Overview Version (0) Discussion (1) License

• 

  XenForo 2.3.9 Released (Security Fix) patch

  This version only includes security fixes and any bug fixes we previously said would make it to 2.3.

  xenforo

  xenforo 2.3.9

  patch
  About this resource

  The following public templates have had changes:
  

  • attachment_macros
  • bb_code_tag_attach
  • lightbox_macros

  Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.
  
  The issues identified are as follows:
  

  • Prevention of a possible stored XSS (cross-site scripting) exploit related to BB code rendering (thank you to Antisocial)
  • Prevention of a possible XSS exploit related to lightbox usage in posts (thank you UwU)
  • Prevention of a possible RCE (remote code execution) exploit via authenticated, but malicious, admin users (thank you UwU)

  We recommend doing a full upgrade to resolve the issue, but a patch can be applied manually. See below for further details.
  

  Upload patch files

  • Download 239-patch.zip
  • Extract the .zip file
  • Upload the contents of the upload directory to the root of your XenForo installation
  • Rebuild master data by logging in to your install URL, or running xf:rebuild-master-data on the command line

  Note: If you decide to patch the files instead of doing full upgrades, your "File health check" will report these files as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.
• Version

  There are no downloadable versions available for this resource yet.
• Discussion

  This resource has a discussion thread on the forum where you can ask questions, report issues, and talk with the author and other users.

  Join the discussion (1)

• License Terms
  
  By purchasing this resource, you are granted a license to use it on one (1) site, for as long as your license remains valid. You are not purchasing ownership of the underlying code.
  
  How your license works
  

  • Your license is checked automatically in the background. This never affects your site's visitors.
  • As long as your license is valid, this resource keeps working normally — even if our license server is briefly unreachable, a temporary network issue will never disable it.
  • Your license is bound to your site's domain the first time it's used.

  
  Moving to a new domain?
  Contact us and we'll move your license for you.
  
  What's included
  Updates and support for the period stated on this resource's page (see the Version tab for the current release).
  
  What's not allowed
  

  • Sharing your license with others, or using it on more than one site at a time
  • Removing or bypassing the license check in the code