رفع مشکل امنیتی
امروز به همه مشتریانی که XenForo را اجرا می کنند توصیه می کنیم که یک آسیب پذیری امنیتی بالقوه شناسایی شده است. همه مشتریان آسیب دیده که XenForo 2.3.0 را اجرا می کنند، باید به XenForo 2.3.0 Release Candidate 1، از جمله XenForo Media Gallery 2.3.0 Release Candidate 1 در صورت نیاز، ارتقا دهند.اگر شما نیز نصب فعال XenForo 2.2 یا XenForo 2.1 دارید، باید به تاپیک قبلی با جزئیات و پچ مراجعه کنید.
این مشکل به جعل درخواست بین سایتی و آسیب پذیری تزریق کد مربوط می شود که می تواند منجر به اجرای کد از راه دور (RCE) یا اسکریپت بین سایتی (XSS) شود.
XenForo به لطف محقق امنیتی مستقل، Egidio Romano (EgiX) که با SSD Secure Disclosure کار می کند، گسترش می یابد .
توصیه می کنیم برای حل این مشکل یک ارتقاء کامل انجام دهید.
XenForo & Add-ons 2.3.0 Release Candidate 1 منتشر شد
بالاخره اینجا رسید، اولین مورد از سری نامزدهای انتشار برای نسخه پایدار XenForo 2.3.0. ما هنوز کمی کار بیشتری برای انجام داریم و تغییرات و پیشرفت‌های دیگری در خط لوله داریم، اما در این مرحله جدی‌ترین اشکالات برطرف شده‌اند و قبل از اینکه بتوانیم اعلام کنیم برای انتشار پایدار آماده است، انتظار انتشار بیشتری نداریم.ما قویاً توصیه می‌کنیم هر کسی که نسخه 2.3 را در طول این ارتقاء دوره قبل از انتشار آزمایش کند، زیرا هر نسخه پیش از انتشار منتشر می‌شود.
جزئیات بیشتر در مورد اشکالات رفع شده در این نسخه را می توان در انجمن اشکالات حل شده یافت .
این نرم افزار پیش از انتشار است. به طور رسمی پشتیبانی نمی شود.
ما اجرای آن را در تولید توصیه نمی کنیم.
لطفا به یاد داشته باشید که این نرم افزار پیش از انتشار است . این شامل اشکالات شناخته شده و عملکرد ناقص است. ما اجرای نرم افزار پیش از انتشار را در یک محیط تولیدی توصیه نمی کنیم و پشتیبانی در حال حاضر محدود به سؤالات اینجا در انجمن های انجمن است.
افزونه ها و سبک های سفارشی ممکن است پس از ارتقاء به 2.3 شکسته شوند. باید افزونه های خود را به طور کامل آزمایش کنید یا به دنبال به روز رسانی باشید. به ویژه در مورد افزونه هایی که ویژگی های مشابه موارد اضافه شده به 2.3 را پوشش می دهند، مراقب باشید. اینها ممکن است با داده های اصلی XenForo در تضاد باشند. اگر تداخل داده‌ها پیدا شد، باید در یک نسخه افزودنی جدید یا با حذف افزونه قبل از ارتقا به 2.3 حل شود .
اگر تصمیم به اجرای نرم افزار پیش از انتشار دارید، این مسئولیت شماست که از تهیه نسخه پشتیبان از اطلاعات خود اطمینان حاصل کنید . توصیه می کنیم این کار را قبل از اقدام به ارتقا انجام دهید. اگر شک دارید، همیشه نسخه‌ای از داده‌های تولید خود را به‌روزرسانی آزمایشی انجام دهید.
همه مشتریان دارای مجوز فعال اکنون می توانند نسخه جدید را از منطقه مشتری دانلود کنند.
XenForo 2.3.0 Release Candidate 1
از منطقه
در کنار انتشار XenForo 2.3.0 Release Candidate 1، ما همچنین نسخه های به روز شده هر یک از افزونه های رسمی خود را منتشر می کنیم:
- XenForo Media Gallery 2.3.0 Release Candidate 1 (شامل رفع امنیتی)
- XenForo Resource Manager 2.3.0 Release Candidate 1
- XenForo Enhanced Search 2.3.0 Release Candidate 1
افزونه های
از منطقه
الزامات
موارد زیر حداقل الزامات هستند:- PHP 7.2 یا جدیدتر
- MySQL 5.7 و جدیدتر
- همه افزونه های ذکر شده در اینجا به XenForo 2.3 نیاز دارند.
- جستجوی پیشرفته حداقل به Elasticsearch 7.2 نیاز دارد
دستورالعمل نصب و ارتقا
جزئیات کامل نحوه نصب و ارتقاء XenForo را می توانید در کتابچه راهنمای XenForo بیابید . ارتقا با یک کلیک از XF 2.2 امکان پذیر است، اما باید تیک گزینه «فقط بررسی برای ارتقای پایدار» را در گزینه ها > اطلاعات پایه پایه بردارید. پس از تکمیل ارتقاء XF 2.3، افزونه های رسمی نیز باید ارتقا داده شوند.لطفا به یاد داشته باشید که این نرم افزار پیش از انتشار است . این شامل اشکالات شناخته شده و عملکرد ناقص است. ما اجرای نرم افزار پیش از انتشار را در محیط تولید توصیه نمی کنیم یا پشتیبانی نمی کنیم. پشتیبانی از پیش‌انتشارها به سؤالات اینجا در انجمن‌های انجمن محدود می‌شود.
Security Fix
Today we are advising all customers running XenForo that a potential security vulnerability has been identified. All affected customers running XenForo 2.3.0 should upgrade to XenForo 2.3.0 Release Candidate 1, including XenForo Media Gallery 2.3.0 Release Candidate 1 if needed.
If you also have active installs of XenForo 2.2 or XenForo 2.1 you should refer to the earlier thread with details and patch.
The issue relates to a potential cross-site request forgery and code injection vulnerability which could lead to a remote code execution (RCE) or cross-site scripting (XSS) exploit.
XenForo extends thanks to independent security researcher, Egidio Romano (EgiX), working with SSD Secure Disclosure.
We recommend doing a full upgrade to resolve the issue.
XenForo & Add-ons 2.3.0 Release Candidate 1 Released
It's finally here, the first of a series of release candidates for the XenForo 2.3.0 stable release. We still have a bit more work to do and other changes and improvements in the pipeline but at this point the most serious bugs have been tackled and we don't expect many more releases before we can declare it is ready for a stable release.
We strongly recommend anyone testing 2.3 during this pre-release period upgrade as each pre-release version is released.
More specific details regarding bugs fixed in this release can be found in the resolved bugs forum.
This is pre-release software. It is not officially supported.
We do not recommend running it in production.
Please remember that this is pre-release software. It contains known bugs and incomplete functionality. We do not recommend running pre-release software in a production environment, and support is limited at this time to questions here on the community forums.
Add-ons and custom styles may be broken after upgrading to 2.3. You must test your add-ons thoroughly or look for updates. Be especially careful with add-ons that cover similar features to ones that are added to 2.3; these may conflict with the core XenForo data. If data conflicts are found, they will need to be resolved in a new add-on release or by removing the add-on before upgrading to 2.3.
If you choose to run pre-release software, it is your responsibility to ensure that you make a backup of your data. We recommend you do this before attempting an upgrade. If in doubt, always do a test upgrade on a copy of your production data.
All customers with active licenses may now download the new version from the customer area.
Download XenForo 2.3.0 Release Candidate 1
From the licensed customer area
Alongside the release of XenForo 2.3.0 Release Candidate 1, we are also releasing updated versions of each of our official add-ons:
XenForo Media Gallery 2.3.0 Release Candidate 1 (Includes Security Fix)
XenForo Resource Manager 2.3.0 Release Candidate 1
XenForo Enhanced Search 2.3.0 Release Candidate 1
Customers with active licenses for these add-ons may download the new versions from their customer area.
Download official add-ons
From the licensed customer area
Requirements
The following are minimum requirements:
PHP 7.2 or newer
MySQL 5.7 and newer
All of the add-ons listed here require XenForo 2.3.
Enhanced Search requires at least Elasticsearch 7.2
Note: Only the PHP version requirements have changed here. However, even if you're running PHP 7.2 we strongly recommend upgrading to PHP 8.3 at the earliest opportunity for improvements in speed, security and stability. We also recommend MySQL 8.0 (or equivalent).
Installation and upgrade instructions
Full details for how to install and upgrade XenForo can be found in the XenForo manual. One-click upgrades from XF 2.2 are possible, but you must uncheck the "Only check for stable upgrades" option in Options > Basic board information. Once the XF 2.3 upgrade has been complete, the official add-ons should be upgraded as well.
Please remember that this is pre-release software. It contains known bugs and incomplete functionality. We do not recommend or support running pre-release software in a production environment. Support for pre-releases are limited to questions here on the community forums.
Today we are advising all customers running XenForo that a potential security vulnerability has been identified. All affected customers running XenForo 2.3.0 should upgrade to XenForo 2.3.0 Release Candidate 1, including XenForo Media Gallery 2.3.0 Release Candidate 1 if needed.
If you also have active installs of XenForo 2.2 or XenForo 2.1 you should refer to the earlier thread with details and patch.
The issue relates to a potential cross-site request forgery and code injection vulnerability which could lead to a remote code execution (RCE) or cross-site scripting (XSS) exploit.
XenForo extends thanks to independent security researcher, Egidio Romano (EgiX), working with SSD Secure Disclosure.
We recommend doing a full upgrade to resolve the issue.
XenForo & Add-ons 2.3.0 Release Candidate 1 Released
It's finally here, the first of a series of release candidates for the XenForo 2.3.0 stable release. We still have a bit more work to do and other changes and improvements in the pipeline but at this point the most serious bugs have been tackled and we don't expect many more releases before we can declare it is ready for a stable release.
We strongly recommend anyone testing 2.3 during this pre-release period upgrade as each pre-release version is released.
More specific details regarding bugs fixed in this release can be found in the resolved bugs forum.
This is pre-release software. It is not officially supported.
We do not recommend running it in production.
Please remember that this is pre-release software. It contains known bugs and incomplete functionality. We do not recommend running pre-release software in a production environment, and support is limited at this time to questions here on the community forums.
Add-ons and custom styles may be broken after upgrading to 2.3. You must test your add-ons thoroughly or look for updates. Be especially careful with add-ons that cover similar features to ones that are added to 2.3; these may conflict with the core XenForo data. If data conflicts are found, they will need to be resolved in a new add-on release or by removing the add-on before upgrading to 2.3.
If you choose to run pre-release software, it is your responsibility to ensure that you make a backup of your data. We recommend you do this before attempting an upgrade. If in doubt, always do a test upgrade on a copy of your production data.
All customers with active licenses may now download the new version from the customer area.
Download XenForo 2.3.0 Release Candidate 1
From the licensed customer area
Alongside the release of XenForo 2.3.0 Release Candidate 1, we are also releasing updated versions of each of our official add-ons:
XenForo Media Gallery 2.3.0 Release Candidate 1 (Includes Security Fix)
XenForo Resource Manager 2.3.0 Release Candidate 1
XenForo Enhanced Search 2.3.0 Release Candidate 1
Customers with active licenses for these add-ons may download the new versions from their customer area.
Download official add-ons
From the licensed customer area
Requirements
The following are minimum requirements:
PHP 7.2 or newer
MySQL 5.7 and newer
All of the add-ons listed here require XenForo 2.3.
Enhanced Search requires at least Elasticsearch 7.2
Note: Only the PHP version requirements have changed here. However, even if you're running PHP 7.2 we strongly recommend upgrading to PHP 8.3 at the earliest opportunity for improvements in speed, security and stability. We also recommend MySQL 8.0 (or equivalent).
Installation and upgrade instructions
Full details for how to install and upgrade XenForo can be found in the XenForo manual. One-click upgrades from XF 2.2 are possible, but you must uncheck the "Only check for stable upgrades" option in Options > Basic board information. Once the XF 2.3 upgrade has been complete, the official add-ons should be upgraded as well.
Please remember that this is pre-release software. It contains known bugs and incomplete functionality. We do not recommend or support running pre-release software in a production environment. Support for pre-releases are limited to questions here on the community forums.
