A perfect example of Flarum's customizability. This highly customised Dutch developer community has a unique layout, with beautiful elements like a custom loader. Created by the author of the popular SEO and Support Platform extensions.
As a leading British telephone network, giffgaff serves millions of customers. Through innovative use of Flarum, they've built up a passionate peer support community, improving support and engaging customers.
An avid adventurer and hiker, Mike has found Flarum to be an excellent platform for blogging about his trips, discussing gear, and meeting fellow hiking enthusiasts while slowly increasing engagement.
migrate command into assets:publish.Before starting the upgrade process, ensure you are on 0.1.0-beta.16 in your Admin Dashboard or by typingBefore you run the upgrade, make sure to create a backup of yourpublic/assetsdirectory, yourcomposer.jsonand your database!
php flarum info, use the previous release notes for upgrading from an earlier version.If you run into any issues, please open a new discussion under the Support tag. Ignore similar discussions, and open a new one anyhow. Make sure to mention the output ofphp flarum info,composer why-not flarum/core v1.0.0and any errors in their fullest.
# Update to latest version
composer update --prefer-dist --no-dev -a -W
# Verify that you're on v1.0.2
composer show flarum/core
# Clear cache
php flarum cache:clear#devs-security channel at 23:05 UTC (3 mins after discovery). The vulnerability's CVE score was 10.0, which is the highest CVE score possible.<script>alert('test')</script> resulted in an alert box appearing on the forum. This attack could also be modified to perform AJAX requests on behalf of a user, possibly deleting discussions, modifying their settings or profile, or even modifying settings on the Admin panel if the attack was targeted towards a privileged user.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, resulting in a CVE score of 10, the highest possible. See the CVSS score breakdown.CVE-2021-32671) that will be published on the official CVE list at mitre.org: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32671Attack complexity: low
The attack can be performed relatively simply and affected all forums, despite their individual configurations. It is repeatable under all conditions.
User interaction: none
The example that led to the discovery of this vulnerability does require user interaction: a malicious link must be clicked and then the search box must be entered. However, we believe there is a high chance that it may be possible to perform an attack due to this vulnerability without any user interaction
Scope: changed
The vulnerable component is the Flarum forum. The impacted component is the user's browser, therefore the scope has changed.
Confidentiality impact: high
An impacted user's details could be fully retrieved by the attacker via a malicious AJAX request.
Integrity impact: high
An impacted user's details could be changed by the attacker via a malicious AJAX request.
Availability impact: high
If a forum administrator was impacted, a malicious AJAX request could modify forum settings on the Admin dashboard and result in a full forum denial of service. This could be by injecting broken Javascript code into the custom header resulting in a broken forum frontend.
440bed8A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [email protected], and we will address it promptly.
You can find our full security policy on GitHub.
# Update to latest version
composer update --prefer-dist --no-dev -a -W
# Verify that you're on v1.0.2
composer show flarum/core
# Clear cache
php flarum cache:clearcomposer create-project flarum/flarum) will automatically install these patch releases.composer update --prefer-dist --no-dev -a
php flarum cache:clearphp flarum --versionThanks to the amazing bug reporters and especially likuilin and @DursunCan for filing great reports on GitHub.
Thanks to the superstar people doing QA for these patches @Ralkage and @datitisev.
Thanks to the wonderful people providing the patches @SychO, @davwheat and @luceos.
Please use this discussion only for feedback and comments, not support. Support questions should be raised in their own discussion. We will not sticky this release because it contains only patches.
It does not matter how slowly you go so long as you do not stop. --Confucius
extend.php (flarum/core#2134)array_get, are no longer available. Also, theApplication has been decoupled from the IoC container and Laravel's Application contract flarum/core#2243config.php contents) has been moved to the resolvable Config class. (flarum/core#2271)Please also read about ourflarum/coreversion constraint recommendation to stable.
Before you run the upgrade, make sure to create a backup of yourpublic/assetsdirectory, yourcomposer.jsonand your database!
Step 1: Ensure you are on version 0.1.0-beta.13 in your Admin Dashboard or by running php flarum info (use the previous release notes for upgrading from an earlier version)
Step 2: Uninstall every 3rd party extension that isn't compatible with beta 14 yet. Most extensions are no longer compatible! You can check which extensions are compatible at Extiverse (it needs up to one hour after release to display compatible extensions).
Step 3: Disable the remaining extensions. Re-enabling them one at a time after you update will make it easier to debug if any issues occur.
Step 4: Run the following commands:
composer remove --no-update flarum/auth-facebook flarum/auth-github flarum/auth-twittercomposer update --no-install --with-all-dependenciescomposer require --no-update fof/oauthcomposer install --prefer-dist --no-dev -aphp flarum migrate
php flarum cache:clearphp flarum info. Please also include the output of composer why-not flarum/core v0.1.0-beta.14Learn how to harness the extensibility of Flarum to create your own extensions and customize your community.
Help us make Flarum even more powerful and customizable! Every bug report, pull request, and documentation improvement is a huge help.
Have you ever changed tires with a spoon? Using the right tools for the job is key to success. We thank our technology partners for their generous product donations!
