- Additional Requirements
- PHP 7.2 or newer (PHP 8.2 recommended)
MySQL 5.5 and newer (Also compatible with MariaDB/Percona etc.)
All of the official add-ons require XenForo 2.2.
Enhanced Search requires at least Elasticsearch 2.0.
- Visible Branding
- Yes
XenForo 2.2.16 Released
XenForo 2.2.16 is now available for all licensed customers to download. We strongly recommend that all customers running previous versions of XenForo 2.2 upgrade to this release to benefit from increased stability.Some of the changes in XF 2.2.16 include:
- Fix some issues with xf-dev:class-use-function to better support classes with class attributes and comments, or existing use function declarations.
- Fix persistent action indicator when using back/forward navigation
- Add _deleteFromSource method to support performing tasks right before entity deletion
- Skip logging IPs when updating avatars during registration
- Fix docblock return hint for \XF\Util\Ip::checkIpsAgainstBinaryRangeList
- Add missing security locked phrase
- Expose additional parameters to the reported_thread_title phrase
- Ensure sticky threads are passed to the fetchExtraContentForThreadsFullView method
- Adjust the phrasing of mail encryption options
- Update purchase requests on user merge
- Set aria-label for tooltips with no children
- Skip processing email bounces and unsubscribes when email has been disabled in config.php
- Gracefully handle errors when editing bookmarks
- Clean up temp files after job completion
- Add proper ordering to the shared IPs tab
- Add an index hint to the newest members widget
- Avoid generating invalid SQL with XF\Db\Schema\Column::values()
- Prevent disabled accounts from using the admin control panel
- Include a plain confirmation URL in the email sent to users awaiting email confirmation
Security Fix
Today we are advising all customers running XenForo that a potential security vulnerability has been identified. All affected customers should either upgrade to XenForo 2.1.15 or XenForo 2.2.16.The issue relates to a potential cross-site request forgery and code injection vulnerability which could lead to a remote code execution (RCE) or cross-site scripting (XSS) exploit.
XenForo extends thanks to independent security researcher, Egidio Romano (EgiX), working with SSD Secure Disclosure.
We recommend doing a full upgrade to resolve the issue.