was an increase in stability.
This release includes fixes for 2 security-related issues reported by Julien Ahrens (fromwww.innogames.com). We consider these issues to be very minor and are very unlikely to be exploitable, so they have been included as part of the 1.5.8 fixes rather than as a separate patch. The issues fixed were:
- An image injection vulnerability in SWFUpload. This could allow a user to believe they were loading an image from your domain while it was being loaded from an external domain which may lead to user confusion.
- A self-XSS related to uploading an invalid attachment file with a specially crafted filename. This can only be triggered by the user uploading the file, so it would require tricking a user to upload a file using your specified filename (using characters disallowed in filenames by Windows) to exploit. (An XSS may allow an attacker to steal data or cause a user to take actions without their consent or knowledge.)
Thanks again to Julien for reporting these issues to us.
Some of the other bugs fixed in 1.5.8 include:
- Ensure message length limits are enforced in conversations.
- Clean up like counts on profile post comments when the comment is deleted or the containing profile post is deleted.
- Log IPs when a session is created from a "stay logged in" cookie.
- Fix an issue where content pasted into the rich text editor could have spaces stripped out unexpectedly.
- When an add-on is updated, make sure JS files are recached as they may have changed.
- Allow reports for posts that were in a forum that has since been deleted to be viewable.
- Only allow form textareas to be vertically resizable by default.
- Attempt to force TLSv1 with connections to PayPal when it's unclear if TLS 1.2 is supported.
- Make the meaning of certain subscription-related IPN callbacks from PayPal clearer in the transaction log.
- Allow the PayPal IPN handler to be extended by add-ons.
- Fix an issue where inserting a spoiler into the rich text editor could lose the current selection.
- Fix an issue with spoiler tag buttons being submittable if JavaScript is not functioning properly.
- Remove an unexpected scrollbar from the second (and further) lightbox created on a page.
- Fix a case where accounts imported from IPB did not authenticate properly if their password contained certain special characters.
- Respect custom BB codes disabling BB code parsing within when setting up the rich text editor.
See the Resolved Bug Reports forum for further information.
The following templates have had changes:
- bb_code_tag_spoiler.html
- form.css
- member_view
- message
Where necessary, the merge system within the "Outdated Templates" page should be used to integrate these changes.
Please note that we are now formally recommending that you upgrade to PHP 5.4 or newer. Our intention with XenForo 2.0 is to require PHP 5.4 or newer. If you are running PHP 5.3 or 5.2, you will receive a warning when installing or upgrading XenForo.
All customers with active licenses may now download the new version from the customer area.
XenForo 1.5.8 Released Upgrade
XenForo 1.5.8 Released
