I am pleased to announce the eleventh release in the 1.5 cycle: v1.5.10 is here.
This release fixes a security vulnerability as well as several bugs, and also contains several small improvements.
The vulnerability, kindly disclosed by Kacper Szurek, allowed skilled attackers to inject malicious JavaScript into the page that is shown when administrators try to view information about a user's IP address.
In addition, this release contains some minor improvements in the area of CSS and usability, and fixes several smaller bugs. For more details, please view the full changelog.
Please update your forums as soon as possible.
We also recommend subscribing to the security mailing list in your site's user profile. That way, you will get notified of new security-relevant releases immediately.
As always, download packages can be found on our download page.
Changed files and patches are available on the upgrade page. Please remember to make a backup of your files as well as the database before upgrading your forum!
A big thank you to all contributors, and again a hat-tip to Kacper Szurek for the detailed and responsible disclosure of security information!
