Forum Updates

Forum software is updated to WoltLab Suite 6.2.4

Notable Changes

WoltLab Suite Core: Conversations

• Sort available group participants alphabetically by using UserGroup::getSortedGroupsByType() instead of unsorted UserGroupCacheBuilder output. 6.2

WoltLab Suite Core

• Fixed broken inner error in WYSIWYG form field. 6.1 6.2
• Added 5 new bots. 6.1 6.2
• Added a fallback value if the selected colorScheme is null. 6.1 6.2
• Fixed unescaped username in the daily notification email. 6.1 6.2
• Fixed that fixing mime types did not notify of file changes. 6.2
• Fixed the today/yesterday calculation not using the account time zone. 6.2
• Improved the error message for unknown DBO actions. 6.2
• Added the “Manually Add Subscription” interaction to paid subscriptions. 6.2
• Updated to CKEditor v48.1.1. 6.2
• Fixed the documented type of some columns. 6.2
• Fixed the display of the user's avatar in UserEditForm. 6.2
• Fixed wrong permission name in the Article::canRead fallback. 6.2
• Fixed an exception when deleting likes without assigned objects. 6.2
• Added fancybox gallery grouping to inline images. 6.2
• Removed the obsolete CSS class jsResizeImage. 6.2
• Fixed the headContent variable being overwritten. 6.2
• Fixed multi-select option values being dropped in the contact form. 6.2
• Skipped the permission check when generating the simple page sitemap. 6.2
• Skipped invalid files used as a cover photo. 6.2
• Fixed various issues and inconsistencies in language files. 6.2
• Fixed incorrect order of article categories in the breadcrumbs. 6.2
• Fixed the WYSIWYG tab menu not working correctly with prefixed form documents. 6.2
• Fixed the missing spacing between multiple badges. 6.2
• Fixed the support for quotes inside spoilers. 6.2
• Fixed the permissions being used to manage group assignments. 6.2

Forum software is updated to WoltLab Suite 6.2.5

Notable Changes

WoltLab Suite Forum

• Escaped user input in LIKE queries via escapeLikeValue(). 6.2
• Migrated user group board permission button to interaction API. 6.2
• Fixed several issues in BoardPermissionUserForm: ACL query passed sequential array indices instead of option IDs, parent group value overrode current board's own value, and deny fallback did not propagate the correct defaultValue to children. 6.2

WoltLab Suite Core

• SECURITY Disabled AJAX access to create and update actions in UserAction. 5.5 6.0 6.1 6.2
• SECURITY Restricted PayPal IPN sandbox endpoint to debug mode. 6.0 6.1 6.2
• SECURITY Verified permissions before generating thumbnails. 6.1 6.2
• SECURITY Required confirmed email addresses when signing up with GitHub and Google. 6.2
• Escaped user input in LIKE queries via escapeLikeValue(). 6.2
• Changed navigation link rel attribute in related articles from prev to next. 6.2
• Disabled licensed products list while upgrade is active. 6.2
• Prevented infinite loop caused by invalid resize operations. 6.2
• Handled taggable processors lacking ICombinedTaggable. 6.2
• Fixed the processing of EXIF data in WebP images in certain PHP configurations. 6.2
• Reduced autosave waitingTime in the editor from 15 to 1 second. 6.2
• Used dropdown border variable for date picker in dark mode. 6.2
• Deferred the download of smiley images. 6.2
• Prevented nested links in attachment grid username column. 6.2
• Skipped fancybox attributes on images already wrapped in a link. 6.2
• Removed CSS hack for breaking up mentions. 6.2

Forum software is updated to WoltLab Suite 6.2.6

Security Notice

(CVE-pending) Authenticated Remote Code Execution

We have been notified by kat regarding a security vulnerability that allows authenticated users to inject PHP code into certain cache files. All releases of WoltLab Suite 6.1 and 6.2 prior to this update are impacted.

Using the CVSS V3.1 scoring system (https://nvd.nist.gov/vuln-metrics/cvss), this issue is rated HIGH. AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 (High)

Notable Changes

WoltLab Suite Forum

• Threads without a first post are no longer included in the RSS feed. 6.1 6.2
• Users can no longer reply to their own disabled threads that are still awaiting approval. 6.2
• Board pages now provide the missing og:description meta tag. 6.2
• Activity point events are now updated correctly when posts are moved between threads. 6.2

WoltLab Suite Core: Conversations

• Conversation add and draft edit forms now support autosave. 6.2

WoltLab Suite Core

• SECURITY Changed the cache file format to use unique boundaries to prevent remote code execution. 6.1 6.2
• Updated to CKEditor v48.3.1. 6.2
• Updated Font Awesome to v7.3.1. 6.2
• List view settings are now preserved across AJAX requests. 6.2
• List and grid views now generate unique IDs to avoid collisions when rendered multiple times. 6.2
• Filtered grid and list views now also catch a TypeError during instantiation. 6.2
• Fixed the wrong sub-select references in MenuGridView. 6.2
• Fixed the unclosed anchor tag in TagGridView. 6.2
• Fixed the invalid HTML in UserRankGridView. 6.2
• Articles without any content are now skipped in the RSS feed. 6.2
• Fixed the article category sort field options and migrated the legacy publicationDate value. 6.2
• Fixed the documentation of article->time. 6.2
• Limited the length of generated WebP filenames. 6.2
• Unfurled image previews now use the thumbnail dimensions. 6.2
• Label selections are now validated for required fields. 6.2
• The list of API endpoints is now reset when an option is changed. 6.2
• The cache of API endpoints is now reset after installing a package installation plugin. 6.2
• Developer Tools: The bootstrap file is now rebuilt if a new one was added. 6.2
• Editing a system phrase now only resets its custom value. 6.2
• The default controller is now suppressed unless it is required by the build schema. 6.2
• Tightened the supported PHP versions reported by the system check. 6.2
• Invalid style variables are now filtered out before compiling a stylesheet. 6.2
• Silenced the deprecation warning for mixed declarations in the style compiler. 6.2
• Dropped the start_url from manifest.json and regenerated the manifest of all styles. 6.2
• Fixed the inconsistent scaling of the cropper dialog. 6.2
• Improved the marker rendering performance in the GoogleMaps MarkerLoader. 6.2
• reCAPTCHA now also matches submit buttons in addition to submit inputs. 6.2
• Fixed the reversed argument order in the captcha answer regex detection. 6.2
• The output of WysiwygFormatter is now wrapped in an htmlContent container. 6.2
• WysiwygFormContainer now forwards autosaveId and lastEditTime to the WysiwygFormField. 6.2
• Fixed the data-name mismatch in the shared_tabTabMenuFormContainer template. 6.2
• Fixed the mismatched closing tag of the copy button in the RSS feed dialog. 6.2
• Added a missing phrase to the wysiwyg attachment form field. 6.2
• Allowed array_first, array_last and array_reverse as template modifiers. 6.2
• Fixed the text and link colors in the message user consent box. 6.2
• The entry navigation is now stacked vertically on medium viewports. 6.2
• Disabled the GUI editing of ACP menu items in the devtools. 6.2
• A language variable is now injected into the NamedUserException on the license page. 6.2

Forum software is updated to WoltLab Suite 6.2.7

Notable Changes

WoltLab Suite Forum

• SECURITY The visibility of threads and posts is now consistently enforced before merging, copying or splitting posts, when marking or unmarking a best answer, when casting a poll vote, when warning a user for a post, when determining a thread's first post and in the thread's JSON-LD and meta data. 6.0 6.1 6.2
• SECURITY Splitting or copying posts now requires the destination thread to be visible and the user to hold moderator permissions in the destination board. 6.0 6.1 6.2
• SECURITY The thread visibility is now enforced before redirecting moved threads and before exposing the thread log. 6.0 6.1 6.2
• SECURITY The user thread list and the user post list now enforce the thread and post visibility per board. 6.0 6.1 6.2
• SECURITY Deleted and disabled threads are no longer disclosed in the watched and ignored thread lists. 6.0 6.1 6.2
• SECURITY Deleted or disabled posts are no longer disclosed through the thread popover. 6.0 6.1 6.2
• SECURITY Moderated posts are no longer disclosed to users lacking the permissions for the board. 6.0 6.1 6.2
• SECURITY The excerpts of the thread list box no longer disclose the content of posts that are not visible to the user. 6.0 6.1 6.2
• SECURITY Private boards are excluded from the aggregated board counters and the last posts of private boards are no longer exposed to guests through the internal data. 6.0 6.1 6.2
• SECURITY The board tag cloud excludes deleted, disabled and moved threads because the cache is shared by all users. 6.0 6.1 6.2
• SECURITY Subscribing to a board now requires the canReadThread permission and subscriptions to private boards no longer leak notifications. 6.0 6.1 6.2
• SECURITY Board ACLs can no longer overrule a moderator permission set to "Never". 6.0 6.1 6.2
• SECURITY The per-board canReadPrivateThread ACL is honored for third-party permission checks. 6.0 6.1 6.2
• SECURITY Cached board permissions are invalidated after changes to the ACLs or the board tree. 6.0 6.1 6.2
• SECURITY The board filter is propagated into the recursive generation of the board node tree. 6.0 6.1 6.2
• SECURITY The board filter is applied when loading embedded threads. 6.1 6.2
• SECURITY Attachment upload permissions are enforced for the target board of a new thread. 6.0 6.1 6.2
• SECURITY Internal parameters are discarded from client-supplied payloads of post actions, thread moderation actions and the quick reply. 6.0 6.1 6.2
• SECURITY Thread editor updates are restricted to an allow-list of columns. 6.0 6.1 6.2
• SECURITY The scheduled publication of posts and threads requires moderator permissions. 6.0 6.1 6.2
• SECURITY Copying a thread is restricted to the newly created thread as the target and the target boards are validated when converting a thread into an announcement. 6.0 6.1 6.2
• SECURITY Reverting a post to an earlier version now enforces the BBCode permissions of the post author instead of the user performing the revert. 6.0 6.1 6.2
• SECURITY Fixed a reflected XSS through unvalidated label ids in the thread form and the thread label condition. 6.0 6.1 6.2
• SECURITY Fixed a stored XSS through RSS feed content by disallowing the html BBCode in the RSS feed reader cronjob. 6.0 6.1 6.2
• SECURITY The RSS feed reader cronjob limits the size of downloaded feeds, rejects unsafe redirects, limits the number of threads created per run and can no longer be disabled by a crafted feed element. 6.0 6.1 6.2
• SECURITY All thread form and thread form option actions are restricted to the ACP, the option types and the update payload of thread form options are validated. 6.0 6.1 6.2
• SECURITY Discussion threads are no longer created for unpublished or deleted articles. 6.0 6.1 6.2
• Fixed moderation queues being deleted when more than 5000 items are processed. 6.0 6.1 6.2
• The thread list box uses the validated sort field and sort order. 6.0 6.1 6.2
• The implicit limit of 90 days in the thread list box is applied before the thread list is read. 6.1 6.2
• Deleting a multilingual article deletes all of its discussion threads. 6.0 6.1 6.2
• Links of RSS feed items are sanitized and resolved against the feed URL, links using a scheme other than http or https are discarded. 6.2
• Threads without a first post are skipped in the thread feed. 6.2
• Invalid board IDs are ignored in the category form. 6.2

WoltLab Suite Core: Conversations

• SECURITY The module state and the permission to use conversations are now enforced on every conversation action, endpoint, dialog, interaction menu and list view. 6.0 6.1 6.2
• SECURITY Participants that joined a conversation at a later point can no longer read the first message through the teaser, the excerpt, the popover or the notification email. 6.0 6.1 6.2
• SECURITY The RSS feed no longer includes the first message for participants that joined a conversation at a later point. 6.1 6.2
• SECURITY The conversation list no longer discloses activity that happened after a participant left the conversation. 6.0 6.1 6.2
• SECURITY The author of a conversation can no longer access the conversation or its messages after leaving it. 6.0 6.1 6.2
• SECURITY The quick reply, the message search and the modification log are restricted to the timeframe of the user's participation. 6.0 6.1 6.2
• SECURITY Attachments can only be downloaded or quoted for messages that the user is actually permitted to read. 6.0 6.1 6.2
• SECURITY Fixed an attachment permission bypass caused by a mis-keyed object cache. 6.0 6.1 6.2
• SECURITY Uploading and deleting attachments now respects the state of the conversation and the edit permission of the message. 6.0 6.1 6.2
• SECURITY Reporting a conversation message requires read access to that message. 6.0 6.1 6.2
• SECURITY Updating a conversation label is restricted to the label and cssClassName columns and their values are validated. 6.0 6.1 6.2
• SECURITY Replies can no longer set the isFirstPost and conversation parameters. 6.0 6.1 6.2
• SECURITY Guests and users that do not participate in a conversation are no longer listed as readers of that conversation. 6.0 6.1 6.2
• SECURITY Editing the subject of a conversation is now subject to the spam check. 6.1 6.2
• SECURITY Restored the permission check, the conversation quota, the flood control, the message length limit and the spam check when starting a new conversation. 6.2
• SECURITY The interaction context menus no longer allow the enumeration of conversations or disclose the subjects of foreign conversations. 6.2
• SECURITY The conversation label filter only accepts labels owned by the user and label interactions are restricted to the owner. 6.2
• SECURITY The conversation dialogs now verify the participation of the user. 6.2
• Draft attachments are bound to the message instead of the conversation. 6.2
• Required label form fields now validate the selected label. 6.2
• Fixed the handling of notifications for conversations that no longer exist. 6.2

WoltLab Suite Core

• SECURITY The output of the |json template modifier no longer escapes the surrounding <script> element and the documentation now uses the unsafe: prefix. 6.0 6.1 6.2
• SECURITY Unprivileged users can no longer process pending package installation queues. 6.0 6.1 6.2
• SECURITY Fixed an XSS in the filter highlighting of item lists. 6.0 6.1 6.2
• SECURITY Poll option IDs are validated to prevent the manipulation of vote counts. 6.0 6.1 6.2
• SECURITY Fixed XSS through the timestamp and the last activity time interval conditions. 6.0 6.1 6.2
• SECURITY URL custom options and labeledUrl user options reject non-HTTP schemes to prevent XSS. 6.0 6.1 6.2
• SECURITY AbstractDatabaseObjectAction rejects non-identifier column names in the data and counters parameters of the create and update actions. 6.0 6.1 6.2
• SECURITY Fixed XSS via backslashes in language names in the frontend and the ACP. 6.0 6.1 6.2
• SECURITY Fixed XSS via backslashes in the i18n values of the language input. 6.2
• SECURITY Tar and Zip reject unknown filenames instead of returning the wrong entry, reject entries pointing outside of the target directory and stop reading past the end-of-archive marker. 6.0 6.1 6.2
• SECURITY Array keys are encoded in several places to prevent reflected XSS. 6.0 6.1 6.2
• SECURITY Article feeds require an enabled MODULE_ARTICLE, session-specific RSS feeds are no longer stored in shared caches and the access token no longer remains in the anonymous feed link. 6.0 6.1 6.2
• SECURITY reCAPTCHA is verified via POST and API error responses are rejected instead of accepting the captcha. 6.0 6.1 6.2
• SECURITY Fixed a reCAPTCHA downgrade attack through the request-supplied captcha type. 6.2
• SECURITY The captcha is validated before the login credentials are checked. 6.2
• SECURITY The template sandbox is restored in a finally block to prevent variable leaks. 6.0 6.1 6.2
• SECURITY Fixed code injection via crafted variable expressions and unescaped variables in templates and code execution via PHP tags in {literal} blocks. 6.0 6.1 6.2
• SECURITY Fixed email header injection through trailing newlines, custom header names and attachment filenames. 6.0 6.1 6.2
• SECURITY The email body is deep cloned to prevent leaking recipient data across recipients. 6.0 6.1 6.2
• SECURITY Style variables, icon names, style names, font families, preload values and downloaded font file names are validated and escaped to prevent CSS, SCSS and HTTP header injection, path traversal and arbitrary file writes into the web root. 6.0 6.1 6.2
• SECURITY The style colors in the web manifest are escaped. 6.1 6.2
• SECURITY Brand icon names are validated and attributes in the icon fallback are escaped to prevent path traversal, SVG and HTML injection. 6.0 6.1 6.2
• SECURITY The ACP search enforces the enterprise blacklist, escapes the results and bounds the user query. 6.0 6.1 6.2
• SECURITY Trashed and inaccessible articles are excluded from search results and lookups. 6.0 6.1 6.2
• SECURITY Added the missing permission check for tagged article lists. 6.2
• SECURITY Tracked versions are bound to the requested object to prevent cross-object reverts. 6.0 6.1 6.2
• SECURITY Embedded objects are checked for access and their titles are escaped. 6.0 6.1 6.2
• SECURITY The [img] bbcode is restricted to http(s), validates the decoded URL, rejects host-confusion URLs and no longer outputs srcset. 6.0 6.1 6.2
• SECURITY The page visibility is checked to prevent disclosure. 6.0 6.1 6.2
• SECURITY The media alignment is escaped to prevent XSS. 6.1 6.2
• SECURITY The GitHub Gist pattern is restricted and media provider matches are escaped. 6.0 6.1 6.2
• SECURITY The ID of a dismissed notice is validated. 6.0 6.1 6.2
• SECURITY Notice permissions are checked before the lookup. 6.2
• SECURITY Cyclic category structures and cross-type category moves are prevented. 6.0 6.1 6.2
• SECURITY Inaccessible categories are no longer disclosed via CategoryFilter. 6.2
• SECURITY The attributes of <woltlab-metacode> are validated against the bbcode definition. 6.0 6.1 6.2
• SECURITY Select option labels are escaped in ACP option forms, the remaining option type templates, user profiles and the group select option type. 6.0 6.1 6.2
• SECURITY Select option labels are escaped before the phrase lookup, not after. 6.1 6.2
• SECURITY Fixed XSS via usernames in the mention suggestions and the moderation assignee update. 6.0 6.1 6.2
• SECURITY Attachment filenames are rendered as plain text when the file cannot be downloaded. 6.0 6.1 6.2
• SECURITY The full size image source in the attachment bbcode is escaped. 6.1 6.2
• SECURITY The delta type reported by the blacklist server is validated and the IPv6 blacklist check no longer silently matches nothing. 6.0 6.1 6.2
• SECURITY Fixed XSS via the error code reported by an OAuth 2 service. 6.0 6.1 6.2
• SECURITY Unfurl images are limited to HTTP URLs on standard ports. 6.0 6.1 6.2
• SECURITY Fixed open redirects via scheme-relative URLs, C0 control characters, parser confusion and injected internal link parameters. 6.0 6.1 6.2
• SECURITY The unserialization of singletons is blocked. 6.0 6.1 6.2
• SECURITY Fixed a ReDoS in StringUtil::isUTF8(). 6.0 6.1 6.2
• SECURITY StringUtil::stripHTML() no longer leaves multi-line HTML comments intact. 6.0 6.1 6.2
• SECURITY Fixed XSS in the ipSearch template modifier. 6.0 6.1 6.2
• SECURITY The remaining C0 controls, DEL and C1 controls are rejected in usernames. 6.0 6.1 6.2
• SECURITY The AJAX exception details are escaped. 6.0 6.1 6.2
• SECURITY Exception details are hidden outside of the debug mode. 6.1 6.2
• SECURITY Fixed a flood control bypass via IPv6 address rotation. 6.0 6.1 6.2
• SECURITY Disallowed BBCodes in the quick reply are rejected instead of being silently accepted. 6.0 6.1 6.2
• SECURITY The HTML encoded inner content marker is no longer treated as a placeholder. 6.0 6.1 6.2
• SECURITY CSS metacharacters, quotes and semicolons are stripped from <font>, color and font bbcode attributes. 6.0 6.1 6.2
• SECURITY The media bbcode and the bbcode converters reject non-HTTP URL schemes to prevent stored XSS. 6.0 6.1 6.2
• SECURITY PayPal IPN postbacks are validated strictly to prevent forged payment notifications. 6.0 6.1 6.2
• SECURITY Legacy plaintext subscription descriptions and usernames in trophy descriptions are escaped. 6.0 6.1 6.2
• SECURITY The page ACL is enforced in breadcrumbs and the profile access in the online location. 6.0 6.1 6.2
• SECURITY The box sort field and order are validated to prevent SQL injection in ORDER BY. 6.0 6.1 6.2
• SECURITY The media ownership permission is enforced when replacing a file. 6.0 6.1 6.2
• SECURITY Attachment permissions are enforced in [attach] and foreign attachments are no longer accessible via blank temporary hashes. 6.0 6.1 6.2
• SECURITY CSS class names are escaped in Label::render(). 6.0 6.1 6.2
• SECURITY The tag autocomplete enforces MODULE_TAGGING and user.tag.canViewTag. 6.0 6.1 6.2
• SECURITY Tag names are encoded in the tag synonym action. 6.2
• SECURITY View permissions are enforced when loading likes and reactions and reaction titles are escaped. 6.0 6.1 6.2
• SECURITY SendNewPasswordWorker is restricted to accessible groups and validates the authData. 6.0 6.1 6.2
• SECURITY Fixed PHP code injection in generated language files. 6.0 6.1 6.2
• SECURITY Fixed XSS via unvalidated ACL values in the permission JavaScript. 6.0 6.1 6.2
• SECURITY Fixed an authentication bypass in the unsubscribe link via an empty notification mail token. 6.0 6.1 6.2
• SECURITY The profile visibility is enforced when loading the recent activity, the activity points and the profile menu. 6.0 6.1 6.2
• SECURITY Case-mismatched user conditions no longer grant unintended user groups. 6.0 6.1 6.2
• SECURITY Fixed stored XSS via the user language condition and the mention fallback in the user and group bbcodes. 6.0 6.1 6.2
• SECURITY User groups can no longer be created or updated via AJAX, deletion enforces isDeletable() and non-owners cannot grant access to the owner group. 6.0 6.1 6.2
• SECURITY Copying user groups is restricted to accessible groups and the access to the list of groups is restricted. 6.2
• SECURITY The device name in the TOTP selection is encoded. 6.0 6.1 6.2
• SECURITY Fixed an authentication bypass for malformed Drupal and phpBB3 password hashes. 6.0 6.1 6.2
• SECURITY Fixed XSS via media metadata in the media selection display. 6.0 6.1 6.2
• SECURITY Added the missing permission check for global SCSS/CSS. 6.0 6.1 6.2
• SECURITY Revoking or restoring subscriptions requires the permission. 6.0 6.1 6.2
• SECURITY Fixed a permission bypass via case-insensitive action names. 6.0 6.1 6.2
• SECURITY Fixed SSRF through service worker push endpoints. 6.1 6.2
• SECURITY Ads are disabled in the authentication flow to keep third-party code off login forms. 6.1 6.2
• SECURITY Embedded media thumbnails are restricted to the sizes offered by the editor. 6.1 6.2
• SECURITY Added the missing moderation check for responses of disabled comments. 6.1 6.2
• SECURITY The registration disclaimer confirmation is enforced. 6.1 6.2
• SECURITY Forged AJAX requests are detected when enforcing the multi-factor requirement. 6.1 6.2
• SECURITY UserAuthenticationConfiguration is enforced in AccountManagementForm. 6.1 6.2
• SECURITY Dashboard box titles are escaped in the configuration dialog. 6.1 6.2
• SECURITY The client-controlled __replace flag can no longer bypass the upload limit. 6.1 6.2
• SECURITY Fixed XSS via unfiltered quote previews and unvalidated quote IDs. 6.2
• SECURITY The moderation permission and the queue type are enforced on the moderation endpoints. 6.2
• SECURITY Size, type and count limits are enforced for contact form attachments. 6.2
• SECURITY Plaintext captions in the image viewer are escaped. 6.2
• SECURITY Fixed XSS via the cronjob description in the cronjob log grid view. 6.2
• SECURITY Module and permission checks are enforced in interaction providers. 6.2
• SECURITY Fixed a path traversal via the logFile filter in ExceptionLogGridView. 6.2
• Added WysiwygFormField::getHtmlInputProcessor(). 6.0 6.1 6.2
• StringUtil uses mb_chr() and mb_ord() to stop emitting malformed UTF-8 for astral code points and surrogates. 6.0 6.1 6.2
• Fixed the stale file list in uploads. 6.0 6.1 6.2
• Fixed the never-matching removedFiles key in uploads. 6.2
• Fixed isInitialized() reporting true while the constructor is still running. 6.0 6.1 6.2
• Avoided the deprecated out-of-range chr() call in IpAddress::toMasked(). 6.0 6.1 6.2
• Fixed cronjob update data leaking between iterations in resetFailedCronjobs(). 6.0 6.1 6.2
• Unparsable requests are rejected instead of raising uncaught exceptions. 6.0 6.1 6.2
• Fixed Tar::extractToChunks() reading zero bytes when the file size is a multiple of the chunk size. 6.1 6.2
• Fixed files being moved outside of the file tree during a rebuild. 6.1 6.2
• Invalid push subscriptions no longer block the notification queue. 6.1 6.2
• Updated CKEditor to v48.4.0. 6.2
• Fixed empty article links caused by a language switch after the cache fetch. 6.2
• Fixed the style compilation failing on absolute URLs in style variables. 6.2
• Fixed the show order handler returning a non-list of items and deduplicating mixed int and string IDs incorrectly. 6.2
• Multilingual pages are shown only once in the search results. 6.2
• Fixed the link color in the header of reduced messages. 6.2
• Fixed a missing else in AbstractGridView. 6.2
• Fixed the permission check for moderation comment notifications failing on missing user profiles. 6.2
• Fixed the minimum and maximum configuration of the float form option. 6.2
• Fixed a typo in a variable name in AbstractOptionPackageInstallationPlugin. 6.2
• Fixed the replacement of URLs containing UTF-8 characters. 6.2
• Fixed the one-time consent for external media in the image viewer. 6.2
• __rewrittenPath is validated to be a string. 6.2

Forum software is updated to WoltLab Suite 6.2.8

Notable Changes

WoltLab Suite Forum

• Fixed a capitalization typo in the German phrase wbb.post.option.markAsDone.description. 6.2

WoltLab Suite Core: Moderated User Group

• Attachments are now disabled in the editor for user group applications, fixing a TypeError when uploading an image in the application reason. 6.2

WoltLab Suite Core

• SECURITY Temporary attachments are restricted to their uploader, preventing third parties from listing or claiming them through a computed tmpHash. 6.0 6.1 6.2
• The WebP variant of a file is deleted together with the file to prevent access to deleted images. 6.1 6.2
• Stale WebP variants are deleted when a file is no longer eligible for a WebP variant. 6.1 6.2
• The composer dependencies were updated, including Guzzle 7.15.5 which fixes the host validation (GHSA-v5mv-p594-2x33) and the cookie domain matching (GHSA-f7vp-7xgx-4w4r). 6.2
• The i18n values in the multilingual input were escaped twice, leaking backslashes into the stored phrase on every save. 6.0 6.1 6.2
• CKEditor was updated to v48.5.1. 6.2
• The fix for the broken substr in Safari 27 on x86_64 was backported to the CKEditor bundle. 6.2
• The CKEditor translations that were lost due to a format change were restored. 6.2
• The quote buttons were unresponsive on iOS 27 due to a delayed touchend event. 6.2
• The quote lists became stale when an inline editor was recreated. 6.2
• The service worker now calls waitUntil() synchronously in the push handler to keep the worker alive. 6.2
• The service worker claims the clients on activation and skips push notifications that were already shown by polling. 6.2
• The user menu uses native scrolling on touch devices, fixing notifications that had to be tapped twice. 6.2
• The react button crashed during initialization when the label span was absent, for example, when only one reaction type is active. 6.2
• The state manipulation upon navigation was dropped because it was only required for the previous image viewer. 6.2
• Unfurled URL previews were rendered as squared images. 6.2
• The RPC endpoints for paid subscriptions in the admin panel were broken. 6.2
• Tags created in the admin panel are assigned to the default language when content languages are disabled. 6.2
• Pages that require an unavailable object id can no longer be selected for menu items. 6.2
• The output of source code options can be scrolled when it overflows. 6.2
• The language cache is reset when menus or menu items change. 6.2
• The urlParameters were lost when saving menu items via the devtools PIP form. 6.2
• The devtools PIP entry edit form reads the identifier from $_GET only, fixing an error when the identifier of an entry was changed. 6.2
• GridViewFormNode is wrapped in a container element so that addClass() and addClasses() take effect. 6.2
• A missing phrase was added. 6.2
• Form builder dependencies ignored changes to item lists. 6.2
• Circular package requirements are detected during the topological sorting instead of causing an endless loop. 6.2
• File processors are notified when the EXIF stripping or the WebP generation renames the file. 6.2
• FileProcessor::generateWebpVariant() was missing the #[\NoDiscard] attribute. 6.2
• Deadlocks when enqueuing a unique background job are handled without a retry. 6.2
• The legacy global helper functions in wcf.globalHelper.js were marked as deprecated. 6.2
• A CLI script was added to migrate installations from WCF_N > 1 to WCF_N = 1. 6.2
• The NPM dependencies were updated. 6.2