Four additional backports
The 14 fixes from 2.3.13 were already covered. These four come from earlier releases, and XenForo's own patch for an old branch does not include them - on 2.3.3 the official patch gives you the 14, and the rest only arrive by upgrading.
- 2.3.5 - OAuth2 scope escalation. Allowed scopes are stored as a plain list, so the lookup compared a string column against integers. MySQL casts every non-numeric scope ID to 0, which matched every scope row, and a client was granted any scope it asked for.
- 2.3.7 - Account page caching. Account pages carry personal data but were served with no cache directive, so a browser or proxy could keep a copy.
- 2.3.9 - BBCode table XSS. The width option of
[TABLE] and [TD] was written into a style attribute unescaped, so a crafted width broke out and injected markup.
- 2.3.10 - HTML placeholder bypass. Placeholder markers were stripped in a single pass, so crafted input could splice leftover bytes back into a fresh placeholder and survive.
That takes the add-on from 14 to 18 issues, and from 10 to 14 class extensions.
New optional manual patch
The download now includes a
manual-patch-2.3.7/ folder covering the one 2.3.7 fix an add-on cannot reach: the template method-call whitelist. The affected code is a static utility method and a class built outside the extension system, so there is nowhere to hook in. The folder has a patch file, hand-edit instructions and a read-only checker that tells you what your install is missing. These are core file edits and are lost on every upgrade, so they are entirely optional.
Upgrading
Upload the contents of
upload/ over your existing files, then run the upgrade from the ACP add-on list (or
php cmd.php xf:addon-upgrade SecurityFixes/XF23). Afterwards
Tools -> Class extensions should show fourteen active entries.
