Announcements

We have recently become aware of a security issue relating to a third-party library included with XenForo Media Gallery and have released a patch to resolve this issue. The issue is a cross site scripting (XSS) flaw that could allow an attacker to steal cookies or force a user to take actions without their consent or knowledge (possibly including administrative actions). We recommend all XenForo Media Gallery customers use one of the methods described below to resolve this issue and improve their security.If you have any questions regarding this patch, please post in the Media Gallery Support forum.Method 1: Install the PatchDownload the patch zip file attached to the end of this message. It contains 3 files...

XenForo Media Gallery 1.0.1 is the first maintenance release for our media gallery add-on. We recommend all customers running XenForo Media Gallery upgrade to benefit from increased stability.In addition to bug fixes, this release adds some small improvements:Media and albums can now be sorted by a weighted average (like XenForo Resource Manager). The weighted average is rebuilt during upgrade It is now possible to show a new/random media block in the sidebar simply by enabling it in Admin CP > Applications > Gallery Options > Blocks Options If the content tag cloud is disabled, the ability to search tags from the sidebar is still available It is now possible to report albums New permission to control the hard deletion of comments...

Today, we are pleased to release XenForo 1.4.3. This release fixes a number of bugs and issues that were found since the release of 1.4.2. As this is a maintenance release, the vast majority of the focus was an increase in stability.This release also adds an importer for SMF 2.0. As this is an initial release, changes may need to be made to deal with the various types of data in the wild. If you have SMF 2.0 data you'd like to bring into XenForo, please try the importer and let us know how it goes.Some of the bugs fixed in 1.4.3 include:Don't show contact details custom fields in the message template when privacy checks are applied Prevent malformed BB code from being used to potentially bypass certain signature tag limits Update...

XenForo Resource Manager 1.1.5 is a maintenance release for our resource manager add-on. We recommend all customers running XenForo Resource Manager 1.1 upgrade to 1.1.5 to benefit from increased stability.In addition to bug fixes, this release adds some small improvements:Resource prefixes can now be bulk edited via inline moderation Resources can now be edited using inline moderation in search results (requires XF 1.4)This release fixes several bugs that were reported following the release of XenForo Resource Manager 1.1.4:Resource count not calculated correctly when filtering to a prefix External purchase URLs now respect the download permission (consistent with other types) Flood check triggered incorrectly when editing a...

Today, we are delighted to announce that the Xen Media Gallery add-on by @@Chris D is joining the official XenForo product line. The newly-named XenForoMedia Gallery will sit alongside the XenForo Resource Manager and XenForo Enhanced Search add-ons and will be maintained, updated and supported by the XenForo team. Furthermore, the developer of XMG, @@Chris D will be joining the XenForo development team to help us develop XenForo and our official add-ons. Please join us in welcoming Chris!XenForo Media Gallery licenses will be managed in the same way as XenForo Resource Manager and XenForo Enhanced Search licenses. They will be attached to a specific XenForo license and support/update extensions will be tied into that license...

Today, we are pleased to release XenForo 1.4.2. This release fixes a number of bugs and issues that were found since the release of 1.4.0. As this is a maintenance release, the vast majority of the focus was an increase in stability.However, there have been several minor improvements:The IP of the user submitting a "Contact Us" form is now displayed in the email sent to the forum contact. The "Contact Us" form can use the 1.3-style method of headers with the "Sender info in From header on contact emails" option. This can be useful when sending contact emails to a Gmail account which may not always respect the Reply-To header as expected. Added support for Google's new Search Sitelinks mark up. When a user has received warnings...

A cross site request forgery (CSRF) issue has been identified in the SWFUpload library that XenForo uses. This issue may allow an attacker to make requests and carry out actions as you or one of your members.This issue affects all versions of XenForo available prior to this announcement. We recommend all customers take steps to apply a fix as soon as possible. If you have any questions about applying a fix, please post in the appropriate forum or submit a ticket.Applying a Fix: Upgrading XenForo versions 1.2.7, 1.3.6 and 1.4.1 include a fix for this issue. To apply the fix, you may upgrade in the standard way to the appropriate version:Customers running 1.2 or earlier should upgrade to 1.2.7, 1.3.6 or 1.4.1. Customers running 1.3...