Forum Updates

Forum software is updated to WoltLab Suite 6.2.4

Notable Changes

WoltLab Suite Core: Conversations

• Sort available group participants alphabetically by using UserGroup::getSortedGroupsByType() instead of unsorted UserGroupCacheBuilder output. 6.2

WoltLab Suite Core

• Fixed broken inner error in WYSIWYG form field. 6.1 6.2
• Added 5 new bots. 6.1 6.2
• Added a fallback value if the selected colorScheme is null. 6.1 6.2
• Fixed unescaped username in the daily notification email. 6.1 6.2
• Fixed that fixing mime types did not notify of file changes. 6.2
• Fixed the today/yesterday calculation not using the account time zone. 6.2
• Improved the error message for unknown DBO actions. 6.2
• Added the “Manually Add Subscription” interaction to paid subscriptions. 6.2
• Updated to CKEditor v48.1.1. 6.2
• Fixed the documented type of some columns. 6.2
• Fixed the display of the user's avatar in UserEditForm. 6.2
• Fixed wrong permission name in the Article::canRead fallback. 6.2
• Fixed an exception when deleting likes without assigned objects. 6.2
• Added fancybox gallery grouping to inline images. 6.2
• Removed the obsolete CSS class jsResizeImage. 6.2
• Fixed the headContent variable being overwritten. 6.2
• Fixed multi-select option values being dropped in the contact form. 6.2
• Skipped the permission check when generating the simple page sitemap. 6.2
• Skipped invalid files used as a cover photo. 6.2
• Fixed various issues and inconsistencies in language files. 6.2
• Fixed incorrect order of article categories in the breadcrumbs. 6.2
• Fixed the WYSIWYG tab menu not working correctly with prefixed form documents. 6.2
• Fixed the missing spacing between multiple badges. 6.2
• Fixed the support for quotes inside spoilers. 6.2
• Fixed the permissions being used to manage group assignments. 6.2

Forum software is updated to WoltLab Suite 6.2.5

Notable Changes

WoltLab Suite Forum

• Escaped user input in LIKE queries via escapeLikeValue(). 6.2
• Migrated user group board permission button to interaction API. 6.2
• Fixed several issues in BoardPermissionUserForm: ACL query passed sequential array indices instead of option IDs, parent group value overrode current board's own value, and deny fallback did not propagate the correct defaultValue to children. 6.2

WoltLab Suite Core

• SECURITY Disabled AJAX access to create and update actions in UserAction. 5.5 6.0 6.1 6.2
• SECURITY Restricted PayPal IPN sandbox endpoint to debug mode. 6.0 6.1 6.2
• SECURITY Verified permissions before generating thumbnails. 6.1 6.2
• SECURITY Required confirmed email addresses when signing up with GitHub and Google. 6.2
• Escaped user input in LIKE queries via escapeLikeValue(). 6.2
• Changed navigation link rel attribute in related articles from prev to next. 6.2
• Disabled licensed products list while upgrade is active. 6.2
• Prevented infinite loop caused by invalid resize operations. 6.2
• Handled taggable processors lacking ICombinedTaggable. 6.2
• Fixed the processing of EXIF data in WebP images in certain PHP configurations. 6.2
• Reduced autosave waitingTime in the editor from 15 to 1 second. 6.2
• Used dropdown border variable for date picker in dark mode. 6.2
• Deferred the download of smiley images. 6.2
• Prevented nested links in attachment grid username column. 6.2
• Skipped fancybox attributes on images already wrapped in a link. 6.2
• Removed CSS hack for breaking up mentions. 6.2

Forum software is updated to WoltLab Suite 6.2.6

Security Notice

(CVE-pending) Authenticated Remote Code Execution

We have been notified by kat regarding a security vulnerability that allows authenticated users to inject PHP code into certain cache files. All releases of WoltLab Suite 6.1 and 6.2 prior to this update are impacted.

Using the CVSS V3.1 scoring system (https://nvd.nist.gov/vuln-metrics/cvss), this issue is rated HIGH. AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 (High)

Notable Changes

WoltLab Suite Forum

• Threads without a first post are no longer included in the RSS feed. 6.1 6.2
• Users can no longer reply to their own disabled threads that are still awaiting approval. 6.2
• Board pages now provide the missing og:description meta tag. 6.2
• Activity point events are now updated correctly when posts are moved between threads. 6.2

WoltLab Suite Core: Conversations

• Conversation add and draft edit forms now support autosave. 6.2

WoltLab Suite Core

• SECURITY Changed the cache file format to use unique boundaries to prevent remote code execution. 6.1 6.2
• Updated to CKEditor v48.3.1. 6.2
• Updated Font Awesome to v7.3.1. 6.2
• List view settings are now preserved across AJAX requests. 6.2
• List and grid views now generate unique IDs to avoid collisions when rendered multiple times. 6.2
• Filtered grid and list views now also catch a TypeError during instantiation. 6.2
• Fixed the wrong sub-select references in MenuGridView. 6.2
• Fixed the unclosed anchor tag in TagGridView. 6.2
• Fixed the invalid HTML in UserRankGridView. 6.2
• Articles without any content are now skipped in the RSS feed. 6.2
• Fixed the article category sort field options and migrated the legacy publicationDate value. 6.2
• Fixed the documentation of article->time. 6.2
• Limited the length of generated WebP filenames. 6.2
• Unfurled image previews now use the thumbnail dimensions. 6.2
• Label selections are now validated for required fields. 6.2
• The list of API endpoints is now reset when an option is changed. 6.2
• The cache of API endpoints is now reset after installing a package installation plugin. 6.2
• Developer Tools: The bootstrap file is now rebuilt if a new one was added. 6.2
• Editing a system phrase now only resets its custom value. 6.2
• The default controller is now suppressed unless it is required by the build schema. 6.2
• Tightened the supported PHP versions reported by the system check. 6.2
• Invalid style variables are now filtered out before compiling a stylesheet. 6.2
• Silenced the deprecation warning for mixed declarations in the style compiler. 6.2
• Dropped the start_url from manifest.json and regenerated the manifest of all styles. 6.2
• Fixed the inconsistent scaling of the cropper dialog. 6.2
• Improved the marker rendering performance in the GoogleMaps MarkerLoader. 6.2
• reCAPTCHA now also matches submit buttons in addition to submit inputs. 6.2
• Fixed the reversed argument order in the captcha answer regex detection. 6.2
• The output of WysiwygFormatter is now wrapped in an htmlContent container. 6.2
• WysiwygFormContainer now forwards autosaveId and lastEditTime to the WysiwygFormField. 6.2
• Fixed the data-name mismatch in the shared_tabTabMenuFormContainer template. 6.2
• Fixed the mismatched closing tag of the copy button in the RSS feed dialog. 6.2
• Added a missing phrase to the wysiwyg attachment form field. 6.2
• Allowed array_first, array_last and array_reverse as template modifiers. 6.2
• Fixed the text and link colors in the message user consent box. 6.2
• The entry navigation is now stacked vertically on medium viewports. 6.2
• Disabled the GUI editing of ACP menu items in the devtools. 6.2
• A language variable is now injected into the NamedUserException on the license page. 6.2