XenForo 2.1.10 Nulled

Released XF 2.x XenForo 2.1.10 Nulled 2.1.10 Patch 2

Compatible With XenForo
PHP Compatible
Visible Branding
XenForo 2.1.10 Patch 2 Released (Includes Security Fix)

XenForo 2.1.10 is now available for all licensed customers to download. We recommend that all customers running previous versions of XenForo 2.1 upgrade to this release to benefit from increased stability.

Most importantly, this release fixes a security vulnerability in XenForo.

The issue is a XSS vulnerability. XSS (Cross Site Scripting) issues allow scripts and malicious HTML to be injected into the page, potentially allowing data theft or unauthenticated access. The vulnerability requires some very specific steps to be taken, involving pasting malicious content into the XenForo rich text editor, which may mean it is difficult to trigger. XenForo extends thanks to @TickTackk for reporting the issue.

While we recommend doing a full upgrade to resolve this issue, you can also patch the issue yourself with the attached file.

To patch your existing installation, please follow these steps:
  1. Download the patch files which are contained in a file called 2110patch.zip
  2. Extract the zip file to your computer, which should contain the following files:
    1. upload/js/xf/editor.js
    2. upload/js/xf/editor.min.js
    3. upload/js/xf/editor-compiled.js
  3. Upload the contents of the upload directory to the root of your XF installation.
  4. This will overwrite the following files:
    1. js/xf/editor.js
    2. js/xf/editor.min.js
    3. js/xf/editor-compiled.js
Note: If you decide to patch the files instead of doing a full upgrade, your "File health check" will report these three files as having "Unexpected contents". Because these files no longer contain the same contents your version of XF was shipped with, this is expected and can be safely ignored.

For instructions on how to resolve the issue by upgrading, and to see what else has changed in XenForo 2.1.10, please read on.

The following public templates have had changes:
  • _help_page_bb_codes
  • app_body.less
  • bb_code_tag_attach
  • code_editor
  • conversation_list
  • core_datalist.less
  • core_input.less
  • core_menu.less
  • core_overlay.less
  • editor.less
  • editor_base.less
  • editor_dialog_media
  • forum_post_quick_thread
  • forum_post_thread
  • forum_post_thread_chooser
  • forum_view
  • lightbox.less
  • lost_password_confirm
  • payment_cancel_recurring_confirm
  • payment_initiate.less
  • quick_reply_macros
  • share_page_macros
  • thread_reply
  • thread_view
  • widget_html
Where necessary, the merge system within the "outdated templates" page should be used to integrate these changes.
Report Edit IP
  • Like
Reactions: triniplug
First release
Last update
0.00 star(s) 0 ratings

More resources from ScriptsNulled.to