Skip to content

v2.6.2 — private groups stay private, and pages load far less

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Oct 17:16
· 56 commits to main since this release
v2.6.2
b22c741

Private groups stay private, and pages load far less

Security update — please update.

  • Any member could use link previews to read pages that are only reachable from the forum's own server or its private network.
  • A member of a private group could share its threads into a public group, showing the private group's name, the author and the opening lines of the post to everyone there, guests included.
  • A group creator could store page styling instead of a colour, changing how the page looked around that group's badges for every viewer.
  • Any group moderator could undo the creator's ban by inviting the removed member back.
  • A member removed from a private group could still read its posts.

Fixed

  • Link previews only fetch ordinary public web pages. Addresses that lead back to the server or a private network are refused however they are written, only ports 80 and 443 are used, a slow site gives up after 5 seconds, and each member gets at most 20 new previews a minute.
  • Threads in a private group cannot be shared outside it, and the Share option is not offered there. Shares made earlier no longer show the private group's details to people who cannot see that group. They keep the "Shared: …" title they were created with.
  • A group colour must be a hex colour such as #4A90E2. Anything else already stored is treated as no colour, with nothing to run.
  • Removed members cannot read a private group's posts any more.
  • Comments in the feed show their text safely when a post has no formatted version.
  • Group pages and their styles load only on the groups pages. Every visitor used to download them on every page: forum.js 137 → 25 KB (30.8 → 6.7 KB compressed), and Social Groups' share of forum.css 65.5 → 3.6 KB.
  • Group pages no longer clash with other extensions that load parts on demand.

Changed

  • Only the group's creator (or a forum admin) can invite back someone who was removed. Other moderators get a message saying so.
  • Link previews of pages on unusual ports no longer work.
composer update ernestdefoe/social-groups
php flarum cache:clear
Assets 2
Loading