With WoltLab Suite 6.0, we have implemented several security measures aimed at making the software itself more robust and preventing certain attack scenarios in advance. Of particular importance is the use of the “intl” library’s “SpoofChecker” when validating usernames to protect against homographic attacks. This prevents the mixing of character sets from different languages, which is used to create usernames that look confusingly similar to existing usernames. In addition, we added additional HTTP headers in the admin panel to prevent an attack on administrators using externally embedded sources, and we also suppress the transmission of the referrer when following links to prevent the unintentional disclosure of confidential URLs.
Less visible security measures include forcing encrypted connections when retrieving package server data to ensure the confidentiality and integrity of transmitted data. The package system now features an “audit log” in which all changes made to the system by packages are logged and thus remain traceable well after the changes were made.
The last change concerns the use of template modifiers. This is a way for the template system to delegate certain tasks, such as converting text to uppercase, to existing PHP functions. With the exception of a few selected functions, all functions that PHP has to offer were available. Generally speaking, templates should not make use of any complicated logic, which is why the use of template modifiers apart from a few useful helper functions has always been questionable. The biggest problem, however, is that multilingual input fields are technically based on language variables, and language variables have access to all template functions, because language variables are technically implemented as templates.
An attacker with access to the admin panel with permission to customize templates, boxes, pages or multilingual input fields can potentially abuse them to execute almost any PHP function. However, when we designed the WoltLab Cloud we have put security and integrity first from the beginning and only allowed a limited selection of functions to be accessed - a concept that has more than proven itself over the past years. With WoltLab Suite 6.0, only a select subset of PHP functions are allowed to be called via template modifiers, and the previous divergent behavior of WoltLab Cloud thus becomes the standard.
The list of reactions below a content piece has been technically modernized and is now based on a Web Component. The structure in HTML has also been improved in terms of accessibility and additionally highlights the reaction given by oneself. For developers there is no need for adaptation, the changes were made in the template for the summary of reactions.
Unification of the subscribe function
The functionality and appearance of the subscribe functions have been aligned across apps.
Improved internationalization / localization
There is now the “locale” field, which allows numbers and times to be formatted in a country-specific way. This is especially interesting for people from Switzerland (1'000'000 for large numbers) and the UK (24 hour time format). In addition, UTC is now available as a time zone, for example for digital events in the calendar.
Standardization of wording
In various places, the user interface texts have been standardized.
Performance improvement
Various optimizations have been made to improve performance.
Easier access to CLI workers
The Update Ads page in the admin panel lists the necessary commands for execution via CLI.
Statistics for CAPTCHA questions
For CAPTCHA questions, the number of times a question was answered correctly or incorrectly is now recorded.
Support for WebP avatars
Uploading avatars in WebP format is now supported.
Events can be canceled after the fact
Calendar events can now be canceled after the time of the appointment.
Height upload limit for file uploads
For file uploads (e.g. to Filebase or Gallery), file sizes of over 2 GiB are now supported.
Flood-Control for vandalism in old posts
The flood control is now also used when editing posts to prevent a user from mass modifying old posts in a short time.
Twitter buttons changed to X
The buttons for sharing content on Twitter or logging in via Twitter have been updated.
Improved data import
Data import from another WoltLab Suite installation can now take over more content.
Better support for images in desktop notifications
In desktop notifications, the alt tag content of images is used for display.
Support for 4K images as avatars
Avatars can be uploaded as 4K variants.
Better readability of change history
The formatting of changes has been improved for better readability.
Warning for invisible participants when replying
Invisible participants now receive a warning when replying to a conversation that they are no longer invisible as a result of the reply.
Spotify media provider updated
The media provider for Spotify has been updated to the latest version.
Improved processing of animated WebP images
Animated images in WebP format are now processed correctly, allowing the creation of appropriate preview graphics.
Setting for blog article order
The administrator can now configure the order of blog articles.
Last posts box without cache
The recent posts box now determines the displayed topics live rather than with a 5-minute cache.
Recognition of URLs in texts improved
The algorithm for detecting URLs in texts has been revised and now works much more precisely.
Better detection of failed file uploads
If a file upload fails due to a web server-side limit, this is now correctly detected and reported to the user.
Mobile language selection improved
The mobile language selection now additionally displays the flag icons.
Revised breadcrumbs
The breadcrumbs have been completely revised technically.
Use of the meter tag
The meter tag is used, for example, to display the utilization of the conversation quota and provides better semantics.
Reset button in date selection revised
The button is now more accessible and can also be controlled by keyboard, for example.
Hiding of unnecessary language selection
The language selection for multilingual content is now automatically hidden if only one language is available for selection.
Placeholder for email address in newsletters
{$email} can be used as a placeholder in newsletters to display the e-mail address of the respective recipient.
Box display unified
The display of content boxes has been standardized.
Display of article buttons revised
The display of buttons in articles has been revised and aligned with the display from other areas.
Improved deletion of articles
In the confirmation dialog for articles, the title of the respective article is now displayed.
Presentation of review buttons revised
The display of buttons in reviews has been revised and aligned with the display from other areas.
Improved email notifications
The subject line of various notification emails has been adjusted to make them easier to understand.
Database name in system information
The system information on the start page of the admin panel now lists the name of the database used.
Printout of MFA backup codes improved
The view for printing MFA backup codes has been revised and made more user-friendly.
Embedded content widget revised
The embedded content widget has been completely redesigned to be more user-friendly and accessible.
Advanced search form improved
The advanced filters area now automatically unfolds when a filter is active.
Survey editing improved
When editing polls, you can now see if it is a public poll.
Individual icons for search results
Search results can now be provided with individual icons.
Simplified creation of cronjobs
Cronjobs can now be created using Expression.
Embedding of audio and video media
Embedding media of type audio or video now leads to the display of a corresponding audio or video player.
Better indication of activated debug mode
The admin panel now better indicates that debug mode is active.
Generic share button
A generic button for sharing the respective page has been introduced.
Improved tagged content page
When calling the page with a specific tag, the content for which results are available is now still offered for filtering.
Input for MFA codes improved
The input for MFA codes has been revised and made more user-friendly.
Improved tag suggestions for multilingual content
The suggestions for tags now fit better to the respective language.
Improved template copying
When copying templates, the first available template group is no longer selected.
Misleading “Full access” option removed
The “Full access” option often led to unnecessarily complicated configurations in the permissions.
19
7
11
