XenForo 2.1.7, the next maintenance release for the XenForo 2.1 series is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo 2.1 upgrade to this release to benefit from increased stability.
Most importantly, this release fixes a security vulnerability in XenForo. Only XenForo 2.1.0 and above are affected.
The issue is a XSS vulnerability. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access.
The vulnerability affects content displayed in the "Approval queue" and requires specially crafted text to be entered into a relevant field for the content type (such as a thread title).
While we recommend doing a full upgrade to resolve this issue, you can also patch the issue yourself with a simple template edit.
For upgrade and patch instructions please visit the release announcement.
If you are already running XenForo 2.1, the easiest way to upgrade is directly from your admin control panel.
Some of the fixes in 2.1.7 include:
Ensure that some jobs do not attempt to complete or otherwise change state inside a transaction.
Ensure correct URL is used in the bookmark label filter when friendly URLs are not enabled.
Display correct username styling when viewing users linked to an IP.
In alerts and the news feed, ensure the "your post" link in the reaction item is clickable.
Format reaction alerts correctly for guests and deleted users.
Ensure login button when viewing a forum as a guest wraps properly.
Only try to hide the global action indicator if it's actually present.
Add additional wording to make it clear that the rejection reason will be shown to users awaiting approval.
Remove hard-coded height from payment inputs.
Display PHP's memory_limit within server environment report.
Update promotion history interface for clarity.
Fix post copier attachment regex.
For more information, including a full list of changes, please see the XenForo 2.1.7 release announcement.
Most importantly, this release fixes a security vulnerability in XenForo. Only XenForo 2.1.0 and above are affected.
The issue is a XSS vulnerability. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access.
The vulnerability affects content displayed in the "Approval queue" and requires specially crafted text to be entered into a relevant field for the content type (such as a thread title).
While we recommend doing a full upgrade to resolve this issue, you can also patch the issue yourself with a simple template edit.
For upgrade and patch instructions please visit the release announcement.
If you are already running XenForo 2.1, the easiest way to upgrade is directly from your admin control panel.
Some of the fixes in 2.1.7 include:
Ensure that some jobs do not attempt to complete or otherwise change state inside a transaction.
Ensure correct URL is used in the bookmark label filter when friendly URLs are not enabled.
Display correct username styling when viewing users linked to an IP.
In alerts and the news feed, ensure the "your post" link in the reaction item is clickable.
Format reaction alerts correctly for guests and deleted users.
Ensure login button when viewing a forum as a guest wraps properly.
Only try to hide the global action indicator if it's actually present.
Add additional wording to make it clear that the rejection reason will be shown to users awaiting approval.
Remove hard-coded height from payment inputs.
Display PHP's memory_limit within server environment report.
Update promotion history interface for clarity.
Fix post copier attachment regex.
For more information, including a full list of changes, please see the XenForo 2.1.7 release announcement.
