XenForo.com XenForo 2.1.14 Released (Security Fix)

[Ozzy47]

• Official forums
• Announcements

• Thread starter XenForo
• Start date Yesterday at 12:10 PM

Note: This version supersedes the previously released XenForo 2.1.13.

Today, we are releasing XenForo 2.1.14 to address a potential security vulnerability. We recommend that all customers still running XenForo 2.1 upgrade to 2.1.14 or use the attached patch file as soon as possible.

The issue relates to HTML attribute injection which can be triggered when rendering editor content, such as when a post is edited or quoted.

XenForo extends thanks to @PaulB, the team at @NamePros and @Xon for reporting the issues.

We recommend doing a full upgrade to resolve the issues, but a patch can be applied manually. See below for further details.

Applying a patch manually​

Download the 2114patch.zip file attached to this message. It will contain the following files:

1. src/XF/BbCode/Renderer/Html.php
2. src/XF/BbCode/Renderer/EditorHtml.php

Extract the zip file to your computer and upload the contents to the root of your XenForo installation. This should overwrite the files on your server with the new version.

Note: If you decide to patch the files instead of doing a full upgrade, your "File health check" will report this file as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.

As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area or upgrade from your Admin control panel (Tools > Check for upgrades...).

Directly from your admin control panel

Installation and upgrade instructions​

Full details of how to install and upgrade XenForo can be found in the XenForo 2 Manual. We strongly recommend upgrading directly from within your control panel.

Attachments​

• 2114patch.zip
  12.1 KB · Views: 3

Last edited: Today at 2:47 PM
Reactions: thedude, Dkf, Neal and 2 others
Written by
Company info
There is no better platform upon which to grow your community.

Engage your customers with the premium community experience.
Staff member

• Messages
  656
• Reaction score
  23,277
• Points
  503

If you have already downloaded XenForo 2.1.13 this will have introduced an issue whereby the [COLOR] tag will no longer work as expected when switching to/from the BB code editor.

We have updated the existing download to include a fix for this and updated the manual patch in the original post.
Reactions: [email protected], flowman and eL_
Due to a mistake made during the build process, rolling out the aforementioned fix for the [COLOR] tag, we inadvertently increased the version number to XenForo 2.1.14.

XenForo 2.1.14 now supersedes version 2.1.13 which is no longer available for download.

If you are using XenForo 2.1.13 we recommend upgrading to XenForo 2.1.14 to ensure you have the [COLOR] tag fix. If you already downloaded XenForo 2.1.13 and your admin control panel now lists the version as 2.1.14, you do not need to take any further action.
Reactions: t0fx

Continue reading...