The issue relates to HTML attribute injection which can be triggered when rendering editor content, such as when a post is edited or quoted.
XenForo extends thanks to @PaulB, the team at @NamePros and @Xon for reporting the issues.
We recommend doing a full upgrade to resolve the issues, but a patch can be applied manually. See below for further details.
Note: There are no other changes in this release and any work previously done towards XenForo 2.2.11 - including a new CAPTCHA option by Cloudflare Turnstile and various bug fixes and improvements - will be released alongside XenForo 2.2.12 in the coming weeks.
Applying a patch manually
If you are using XenForo 2.2.0 - 2.2.5
Download the 220-225patch.zip file attached to this message. It will contain the following file:
If you are using XenForo 2.2.6 or above
Download the 2211patch.zip file attached to this message. It will contain the following file:
Note: If you decide to patch the files instead of doing a full upgrade, your "File health check" will report this file as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.
As always, new releases of XenForo are free to download for all customers with active licenses, who may now grab the new version from the customer area or upgrade from your Admin control panel (Tools > Check for upgrades...).
Directly from your admin control panel
Installation and upgrade instructionsFull details of how to install and upgrade XenForo can be found in the XenForo 2 Manual. We strongly recommend upgrading directly from within your control panel.
Cloud customers have received this patch automatically and does not require an upgrade.
5.2 KB · Views: 128
14 KB · Views: 5
Reactions: xml, kdg411, icecore and 23 others
There is no better platform upon which to grow your community.
Engage your customers with the premium community experience.
- Reaction score
The original version of the download may have excluded some changes from XF 2.2.10 Patch 1.
There is now an alternative manual patch available for customers using versions 2.2.0 - 2.2.5.
Reactions: Masetrix and eL_