Tiki 30.1

Tiki 30.1 is a security maintenance release that also includes selected bug fixes and enhancements since Tiki 30.0.

Users of Tiki 30.0 are strongly encouraged to upgrade.

1. Upgrade Notes

• [+] Installer base images must be local
  • Loading installer base images from remote URLs is no longer supported for security reasons. Administrators using custom base images should place the SQL file in the appropriate local db/ directory and reference it locally.

• [+] Verify custom PHP CLI configuration
  • PHP CLI paths are now validated before execution. Administrators using a custom or non-standard PHP CLI path should ensure that it points to a valid PHP executable.

• [+] Review MediaWiki attachment imports
  • MediaWiki attachment imports now reject unsafe URLs, local or private network targets, and invalid attachment paths. Administrators importing attachments from internal or non-public locations should review their import workflow.

• [+] Authentication tokens are more strictly validated
  • Authentication and API token handling has been hardened. Existing tokens may be invalidated by security-related configuration changes or token revocation, so administrators using integrations based on API or authentication tokens should verify them after upgrading.

2. Security

• [+] Graph formula: replace eval() with Math_Formula library
  • Replace unsafe eval() usage in graph formulas with the Math_Formula library and a whitelist of supported mathematical functions for safer formula evaluation.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10921

• [+] Language: block path traversal and PHP injection in translation editor
  • Prevent path traversal and PHP injection vulnerabilities in the translation editor when handling custom language files.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10905

• [+] Tiki switch lang: fix language switch for SEF slugs
  • Preserve SEF slug encoding when switching languages so wiki page URLs containing spaces or + characters correctly redirect to the translated page.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10846

• [+] Wiki rankings: prevent SQL injection via categId
  • Validate category IDs and use parameterized queries in Wiki rankings to prevent SQL injection through the categId parameter.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10928

• [+] Authentication: prevent unauthenticated password changes for new users
  • Require server-side session validation before allowing new-user password changes, preventing forged validation parameters from bypassing authentication.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10914

• [+] Rankings: validate and sanitize request parameters
  • Improve ranking pages by restricting ranking types to allowed values and validating limit and category inputs before processing.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10930

• [+] Email 2FA: improve secure token generation
  • Use cryptographically secure random generation for Email 2FA tokens and improve custom character set handling, including reversed ranges and empty sets.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10916

• [+] Graph formula: replace eval() with Math_Formula library
  • Replace unsafe eval() usage in graph formulas with the Math_Formula library and a whitelist of supported mathematical functions for safer formula evaluation.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10920

• [+] File Gallery: block shell injection and add CSRF protection
  • Secure File Gallery indexing handlers against shell metacharacter injection and add CSRF validation to the reindexing action.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10924

• [+] Email 2FA: decrypt stored token before comparing OTP
  • Fix Email 2FA verification by decrypting the stored token before securely comparing it with the user-provided OTP.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10937

• [+] Realtime: prevent empty WebSocket token from reusing admin permissions
  • Reset the user and permission context when a WebSocket connection has no valid session token, preventing stale administrator permissions from being reused.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10946

• [+] MediaWiki importer: block unsafe attachment URLs and sanitize filenames
  • Harden MediaWiki attachment imports by allowing only public HTTP(S) URLs, blocking local or private network targets, and sanitizing filenames to prevent SSRF, local file access, and path traversal.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10949

• [+] Performance stats: prevent SQL injection in sorting
  • Sanitize the ORDER BY direction used in performance statistics to prevent SQL injection through manipulated sort parameters.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10957

• [+] Installer: harden base image loading
  • Restrict installer base images to local SQL files within the db/ directory and disable remote URL loading to prevent unsafe file ingestion.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10969

• [+] MediaWiki importer: prevent path traversal in attachment filenames
  • Validate and normalize imported attachment filenames and destination paths so malicious filenames cannot write files outside the configured attachment directory.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10977

• [+] Harden remember-me cookies and invalidate them after password changes
  • Strengthen remember-me cookies with session-aligned Secure, HttpOnly, and SameSite attributes, centralize their handling, and invalidate existing remember-me tokens after a password change.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10979

• [+] TikiAccessLib: refactor CSRF handling and remove unnecessary logging
  • Improve CSRF handling for login and password changes, add brute-force protection to password-change attempts, and avoid logging sensitive GET/POST request data in CSRF error logs.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10978

• [+] API tokens: strengthen token generation and storage
  • Generate API tokens with cryptographically secure randomness and store only SHA-256 verifiers instead of plaintext tokens, while adding support to revoke all API and OAuth tokens.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10974

• [+] Harden auth tokens and tighten token access controls
  • Strengthen authentication tokens with HMAC-SHA256 signing and a per-installation secret, improve token validation and usage limits, and add support for rotating the signing secret to revoke existing tokens.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10981

• [+] API tokens: restore revoke-all command
  • Restore the api-tokens:revoke-all console command that was accidentally dropped during the token hardening backport.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10987

• [+] Installer: prevent SQL injection in database user provisioning
  • Validate database names and users, safely quote credentials in GRANT queries, and restrict database-user creation to initial installation to prevent SQL injection during setup.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11000

• [+] API: prevent tracker/form data from being cached in wiki page responses
  • Prevent wiki page API responses containing tracker or form data from being cached, avoiding stale or inappropriate dynamic data being returned.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11005

• [+] PHP CLI: prevent arbitrary command execution
  • Validate the configured PHP CLI path before use to ensure it points to a legitimate PHP executable and prevent arbitrary command execution.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11012

• [+] Score: add missing indexes to object score history
  • Add missing indexes to tiki_object_scores to avoid repeated full-table scans and improve performance when calculating scores and user rankings.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11020

• [+] Password change: fix brute-force protection initialization
  • Define the missing brute-force properties used during password changes, preventing errors and ensuring rate-limit checks and success tracking work correctly.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11033

3. Bug Fixes

• [+] Search Controller: Add raw option to action_lookup for exact value retrieval
  • Add a raw option to search lookups so callers can retrieve exact stored values, such as ItemLink item IDs, instead of rendered text labels.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10791

• [+] UAB: improve default login box icon alignment
  • Remove an unnecessary !important CSS rule in the Unified Admin Backend (UAB), allowing the default login box user icon to align correctly.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10792

• [+] Wiki: restore page history and source view in French locale
  • Fix a template quoting issue in the page history tooltip that prevented page history and source views from rendering correctly when using the French locale.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10800

• [+] ES and Lucene indexing: resolve max clause count
  • Prevent indexing failures when items have more than 1,024 related objects by splitting search lookups into smaller batches.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10808

• [+] Tabular: correct import-export permission handling
  • Fix the Tabular permissions link to use the correct import-export object type and allow feature_filter values that contain characters rejected by the stricter word filter.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10810

• [+] Tabular: fix CSV/JSON synchronization and separator handling
  • Fix Tabular CSV/JSON synchronization through the API and normalize CSV/TSV separators correctly to prevent corrupted JSON sync data.
    https://gitlab.com/tikiwiki/tiki/-/commit/5e65982b1d353de67009c37e5376fe2d6406b9ca

    
    

• [+] Trackers: fix User Selector auto-assign value retrieval
  • Fix User Selector fields so existing values are correctly retrieved when editing another tracker field, particularly when not using creator or modifier modes.
    https://gitlab.com/tikiwiki/tiki/-/commit/03e720c4dcb49ca4d9a5a4ab1f0d2114a7d72af5

    
    

• [+] ListExecute: respect pagination and selected objects
  • Add options to the ListExecute command to run actions on a specific page or a selected set of objects, matching the capabilities available in the UI.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10813

• [+] Attachments migration: update image plugin source type
  • Fix attachment migration so
     Plugin Image

    No image specified. One of the following parameters must be set: fileId, randomGalleryId, fgalId, attId or src.
    plugins referencing wiki attachment download URLs are correctly converted to use fileId, including updating the source type accordingly.
    https://gitlab.com/tikiwiki/tiki/-/commit/925959566dbf3f45bde7e31b4b3ecb05ea5e6fe2

    
    

• [+] Comments: fix copy comment link action
  • Fix comment permalink copying so the generated URL correctly includes the comment thread ID and opens the comments section at the selected comment.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10763

• [+] Cleanup obsolete UI elements
  • Remove unused or duplicate administration UI elements and correct the wiki attachment error message parameter name for a cleaner, more consistent interface.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10816

• [+] Areas: avoid undefined object category warning
  • Move area category handling into the section-change callback so category IDs are initialized before use, preventing undefined variable warnings when Areas are enabled.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10818

• [+] Sections: update current object correctly when section changes
  • Ensure jqueryTiki.current_object is updated properly when the section changes, fixing a regression introduced by earlier section refactoring.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10828

• [+] FileGals: make file delete permissions consistent across all views
  • Standardize file deletion permission checks across File Gallery views, allowing file owners to delete their files consistently in both the standard gallery and elFinder interfaces.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10829

• [+] ItemsList: handle empty field selection in link field ID option
  • Fix ItemsList tracker fields when no linked field is selected, preventing errors during display, saving, and import processing.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10844

• [+] Calendar: show a setup prompt when no calendars exist
  • Replace the previous error page with a clear setup prompt when no calendars are available, allowing administrators to create a calendar directly or advising other users to contact an administrator.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10600

• [+] Cookie consent: add category support and improve preference handling
  • Add cookie category selection and optional {ELSE} content to the CookieConsent plugin, while fixing the consent preferences form to show current selections correctly.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10851

• [+] Cookies: fix cookie settings module positioning
  • Increase CSS selector specificity for the cookie settings module to ensure its configured position is applied correctly.
    https://gitlab.com/tikiwiki/tiki/-/commit/fdec42d37a40f14e616ca8b22dea4df5e1f055bb

• [+] Element Plus Select: keep remote multiple selects usable after selection
  • Prevent duplicate options in remote multiple-select fields by deduplicating results while preserving already selected values, keeping the selector usable after a selection.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10855

• [+] ListExecute: fix actions on wiki pages with itemId in URL
  • Ensure ListExecute uses the parent wiki page when an itemId is present in the URL, preventing actions and reloads from targeting the tracker item instead of the current wiki page.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10859

    
    

• [+] Cookie consent: preserve category keys in defaults
  • Fix default cookie consent preferences so category identifiers are preserved as array keys while all categories remain disabled by default.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10865

• [+] Calendar: correctly import all-day events from ICS files
  • Detect all-day events from ICS DTSTART values even when the Tiki-specific X-Tiki-Allday property is absent, ensuring imported events are correctly marked as all-day.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10869

• [+] Feedback: link to the correct user profile in notification recipients
  • Fix notification recipient links so they point to the correct user profile.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10879

• [+] Wiki page history: fix prev/next navigation and clean up version action links
  • Fix previous/next navigation in wiki page history and simplify version action links so View, Source, Compare, and related actions target the intended version correctly.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10880

• [+] Calendar: correctly update all-day event status
  • Ensure changes between all-day and non-all-day calendar events are saved correctly by explicitly updating the all-day status.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10894

• [+] Calendar: export all events from selected calendars
  • Update the Export calendars option to export all events from the selected calendars rather than only events within the currently displayed date range.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10897

• [+] Multilingual: prevent injection and arbitrary file read vulnerabilities
  • Validate language identifiers before using them in file paths and restrict language file downloads to authorized users, preventing path traversal, code injection, and arbitrary file access.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10975

• [+] Calendar: add landscape layout option for PDF export
  • Add a landscape orientation option when exporting calendars to PDF, providing a wider layout better suited to calendar content.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10998

• [+] User mentions: replace modal with inline suggestions dropdown
  • Restore inline @ mention suggestions with avatars and keyboard navigation, replacing the modal-based user selector for a smoother mention workflow.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10847

• [+] Chart.js: prevent JavaScript errors with multiple charts
  • Prevent fatal JavaScript errors when multiple Chart.js charts are displayed on the same page.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11018

4. Enhancements

• [+] System configuration: support multiple INI files
  • Allow Tiki to load multiple system configuration INI files in a defined order, with later files overriding earlier ones while preserving compatibility with the legacy single-file configuration.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10840

• [+] Users: return false when password update failss
  • Update the password-change function to return false instead of throwing an exception when the database update fails, allowing callers to handle the failure gracefully.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10820

• [+] Search module: make autocomplete source customizable
  • Allow administrators to customize the source used for Search module autocomplete suggestions instead of restricting suggestions to wiki pages.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10837

• [+] GetStringsCommand: add custom translation and string preservation options
  • Enhance getstrings with support for extracting custom translations, including strings from wiki pages, and add --skip-remove to preserve translations no longer found during scans.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10839

• [+] PHP 8.5: avoid deprecated PDO and array-offset constructs
  • Update PDO MySQL constants and section handling for PHP 8.5 compatibility, preventing deprecation output from corrupting downloaded files.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10889

• [+] User validation: secure credential checks during login
  • Enhance login credential validation with single-use CSRF tickets and brute-force protection, while allowing validation checks without recording duplicate failed login attempts.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10976

• [+] Calendar: adjust margins for landscape PDF layout
  • Improve Calendar PDF exports in landscape mode by adjusting page dimensions and margins so the calendar fits the page width more cleanly.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11025

5. Dependency Updates

• [+] Plotly.js: bump minimum version to 3.5.1
  • Update Plotly.js to version 3.5.1 or later and adapt the Vite configuration to account for the removal of the topojson dependency in newer Plotly.js releases.
    https://gitlab.com/tikiwiki/tiki/-/commit/28852f16935bba8d53d3b091ae3690537a485e18

• [+] Element Plus: update library and improve Tiki integration
  • Update Element Plus to a newer version and replace the custom library patch with Tiki-side handling for dropdown focus and selection behavior in Vue widgets.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10796

• [+] Composer: update PHP_CodeSniffer to address vulnerabilities
  • Update PHP_CodeSniffer to version 4.0.2 to address known security vulnerabilities.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10850

• [+] Update composer.lock
  • Updated composer.lock to include the latest fixes and features for various dependencies.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10854

• [+] Tiki-Webmail: update Cypht to 2.12.1
  • Update the bundled Cypht dependency from 2.12.0 to 2.12.1
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10890

    
    

6. References

• Complete changes since Tiki 30.1