Security
- A malicious link no longer runs from the address in a report. The reporting member supplies this address, which is then shown to the moderator: a "javascript:" address ran for them on click. The same guard applies to the links of an RSS feed (widget), a slideshow, the link directory, the partners and any address the site builds: only web, email, phone or site-internal addresses get through.
- Deleting a role, creating the Discord bot key, closing a classified ad or locking a forum topic were done through a simple link: a malicious link was enough to trigger the action for a logged-in administrator, author or moderator. These links now carry a security token.
- The demo locked down. Its shared account (demo / demo) is an administrator: it could turn on debug mode for all visitors, browse and read its files, the error log and phpinfo, see the scheduled task key, change the site settings, create API keys, ban IP addresses or members for good, redirect the PayPal address for donations, and erase images that the reset could not bring back. On a demo, any action toward a locked area is refused before reaching its screen, sensitive screens display a notice, the file manager shows only a sample tree, no file is deleted, and the reset also restores maps and game modes, team roles, notifications, points and permissions.
Fixed
- A file rejected on upload (forbidden extension, or demo) crashed the page (error 500), for example when changing your avatar: the field now says why.
- Statistics over an outsized period (centuries, hour by hour) exhausted the server's memory: the period and the number of points are capped.
- The member export wrote one PHP 8.5 warning per row to the log.
- On the demo, the green banner covered notifications, and the emergency account appeared in a team's player list and in the dashboard activity.
- A thin white line ran along the right edge of the text editor in dark mode (comments, messaging, administration): the editor painted its input area white, and that white overflowed by a fraction of a pixel.