XenForo Releases

Xenforo 2.1.7 Nulled

Submitted by xuromi, , Thread ID: 156811

Thread Closed
xuromi
Active Member
Level:
4
Reputation:
10
Posts:
422
Likes:
353
Credits:
8.65K
28-01-2020, 12:05 AM
This post was last modified: 18-03-2020, 02:17 PM by xuromi
#1
XenForo 2.1.7 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo 2.1 upgrade to this release to benefit from increased stability.

Most importantly, this release fixes a security vulnerability in XenForo. Only XenForo 2.1.0 and above are affected.

The issue is a XSS vulnerability. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access.

The vulnerability affects content displayed in the "Approval queue" and requires specially crafted text to be entered into a relevant field for the content type (such as a thread title).

XenForo extends thanks to @rdn for reporting the issue.

We also give an honourable mention to @TickTackk who reported a "self XSS" issue to us related to the Froala rich-text editor that we use. While we do not consider this to be a security issue, we have fixed it and appreciate the time taken to report it.

While we recommend doing a full upgrade to resolve this issue, you can also patch the issue yourself with a simple template edit.

The template in question is approval_queue_macros.

*To patch your existing installation, please follow these steps:

Download the patched template which is in a file named 217patch.txt (attached to the bottom of this post).
Log in to your Admin control panel, expand the Appearance navigation and click the "Templates" link.
In the "Filter" field at the top of the list, type approval_queue_macros and open the template.
Open the 217patch.txt file and copy the entire contents of this and paste it into the approval_queue_macros template, overwriting the existing content.
Click "Save and exit".
Repeat the steps above for all of your installed styles.


Note that if you upgrade to 2.1.7 or a newer version, you may undo/revert these template edits.

Some of the changes in XF 2.1.7 include:

Ensure that some jobs do not attempt to complete or otherwise change state inside a transaction.
Ensure correct URL is used in the bookmark label filter when friendly URLs are not enabled.
Display correct username styling when viewing users linked to an IP.
In alerts and the news feed, ensure the "your post" link in the reaction item is clickable.
Ensure Gravatar rebuild job respects the options sent to it.
Prevent users from deleting their own accounts
Check for guest posts in post reaction items
Ensure login button when viewing a forum as a guest wraps properly.
Only try to hide the global action indicator if it's actually present.
Do not redirect back to the login page after a connected account request
Properly check for tag container inside tagger
Do not escape outbound email test subject phrase
Correctly handle add-ons created with incorrect casing when the namespace already exists.
Add additional wording to make it clear that the rejection reason will be shown to users awaiting approval.
Remove hard-coded height from payment inputs
Add missing phrase for 'could_not_find_subscriber_id_for_this_purchase_request'
Display PHP's memory_limit within server environment report.
Force choice builder to use temporary variable with set tags
Remove Google+ URL from the Google connected account template.
Allow disabling pointer events for nested tooltips
Remove unused parameter when fetching reaction phrase
Update promotion history interface for clarity
Fix post copier attachment regex


The following public templates have had changes:

alert_post_reaction
approval_item_user
connected_account_associated_google
core_button.less
core_tooltip.less
forum_view
payment_initiate.less
reaction_item_post
thread_edit

Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.

Upgrade Nulled
Content locked
This content has been locked. Please login or register in order to unlock it.


Full Nulled
Content locked
This content has been locked. Please login or register in order to unlock it.


Only Patch 217patch.txt (read up)*
Content locked
This content has been locked. Please login or register in order to unlock it.
This hidden content has been reported as still working 0 times this month.
1 times in total

RE: Xenforo 2.1.7 Nulled

mullvad
Member
Level:
1
Reputation:
0
Posts:
122
Likes:
5
Credits:
3
28-01-2020, 01:35 PM
#2
this release and only the security path or the whole script?

RE: Xenforo 2.1.7 Nulled

lagrace
Newbie
Level:
0
Reputation:
0
Posts:
16
Likes:
0
Credits:
0
28-01-2020, 11:47 PM
#3
bonjour merci pour les utilisateurs de ce script qui a l air pas mal du tout

RE: Xenforo 2.1.7 Nulled

Guest
Level:
0
Posts:
N/A
Likes:
0
Credits:
0
28-01-2020, 11:56 PM
#4
Nice leak man, thanks you. You are realy good man !

RE: Xenforo 2.1.7 Nulled

marcusg445
Lurker
Level:
0
Reputation:
0
Posts:
2
Likes:
0
Credits:
4
29-01-2020, 02:37 AM
#5
Going to give this a go, first time using xenForo.

RE: Xenforo 2.1.7 Nulled

root1337
Lurker
Level:
0
Reputation:
0
Posts:
2
Likes:
0
Credits:
2
30-01-2020, 02:18 PM
#6
Thanks for this release Smile I am going to try it out.

RE: Xenforo 2.1.7 Nulled

Azerkiller
Closed Account
Level:
0
Reputation:
0
Posts:
5
Likes:
0
Credits:
5
01-02-2020, 09:41 PM
#7
Thanks for this release Smile I am going to try it out.

RE: Xenforo 2.1.7 Nulled

bartoszewski
Lurker
Level:
0
Reputation:
0
Posts:
3
Likes:
0
Credits:
3
05-02-2020, 12:42 PM
#8
thanks for newest version of xenforo, i will check this thing out

RE: Xenforo 2.1.7 Nulled

rottweiler
Lurker
Level:
0
Reputation:
0
Posts:
3
Likes:
0
Credits:
3
06-02-2020, 01:14 AM
#9
05-02-2020, 12:42 PM
bartoszewski Wrote:
thanks for newest version of xenforo, i will check this thing out
x2

RE: Xenforo 2.1.7 Nulled

flyzz054
Newbie
Level:
0
Reputation:
0
Posts:
16
Likes:
0
Credits:
0
06-02-2020, 02:04 AM
#10
Merci du partage !!! la derniere version fait plaisir

Users browsing this thread: 1 Guest(s)