Hébergement Vanilla Forums

2.5.1
 (version majeure) (version de sécurité)
17 Février - 30MB2.5.1



Security

Fix profile controller permission checks to block user content from guests.

Fix XSS issue in Flagging addon.



Highlights

Add support for 'rel' attribute to YouTube embeds.

Add profile extender fields into controller data for use by addons.

Add a note about MySQL strict mode to the README.

Update the dashboard version check to seek PHP 7.0.



Bug Fixes

Fix category permission check when using the comments API endpoint (overly aggressive, not leaking data).

Fix .htaccess to work correctly with subdirectories.

Fix broken link text in posts when using "Warn When Leaving" security setting with Wysiwyg formatting.

Disable FloodControl checks when saving the activity notification queue to fix blocked notifications.

Fix analytics tick redirecting to sign-in when Private Community is enabled.

Fix missing Vanilla logo on install screen.



2.5



Highlights

Dashboard fully redesigned.

Full, native API support.

Flat categories - a Vanilla-only innovation.

Enhanced security features, including a dedicated Dashboard area.

All-new category management page.

Full IPv6 support.

Twitter card support.

OAuth 2.0 support.

Apple touch icon support (in core).

Hundreds of translation improvements.

Hundreds of bug fixes.

Tagging core support for developers.

JSON-based addon definitions that allow priority setting & better dependency controls.

Better category scaling and advanced developer features.

Improved logging and debugging features.

Lire la suite: https://open.vanillaforums.com/discussion/35925/vanilla-2-5-1-now-available-security-update






2.3.1
 (version de sécurité)
14 Mai 2017 - 14MBWhat's New

A critical upgrade to the PHPMailer library to prevent remote code execution.

Mitigation of a medium-level exploit of the HTTP_HOST header.

Additional minor fixes.

Lire la suite: http://open.vanillaforums.com/discussion/33498/critical-security-release-vanilla-2-3-1






2.3
 (version majeure)
15 Mars 2017 - 14MBWhat's New

Vanilla 2.3 requires PHP 5.4 which is a change from earlier versions.

Lire la suite: http://open.vanillaforums.com/discussion/32822/vanilla-2-3-is-now-available






2.2.1
 (version de sécurité)
10 Mai 2016 - 14MBWhat's New

Sets email default to text. This is future-proofing for HTML emails being added in 2.3.
Fix RSS feed when using table layout (thanks to korelstar).
Fix breadcrumbs when Vanilla is installed in a sub-directory (thanks to korelstar).
Fix translation bug in Captcha.
Fix where an error could be thrown on certain 404 pages.
Fix redirect after deleting an activity.


Security Patches

Upgrade htmLawed library to 1.1.21 (security fix). Thanks to psych0tr1a for responsibly disclosing this.
Fix condition where a filename could be echoed back to user (unsanitized output).

Lire la suite: http://vanillaforums.org/discussion/32109/vanilla-2-2-1-now-available



Afficher plus de versions




2.2
 (version majeure) (version de sécurité)
17 Novembre 2015 - 14MBWhat's New

Add Advanced Editor (HTML5 full drag-and-drop WYSIWYG).
Remove cleditor (not secure).
Add Emoji and an Emoji Extender addon to create your own sets.
Add Google+ SSO.
Add Section 508 support (accessibility improvements).
Add support for controllers in plugins.
Add spam checking & more flood control in Conversations.
Upgrade PHP Markdown and split out Vanilla Markdown customizations.
Add the Garden.Community.Manage permission for community managers.
Allow Unicode in mentions and usernames.
Allow using utf8mb4 databases (to allow Unicode emoji characters).
Added support for Twitch.tv, Hitbox.tv, and SoundCloud.
Add new social icons.
Add new class to handle event logging.


Security Patches

Fix issues with fetchPageInfo() implementation.
Implement public stashes.
Protect transient key from JSONP.
Protect transient key on profile pages.
Don't allow SSO with empty secrets.
Remove htmlEntityDecode() endpoint.
Improve addon testing / enabling / disabling security.
Add validation to .org feed pulling.
Protect discussions from unauthorized split/merge.
Add output filtering to a few places.

Lire la suite: http://vanillaforums.org/discussion/31121/vanilla-is-proud-to-present-version-2-2