The most important innovations and improvements

IMPORTANT

The update closes a critical vulnerability in the authentication module. The vulnerability was discovered during an audit on 25.11. and, according to current knowledge, was not actively exploited. Potentially affected by the vulnerability are systems that use the "Internal XELOS Authentication" authentication method and have not activated 2-factor authentication.

Customers with maintenance access were hotfixed directly by a BLUEEND AG technician and the audit log was checked for possible exploits.

It is generally recommended to activate the 2-factor authentication at least for administrative accounts. You can find these settings under "Advanced Configuration" > "Security".

further information:

CMS History: Due to usability and rights issues, this feature is disabled with this update. The function will be completely revised and XELOS 9 will return.

Preparation for a better cron management can now be selected "on_demand" for Interval, but this feature is currently ONLYavailable for "Updates instances"and the systemwhen new languages are added".

If the interval of the cron is set to "on_demand", the corresponding module manages the start of the cron. This interval should not be set manually in the crons, because they will not be executed anymore.

There is now the addition "Allow modification during approval process:" to the option "Approve created groups:". If this option is set, the user cannot make any changes to the group while the group is not yet approved.

Fixed bugs and new features

• CMS
  • XC-2231 Footer now shows the last date of editing instead of the creation date
  • XC-2228 Group can be permanently deleted

• Event Planner
  • XC-2158 Notification now also for external users
  • XC-2242 image in detail view is now displayed correctly
  • XC-1850 Commit button is now updated after a "click
  • XC-2244 If you confirm via e-mail link, questions can now also be answered
  • XC-2300 Incorrect e-mail specification is filtered

• Forum
  • Positioning of the category description was adjusted

• Groups
  • XC-2259 Multiple group selection fixed
  • XC-2038 Deactivated users are now removed from the invitation list
  • XC-1564 User names are now displayed again for group notifications

• Framework
  • XC-2157 Encoding problem with preview option fixed
  • XC-2273 Admin can edit and delete comments again

weitere Fixes: 2190,2112,1572,2165,2245,2265,2205,2075,2207,2220,2251,2211