Released 2x XenForo 2.2.16 Released Full | XenForo 2.2 ENXF 2.2.16 Patch 2

Firstly, to clarify some concerns that have arisen:

1. If you did a normal upgrade (either uploading files or via your admin control panel) you do not need to manually edit any files to receive the security fixes.

2. If you upgraded to the initial 2.2.16 release, you are fully protected against the security issues that were being addressed.

Secondly, a second patch is being released to address some minor bug fixes that may not have been correctly applied when upgrading to XenForo 2.2.16. This is only applicable if you performed a normal upgrade to 2.2.16, and this patch is not security related or affected by the security fixes.

You can download that now from your customer area or perform a one-click upgrade through your admin control panel. You can go to Tools > Check for upgrades in order to see the second patch release.

If you are running XenForo Cloud, the fixes have been applied automatically.

Firstly, to clarify some concerns that have arisen:

1. If you did a normal upgrade (either uploading files or via your admin control panel) you do not need to manually edit any files to receive the security fixes.

2. If you upgraded to the initial 2.2.16 release, you are fully protected against the security issues that were being addressed.

Secondly, a second patch is being released to address some minor bug fixes that may not have been correctly applied when upgrading to XenForo 2.2.16. This is only applicable if you performed a normal upgrade to 2.2.16, and this patch is not security related or affected by the security fixes.

You can download that now from your customer area or perform a one-click upgrade through your admin control panel. You can go to Tools > Check for upgrades in order to see the second patch release.

If you are running XenForo Cloud, the fixes have been applied automatically.

Some of the changes in XF 2.2.16 include:

• Fix some issues with xf-dev:class-use-function to better support classes with class attributes and comments, or existing use function declarations.
• Fix persistent action indicator when using back/forward navigation
• Add _deleteFromSource method to support performing tasks right before entity deletion
• Skip logging IPs when updating avatars during registration
• Fix docblock return hint for \XF\Util\Ip::checkIpsAgainstBinaryRangeList
• Add missing security locked phrase
• Expose additional parameters to the reported_thread_title phrase
• Ensure sticky threads are passed to the fetchExtraContentForThreadsFullView method
• Adjust the phrasing of mail encryption options
• Update purchase requests on user merge
• Set aria-label for tooltips with no children
• Skip processing email bounces and unsubscribes when email has been disabled in config.php
• Gracefully handle errors when editing bookmarks
• Clean up temp files after job completion
• Add proper ordering to the shared IPs tab
• Add an index hint to the newest members widget
• Avoid generating invalid SQL with XF\Db\Schema\Column::values()
• Prevent disabled accounts from using the admin control panel
• Include a plain confirmation URL in the email sent to users awaiting email confirmation

Hot on the heels of yesterday's XF 2.2.14 release and subsequent patches, we are today making XenForo 2.2.15 available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability, particularly if you already upgraded to XenForo 2.2.14.

As of this point, XenForo 2.2.14 and its patches are no longer available for download. We are still planning a final XF 2.2 release at some point around the release of XenForo 2.3!

Some of the changes in XF 2.2.15 include:

• Avoid setting duplicate List-Unsubscribe headers.
• Include first post QA schema items unconditionally.
• Make outdated PHP version notice in admin control panel clearer.
• Retain the original unsubscribeEmailAddress option for backwards compatibility.
• New unsubscribeEmailHandling option to replace the new unsubscribeEmail option and conclusively fix issues arising from yesterday's XF 2.2.14 release.
• Fix URL unfurls no longer unfurling.

Current requirements​

Please note that XenForo 2.2 has higher system requirements than earlier versions.

The following are minimum requirements:

• PHP 7.0 or newer (PHP 8.2 recommended)
• MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
• All of the official add-ons require XenForo 2.2.
• Enhanced Search requires at least Elasticsearch 2.0.

Sincere apologies. A further issue has been identified in which initial upgrades to 2.2.14 may have set the default 'http' option for the unsubscribe option incorrectly.

The latest patch will workaround this issue if you are affected.

Alternatively, going to Options > Email options in your admin control panel and setting the "Unsubscribe email handling" option as desired will fix the issue without needing to upgrade.

This is being rolled out to existing Cloud customers automatically if affected.

XenForo 2.2.14 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability.

In addition to the usual slew of bug fixes and improvements, there are a few notable changes in this release.

Compatibility with PHP 8.1 and 8.2​

Most compatibility issues between PHP 8.1 and 8.2 have been addressed. Remaining issues might trigger E_DEPRECATED warnings in the xf_error_log during debug mode, but these are generally non-critical and can be disregarded.

Email unsubscribe changes​

Previously, we allowed users to unsubscribe from emails through certain mail clients when the automated unsubscribe handler was configured. With the introduction of XenForo 2.2.14, we're implementing a new standard feature that processes unsubscribe requests via HTTP. This feature is activated by default and requires no additional configuration. Your current settings for email unsubscribing will not be altered. The recent updates include:

• Enhanced handling of the List-Unsubscribe header to support both mailto and HTTP methods.
• Automatic inclusion of the unsubscribe header in a broader range of outgoing emails, such as notifications for watched threads and activity summaries.
• A default-enabled option to send confirmation emails to users once their unsubscribe request is fulfilled.

Minor security fix​

In previous versions, add-on or style archives could escape their container directory and bypass subsequent validation checks. Exploiting this requires an administrator with the pertinent permissions to upload a maliciously-crafted archive. This has been addressed in XenForo 2.2.14. Thank you to Egidio Romano of Karma(In)Security for reporting this issue.

Update on XenForo 2.3 and XenForo 3.0​

Work continues towards the next versions of XenForo. @Kier is now working full time on some exciting stuff for XenForo 3.0 while the rest of us are working towards getting XenForo 2.3 stable enough for a public beta release, in addition to the last few bells and whistles for both the core software and some enhancements to our official add-ons. Additionally, we plan to release one last update for XenForo 2.2, namely XenForo 2.2.15, which will incorporate significant fixes before we transition to primarily supporting XenForo 2.3.

Some of the changes in XF 2.2.14 include:

• Fix type hinting for extendClass
• Do not attempt to generate tag URLs without a valid tag
• Properly disable outbound IPv6 requests when PHP is not compiled with IPv6 support
• Improve audio mime-type detection
• Use sodium_bin2base64 over base64_encode when generating random strings.
• Update Twitter BB code media site to support x.com URLs and update some branding to X, rather than Twitter.
• Increase the size of the old_value and new_value columns in the xf_change_log table
• Properly throw an exception when failing to decode JSON for oEmbed
• Ensure tag pages have a canonical URL set
• Support custom URL portions for link forums
• Mark old_value and new_value fields as required in the change log entity
• Adjust regex for dialog loading to ensure consistency with BB code tag naming.
• Fix a number of emoji phrases
• Update braintree_api_keys_explain.txt phrase
• Update webmanifest orientation to use natural as this should derive from the system's settings.
• Highlight current style and language selections on chooser pages
• Always set thread RSS publication dates to the creation date of the thread
• Fix profile post/comment author alert reason API documentation
• Properly phrase the BB Code help page example
• Improve error handling when loading notifier services
• Extend notifier service class before calling createForJob static method
• Reduce lock contention when writing thread read records
• Provide a getter for class extensions, and check for class extensions before attempting to remove them
• Skip relative (dot) files when cleaning up temporary files
• Ensure prefix search constraints are lists of values
• Use a no-permission response when a user cannot be banned, and gracefully handle error responses without a proper error message
• Clarify that new SFS submissions will transmit an unhashed email address
• Properly capture array_unique results
• Add an index to the user ID column of the error log table
• Fix value of custom user titles in API responses
• Surely .u-spaceBefore is intended to apply the margin to the left
• Guard against null metadata in MySQL full-text searchs
• Do not display menus for selected tabs with no links
• Use a more efficient query when updating reaction caches for content
• Support filtering threads with forum type filters when using the API
• When rebuilding user group relations, skip falsey values
• Include support for embedding YouTube Live URLs
• Improve PHP 8.2 compatibility in vendor libraries
• Pass posterParams in the post reaction push template
• Attempt to support fb.watch URLs
• Only set descriptor suffix for Stripe card payments

[/LIST]

XenForo 2.2.13 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability.

In addition to the fixes listed below, we have a few other aces up our sleeves this time around.

Full iOS PWA compatibility with push notification support​

iOS 16.4 finally introduced push notifications for iOS devices. To facilitate this, your members need to install your site as a PWA (by utilising the Add to Home Screen feature in Safari). XenForo 2.2.13 now satisfies all of the prerequisites for this to support push notifications which can be enabled by your members once they log in through the PWA and enable push notifications in their Preferences.

The PWA (progressive web app) has now been enhanced with additional gesture based or UI controls, including pull down to refresh and a floating back button.

Structured data metadata improvements​

With many thanks to Ryan Levering from Google we have made a number of improvements to structured data metadata. Structured data enriches the pages we output with additional information which enables Google and other search engines to better understand the structure of the information that is rendered. This helps Google provide rich search results and helps provide additional context to users who may find your content during their Google searches.

Support for OAuth authentication for Microsoft 365 business email accounts​

Microsoft has deprecated the ability to send emails over SMTP using traditional username/password authentication. This is similar to what Google did a while ago. In light of this we have now added an additional option when setting up either your email transport or automated mail handlers (automated unsubscribe/bounce handling) which will enable you to authenticate with OAuth.

Note: The set up for this is fairly complex, requiring you to set up an Azure Active Directory application within the Azure developer portal. There is a link to the documentation when setting this up.

If you are a XenForo Cloud customer, your upgrade will be scheduled automatically.

Some of the changes in XF 2.2.13 include:

• Adjust several cookie third party identifiers
• Fix simple cookie notice flash for guests
• Update thread creation latest activity items when merging threads
• Add null checks when we're inspecting the result of the getPhraseGroup method of the Phrase entity.
• Add context to node permission list with node type icons.
• Don't attempt to access getCookieThirdParties on payment providers which may no longer exist.
• Update enable push option to reflect better browser support.
• Check search permissions when displaying the 'Your content' link in the visitor menu
• Restore "notes" phrase that was inadvertently deleted in the previous release
• Avoid leaking the email address linked to an account that is using email two-step verification
• Don't show the view more link on a member's recent content page for users who have no permissions to search
• Ensure wrapper display HTML value has whitespace trimmed
• Properly set custom titles when batch updating users
• When adding/editing nodes, the description for the URL portion field now refers to nodes rather than forums
• Fix a typo in the cookie_consent.cookie_description_dbWriteForced phrase
• Replace MaxCDN with jsDelivr as the CDN for Twemojis
• Ensure emojis are properly displayed in the chosen style
• More consistently set content key across different content types
• Fix error thrown when xf_consent cookie has an invalid value
• Escape backslashes when escaping SQL like clauses
• Do not prepare member stat results prior to caching
• Fix some entity collection return type hints
• Clamp input filterer float values
• Attempt to prevent browsers from autofilling credentials in the find member widget
• Rebuild permissions in batches to limit memory usage
• Display an error when an invalid URL is used to test URL unfurling
• Display content vote scores in LTR orientation
• Make stream closing attempts more robust when working with abstract files
• Fix type hint in Oembed subcontainer
• Gracefully handle Redis mget failures
• Only display flash message once when tags are edited
• Fix max length attribute of custom warning title input
• Perform validation on email address options
• Allow restricting forum RSS results by prefix IDs
• Do not attempt to decrement alert counters when a new alert is inserted
• Fix behavior of falsy code event listener hints
• Perform validation on error reply values
• Always include search query arguments when building search links
• Retain previous selection when changing poll votes
• Improve notice controller/action criteria validation
• Include support for embedding YouTube Live URLs
• Check thread visibility before redirecting for invalid post links
• Improve user IP lookup query performance
• Make user entity timezone verification more robust
• Remove dead code from vBulletin 5 authentication handler
• currencyFormat was changed to allow figures with no decimals to show without decimal places, but to show the decimals if any were present. In doing so, we managed to kill the ability to specify the number of decimals. Oopsie. So now you can do that again, and you can also now specify -1 precision in order to prevent number_format from limiting or artificially extending the decimal places at all.
• Update the intl-tl-input JS library
• Fix CSS border radius shifting for RTL styling
• Increase entropy of temporary directory name generation to reduce the likelihood of race conditions
• Improve performance of \XF\Extension::resolveExtendedClassToRoot using an inverse lookup table
• Correctly replace urlencoded CSRF token values before returning cached pages to fix an issue with Advanced cookie management.
• Ensure that unsubscribing from emails also unsubscribes the user from activity summary emails
• Support embedding YouTube videos from youtube-nocookie.com
• Fix incorrect type hints in prefix and prompt group entities

The following public templates have had changes:

• PAGE_CONTAINER
• account_confirm_resend
• account_connected_associate
• account_details
• account_email
• account_request_password
• account_two_step_authy_config
• account_visitor_menu
• app_body.less
• app_content_vote.less
• approval_item_user
• approval_queue_macros
• connected_account_macros
• contact_form
• content_vote_macros
• core.less
• core_button.less
• core_list.less
• custom_fields_macros
• editor_base.less
• email_stop_confirm
• google_analytics
• helper_js_global
• lost_password_confirm
• member_about
• member_recent_content
• member_view
• member_warn
• message_macros
• notice_confirm_email
• notice_email_bounce
• poll_macros
• post_macros
• post_question_macros
• register_confirm
• register_connected_account
• security_lock_resend
• security_lock_reset
• spam_cleaner
• tag_macros
• tel_box.less
• two_step_email
• widget_find_member

Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.

Current requirements​

Please note that XenForo 2.2 has higher system requirements than earlier versions.

The following are minimum requirements:

• PHP 7.0 or newer (PHP 8.0 recommended)
• MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
• All of the official add-ons require XenForo 2.2.
• Enhanced Search requires at least Elasticsearch 2.0.

DGT Version

https://enxf.net/threads/xenforo-2-2-12-released-full-xenforo-2-2-enxf-nulled.3893/post-46697

XenForo 2.2.12 Released​

XenForo 2.2.12 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability.

We're pleased to announce the introduction of two new features available in XenForo 2.2.12.

New CAPTCHA provider: Cloudflare Turnstile​

In September, Cloudflare Turnstile was announced. You may have noticed that we quickly implemented this into the software and it has been running here now for a little while.

While on the surface this may seem like "just another CAPTCHA" option, we feel that Cloudflare has gotten a lot of things right in its approach to this product that is missing from many other providers including HCaptcha and Google reCAPTCHA. It's a much better experience for your users, respects your users privacy and with XF 2.2.12 also provides more granular logging in the Cloudflare dashboard so you can see analytics about where in the software a CAPTCHA is being used.

We encourage you to read more about Cloudflare Turnstile on their blog and consider signing your site up, for free, right here or if you are an existing Cloudflare user, get started in your Cloudflare dashboard.

Advanced cookie consent system​

Starting with XF 2.2.12 you will be able to enable a new "Advanced" cookie consent system. This enables your users to have much more granular control over the specific cookies that are set, the purpose of each cookie and prevents certain cookies from being set at all until explicit consent is given.

As ever, this system is also extendable by add-on developers so that cookies set by an add-on can be appropriately categorised and also require consent before certain functionality is available.

Some of the changes in XF 2.2.12 include:

• Always default to an empty array when IPv6 lookup fails
• Fix a server error when guests tried to access non-existent search results
• Include some missing entries in the hashes file
• Suppress warnings when converting invalid IP addresses on older versions of PHP
• Implement suggested password normalization for PhpBb3 authentication
• Check for "Manage add-ons" permission when viewing or triggering a file health check
• Fix not being able to follow users in an email bounced user state
• Fix custom user titles set to falsy values not being displayed
• Add missing pagination when searching for a user's reported content
• Only sign emails if DKIM setup has been verified
• Properly account for falsy values in wholeWordTrim and snippetString functions
• Fix PHP 8.1 compatibility issue when performing a search with no keywords
• Update Swiftmailer to v6.3.0 for PHP 8.1 support
• Make adjustments to Facebook media site to support new pfbid IDs
• Add support for detecting utf8mb3 and treating it the same as utf8 thus ensuring unicode mismatch detection and table conversion to utf8mb4 is working correctly.
• Add missing CSS to the comment macro in the profile_post_macros template
• When trying to unapprove a deleted thread, undelete it and put it in the approval queue
• Prevent configuration of two-factor authentication when it is disabled via the config.php switch
• Fix outdated link in the you_can_preview_icons_and_their_names_here phrase
• Fix typo in legacy Instagram embed template
• Re-implement Instagram embeds without a reliance on the oEmbed endpoints and support reel links.
• Adjust template Parser to allow for more precise parentheses placement in some previously ambiguous usages.
• If guest content is awaiting approval, show the username the content was submitted under
• Fix PHP 8.1 compatibility issue when rebuilding a thread's first post information
• Remove extraneous line breaks from the news feed option description
• If a user is also a moderator, update the URL on their admin profile page to only show forums they moderate
• Exclude nodes where a user can't view thread content from search queries
• When importing from an RSS feed and posting as a particular user, respect their auto-watch preferences
• Add support for 3GP encoded videos
• Fix $fromEmail variable not being set correctly when sending emails
• Fix accidentally exposing thread content to guests without the "View threads by others" permission when the thread starter's account has been deleted
• Ensure error logging isn't silently skipped if stacktrace arguments contain invalid utf-8.
• Adjust CSS for Spotify media embed.
• Adjust Select2 and native auto-completer to accept tab key as selecting a result.
• Support node_name / URL portion for categories (relevant if categoryOwnPage option enabled)
• Remove reference to non-existent reaction_text column
• Fix typo in mail template rendering exception message
• Fix connected account providers not appearing on the login form in some cases
• More accurate way of parsing byte values from PHP config values.
• Ensure only valid users are able to change their username.
• Better support cross platform directory separator trimming in ComposerAutoload
• Mark XF\Payment\CallbackState as allowing dynamic properties.
• Include PHP 8.2 compatibility fixes in non-vendor classes and utf8.php
• Fix Vimeo embed start timestamp behavior
• Use late static binding in utility classes to make them easier to extend
• Ensure job max run-time checks occur at end of loops
• Dynamically build link to front-end in the control panel
• Include content IDs in extra data when performing spam checks
• Include content IDs in extra data when performing spam checks
• Improve the extensibility of spam trigger log request data
• Add validation to widget display conditions
• Fix validation for negative whole number custom fields
• Adjust title attributes on bookmark links and buttons
• Adjust line height of inline mod go button to match select height
• In Text::copy return a Text element rather than Tag.
• Properly escape regex when rendering a BB code table.
• Disable PSR class path inspection in extension_hint.php
• In the ChangeLoggable behaviour add a new option to force a change to be from a specific user ID. In contexts where actions are performed from an email link, such as email stop or password resets, this allows us to ensure the password reset change log is attributed to the correct user.
• Update flow.js to the latest version, remove legacy FustyFlow for ancient IE fallback.
• Apply recommended fix for wrapping selection text in different editor functionality.
• Return a HTTP 404 error code when trying to view a tag with no viewable content
• Handle null arguments when stripping BBcode from strings

The following public templates have had changes:

• PAGE_CONTAINER
• _help_page_cookies
• _media_site_embed_oembed
• _media_site_legacy_embed
• account_confirm_resend
• account_security
• app.less
• app_inlinemod.less
• approval_queue_macros
• bookmark_macros
• captcha
• captcha_turnstile
• contact_form
• core_bbcode.less
• core_utilities.less
• editor_base.less
• forum_post_quick_thread
• forum_post_thread
• google_analytics
• helper_attach_upload
• login
• lost_password
• misc_cookies
• notice_cookies
• notices.less
• register_form
• report_search
• thread_list_macros
• thread_reply
• thread_view

Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.

Current requirements​

Please note that XenForo 2.2 has higher system requirements than earlier versions.

The following are minimum requirements:

• PHP 7.0 or newer (PHP 8.0 recommended)
• MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
• All of the official add-ons require XenForo 2.2.
• Enhanced Search requires at least Elasticsearch 2.0.