Tiki 29.4

Tiki 29.4 is a security maintenance release that also includes selected bug fixes and enhancements since Tiki 29.3.

Users of Tiki 29.3 are strongly encouraged to upgrade.

1. Upgrade Notes

• [+] Installer base images must be local
  • Loading installer base images from remote URLs is no longer supported for security reasons. Administrators using custom base images should place the SQL file in the appropriate local db/ directory and reference it locally.

• [+] Verify custom PHP CLI configuration
  • PHP CLI paths are now validated before execution. Administrators using a custom or non-standard PHP CLI path should ensure that it points to a valid PHP executable.

• [+] Review MediaWiki attachment imports
  • MediaWiki attachment imports now reject unsafe URLs and invalid attachment paths. Administrators importing attachments from internal, private, or non-public locations should review their import workflow.

• [+] Review API and authentication token integrations
  • Authentication and API token handling has been hardened. Administrators using API tokens, authentication tokens, or long-lived integrations should verify that they continue to work as expected after upgrading.

2. Security

• [+] Language: block path traversal and PHP injection in translation editor
  • Prevent path traversal and PHP injection vulnerabilities in the translation editor when handling custom language files.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10906

• [+] Graph formula: replace eval() with Math_Formula library
  • Replace unsafe eval() usage in graph formulas with the Math_Formula library and a whitelist of supported mathematical functions for safer formula evaluation.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10921

• [+] File Gallery: block shell injection and add CSRF protection
  • Secure File Gallery indexing handlers against shell metacharacter injection and add CSRF validation to the reindexing action.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10925

• [+] Wiki rankings: prevent SQL injection via categId
  • Validate category IDs and use parameterized queries in Wiki rankings to prevent SQL injection through the categId parameter.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10928

• [+] Authentication: prevent unauthenticated password changes for new users
  • Require server-side session validation before allowing new-user password changes, preventing forged validation parameters from bypassing authentication.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10929

• [+] Rankings: validate and sanitize request parameters
  • Improve ranking pages by restricting ranking types to allowed values and validating limit and category inputs before processing.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10930

• [+] Email 2FA: improve secure token generation
  • Use cryptographically secure random generation for Email 2FA tokens and improve custom character set handling, including reversed ranges and empty sets.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10931

• [+] Email 2FA: decrypt stored token before comparing OTP
  • Fix Email 2FA verification by decrypting the stored token before securely comparing it with the user-provided OTP.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10942

• [+] Realtime: prevent empty WebSocket token from reusing admin permissions
  • Reset the user and permission context when a WebSocket connection has no valid session token, preventing stale administrator permissions from being reused.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10948

• [+] Performance stats: prevent SQL injection in sorting
  • Sanitize the ORDER BY direction used in performance statistics to prevent SQL injection through manipulated sort parameters.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10963

• [+] Installer: harden base image loading
  • Restrict installer base images to local SQL files within the db/ directory and disable remote URL loading to prevent unsafe file ingestion.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10970

• [+] API tokens: strengthen token generation and storage
  • Generate API tokens with cryptographically secure randomness and store only SHA-256 verifiers instead of plaintext tokens, while adding support to revoke all API and OAuth tokens.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10982

• [+] Harden auth tokens and tighten token access controls
  • Strengthen authentication tokens with HMAC-SHA256 signing and a per-installation secret, improve token validation and usage limits, and add support for rotating the signing secret to revoke existing tokens.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10983

    
    

• [+] MediaWiki importer: prevent path traversal in attachment filenames
  • Validate and normalize imported attachment filenames and destination paths so malicious filenames cannot write files outside the configured attachment directory.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10985

    
    

• [+] TikiAccessLib: refactor CSRF handling and remove unnecessary logging
  • Improve CSRF handling for login and password changes, add brute-force protection to password-change attempts, and avoid logging sensitive GET/POST request data in CSRF error logs.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10986

• [+] Harden remember-me cookies and invalidate them after password changes
  • Strengthen remember-me cookies with session-aligned Secure, HttpOnly, and SameSite attributes, centralize their handling, and invalidate existing remember-me tokens after a password change.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10991

• [+] Installer: prevent SQL injection in database user provisioning
  • Validate database names and users, safely quote credentials in GRANT queries, and restrict database-user creation to initial installation to prevent SQL injection during setup.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11001

• [+] API: prevent tracker/form data from being cached in wiki page responses
  • Prevent wiki page API responses containing tracker or form data from being cached, avoiding stale or inappropriate dynamic data being returned.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11006

• [+] PHP CLI: prevent arbitrary command execution
  • Validate the configured PHP CLI path before use to ensure it points to a legitimate PHP executable and prevent arbitrary command execution.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11014

• [+] Score: add missing indexes to object score history
  • Add missing indexes to tiki_object_scores to avoid repeated full-table scans and improve performance when calculating scores and user rankings.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11021

3. Bug Fixes

• [+] Wiki: restore page history and source view in French locale
  • Fix a template quoting issue in the page history tooltip that prevented page history and source views from rendering correctly when using the French locale.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10801/

• [+] ES and Lucene indexing: resolve max clause count
  • Prevent indexing failures when items have more than 1,024 related objects by splitting search lookups into smaller batches.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10808

    
    

• [+] PluginDiv: fix undefined style variable warning
  • Prevent an E_WARNING in PluginDiv on Tiki 29.x when the style parameter is omitted, while preserving user-provided style values.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10770

• [+] Tabular: fix CSV/JSON synchronization and separator handling
  • Fix Tabular CSV/JSON synchronization through the API and normalize CSV/TSV separators correctly to prevent corrupted JSON sync data.
    https://gitlab.com/tikiwiki/tiki/-/commit/5e65982b1d353de67009c37e5376fe2d6406b9ca

• [+] ListExecute: respect pagination and selected objects
  • Add options to the ListExecute command to run actions on a specific page or a selected set of objects, matching the capabilities available in the UI.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10813

• [+] Attachments migration: update image plugin source type
  • Fix attachment migration so
     Plugin Image

    No image specified. One of the following parameters must be set: fileId, randomGalleryId, fgalId, attId or src.
    plugins referencing wiki attachment download URLs are correctly converted to use fileId, including updating the source type accordingly.
    https://gitlab.com/tikiwiki/tiki/-/commit/925959566dbf3f45bde7e31b4b3ecb05ea5e6fe2

    
    

• [+] FileGals: make file delete permissions consistent across all views
  • Standardize file deletion permission checks across File Gallery views, allowing file owners to delete their files consistently in both the standard gallery and elFinder interfaces.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10830

• [+] Element Plus Select: keep remote multiple selects usable after selection
  • Prevent duplicate options in remote multiple-select fields by deduplicating results while preserving already selected values, keeping the selector usable after a selection.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10858

• [+] Cookie consent: preserve category keys in defaults
  • Fix default cookie consent preferences so category identifiers are preserved as array keys while all categories remain disabled by default.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10868

• [+] Calendar: correctly import all-day events from ICS files
  • Detect all-day events from ICS DTSTART values even when the Tiki-specific X-Tiki-Allday property is absent, ensuring imported events are correctly marked as all-day.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10967

• [+] MediaWiki importer: block unsafe attachment URLs and sanitize filenames
  • Harden MediaWiki attachment imports by allowing only public HTTP(S) URLs, blocking local or private network targets, and sanitizing filenames to prevent SSRF, local file access, and path traversal.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10951

    
    

• [+] User mentions: replace modal with inline suggestions dropdown
  • Restore inline @ mention suggestions with avatars and keyboard navigation, replacing the modal-based user selector for a smoother mention workflow.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11011

• [+] Calendar: add landscape layout option for PDF export
  • Add a landscape orientation option when exporting calendars to PDF, providing a wider layout better suited to calendar content.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10999

• [+] Date Time field: use current date on initial display
  • Fix Tracker Date Time fields so the default year is based on the current date instead of displaying a date far in the past when no value has been submitted or stored.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11029

• [+] Installer: avoid secdb duplicate key during release packaging
  • Move InstallerDatabaseSetupTest into the correct lowercase lib/test/core directory on Tiki 29.x, preventing duplicate index.php entries in tiki_secdb that could cause fresh installations to report SQL failures
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11035

    
    

4. Enhancements

• [+] System configuration: support multiple INI files
  • Allow Tiki to load multiple system configuration INI files in a defined order, with later files overriding earlier ones while preserving compatibility with the legacy single-file configuration.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10237

• [+] GetStringsCommand: add custom translation and string preservation options
  • Enhance getstrings with support for extracting custom translations, including strings from wiki pages, and add --skip-remove to preserve translations no longer found during scans.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10852

• [+] Calendar: export all events from selected calendars
  • Update the Export calendars option to export all events from the selected calendars rather than only events within the currently displayed date range.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10897

• [+] Calendar: adjust margins for landscape PDF layout
  • Improve Calendar PDF exports in landscape mode by adjusting page dimensions and margins so the calendar fits the page width more cleanly.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11026

    
    

5. Dependency Updates

• [+] Update composer.lock
  • Updated composer.lock to include the latest fixes and features for various dependencies.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10856

• [+] Plotly.js: bump minimum version to 3.5.1
  • Update Plotly.js to version 3.5.1 or later and adapt the Vite configuration to account for the removal of the topojson dependency in newer Plotly.js releases.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10798

• [+] Element Plus: update library and improve Tiki integration
  • Update Element Plus to a newer version and replace the custom library patch with Tiki-side handling for dropdown focus and selection behavior in Vue widgets.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10797

• [+] Regenerate package-lock.json with Node.js 20
  • Regenerate the npm lock file using Node.js 20 to restore compatibility with the supported build environment and avoid dependencies requiring newer Node.js versions.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10805

    
    

6. References

• Complete changes since Tiki 29.4