Discovered by: Polina Voronina
CVE-2020-7051 [Type: Stored Cross-Site Scripting, Product: Codelogic Codoforum, Version: 4.8.4]
CVE-2020-7050 [Type: DOM-Based Cross-Site Scripting, Product:
Codelogic Codoforum, Version: 4.8.4]

Codoforum 4.8.4 is released.

It includes a patched XSS vulnerability, it also fixes a few other issues:

[4.8.4]

• Fix bug showing duplicate users when users have multiple roles
• Fix bans not applying for uni login and sso plugins
• Fix mentions style and 404 avatars
• Fix for custom user fields
• Security fixes (Read below)
• Add manage freichat link
• Fix instant notifications
• Updated less compiler to 0.5.0

Read more about the XSS vulnerability here:

[link: ]

Since PHP 7.4 was released a few weeks ago, the next release will be targeted towards PHP 7.4 compatibility and a few more performance enhancements.

Since Freichat was an offloaded service, it was very difficult to change the look and feel of FreiChat, The upcoming release of FreiChat will have a nice backend to Manage Appearance as well as Translations (The release will also include plenty of bug fixes).

Here is a screenshot of what it looks after you play around with the colors,

Do let us know if you have any feedback.

It is a pleasure to announce the release of the new version of codoforum v4.8

Some highlights in this release:

Chat
We have been working on instant messenger feature - FreiChat; for past couple of months. We have now integrated it with codoforum, so you should now be able to see that at bottom right corner of this forum.

You can enable this feature from your forum by first upgrading the FreiChat plugin then enabling it in the Settings:

Docker
We have created a docker image for codoforum with all dependencies which installs itself automatically. So now with one single command you can install any version(>v4.7) of codoforum easily on your local or development setups.

Role colors
It is now possible to give unique styles to every role. We have added a new option in the backend under UI Elements -> Role colors

You can simply give the desired color or put your own styles in css for a given role:

New settings/configuration

You can switch between logo and site title and upload your logo for your site header.

You can now configure whether to use username or email or both for the login screen. This configuration is also applied for the admin login.

Codoforum had issues with cached css where icons were not loaded when you switched between http/https or www/without www. This has finally been fixed, and now it will even work for multiple domains pointing to the same forum. There are also other couple of bug fixes in this release.

As always, you can directly upgrade the forum from your backend or download and install the new version from

We are excited to announce a quick release within just weeks of our previous release.

We have fixed a plenty of annoying bugs in this release.
There are some security fixes as well as improvement to existing plugins.

We have also added forum privacy feature. You can make the forum private and accessible only to registered users with a toggle from the backend

Changes from our readme:
[4.7]

• Make send pm button more visible
• Post & cancel buttons: layout fix in new topic
• Hide "edit profile" for users that dont have permission
• Give warning if installing in database with codoforum tables
• Improved anti spam rules plugin
• Toggle to make forum private
• Security fixes for routes
• Oauth admin shows old settings on save & debug logging permissions fixed
• Fixed password check for edit user in backend
• Fixed role based search in backend

It is a great pleasure to announce a new release of our forum V.4.6

We have fixed some annoying bugs in some plugins and fixed various ui issues.

We have also added a new plugin named 'Anti Spam Rules' for protecting your forum from spam. A visit to the forum just to see spam posts every day should greatly reduce after installing this plugin in your backend.

The new release completely gets rids off a huge html manipulation library named simple_html_dom which was used by some of the plugins. After removing this, you should see some speed improvements in your page load time.

And last, but the best feature of this release is our Private Messaging component. You should see a plugin named 'FreiChat' now in Codoforum plugins. We have used the latest technologies (ReactJS, Websockets, etc) to give you the best experience with a messaging system. Now messages will be delivered in a blink of an eye.
We will be releasing a new version within next 2 weeks for adding offline notification support in FreiChat PM; so do wait for that.

Cheers!

After a long period of development and regression-testing,

we have v.4.5 and you will love ❤️that it can embed everything!

Youtube:

Twitter:
https://twitter.com/lornajane/status/1060927508852432903

SoundCloud:
https://soundcloud.com/dj-ryan-redmond/ryan-redmond-whip-it-out

Vimeo:
https://vimeo.com/294793079

and more..

[4.5]

• Added option to load embedded content(only first) as part of excerpt in All topics and category page


• Fixed pmx link getting appended to notifications div


• Fixed pmx styles


• Fixed dropdown popover bug and other css fixes to menu and responsive styles


• Replaced custom tabs in profile view/edit with bootstrap tabs


• Profile edit signature bug fixed


• Fixed tick image path when subscription is changed


• Added documentation to customize theme easily (Includes css fixes to standardize colors and removal of unused css)


• Reply button not working for mobile bug fixed

Okay so on the left side of the page, you can see....

^All Topics

• Announcements & News
• Other Category here
• Blah

I want to be able to make more topics like this
eg:

^Topic 1
-blah
-blah

^Topic 2
-blah
-blah

^Topic 3
-blah
-blah

Anyone got any ideas on how to do this, sorry I am very new to forum development, but I need one setup for my community.

We have released a new version of v.4-Alpha with following changes

• Added Moderator only access in the admin panel.
• Poll plugin
• New theme
• Sort by Most popular, newest and most commented

[more features will be added in the subsequent releases soon]

Old Forums can be upgraded:
You can find it here: http://<YourForum.com>/admin/index.php?page=manual_upgrade

The forum is still buggy so avoid using it on production. More stable and tested versions will be released in the next week.

Screenshots:
Note: The pictures may look a little different from the alpha. But subsequent releases will completely match the pictures below

Main Page:

Category page:

User profile:

The password for all users have been reset as we are migrating towards a better and more secure system.
Please use the 'Forgot Password' Link to reset your password.

You can also login with Facebook, Google, Twitter and Github

Hi,

Codoforum v4.1.2 released with many bug fixes

[4.1.2] - [Released]

• Topic title special characters in category/topic/profile/urls [done]
• Smiley and headers button in editor [done]
• Improved profile view css
• Pre select category when creating topic from category page
• Added breadcrumbs in new topic based on source
• Mass mails bug fixed
• Added missing translations
• rep button design fixed
• footer pagination to be fixed positioned [done]
• Sub category shows old style num. of unread topics [fixed]
• No. of views doesn't fit in the fixed sidebar when you scroll [fixed]

Hi There,

Just wondered if there were any new updated on the V4 released ?

Thanks,

The video will hopefully help our new comers

Little surprise, do read it

Hello all,

We have released a new product, , a tool intended to help developers, hackers and power users to explore and manage data in their database be it locally or on the cloud.

Please take a look at https://dockdb.com and let us know what you think.

Thank you.
Team DockDB

Note: The team that manages DockDB is completely separate
from the team that builds Codoforum and Freichat, 
Hence support for DockDB will be provided 
only on forum.dockdb.com

Hi,

No new release for almost 2 years ...
I ask myself to renew or upgrade if this component is not upgraded given its price ...
Is an update scheduled?

Sincerely
Ethan

We have released a new version of 3.7.1 with following changes

• Search with code bug fixed
• mentions not working fixed
• 1 security fix
• Template fix
• Avatar not created for users created from backend fixed

We have also upgraded this forum to the latest version.

Should this be private just wondering :/

I'm installing codoforum now, just put all the files in the "codoforum" folder into my public_html folder, but I dont know if it will work because last time it didn't

Any word one the works?