Tiki 24.15

Tiki 24.15 is a security maintenance release that also includes selected bug fixes and enhancements since Tiki PREVIOUS_VERSION.

Users of Tiki PREVIOUS_VERSION are strongly encouraged to upgrade.

1. Upgrade Notes

• [+] Installer base images must be local
  • Loading installer base images from remote URLs is no longer supported for security reasons. Administrators using custom base images should place the SQL file in the appropriate local `db/` directory and reference it locally.

• [+] Verify custom PHP CLI configuration
  • PHP CLI paths are now validated before execution. Administrators using a custom or non-standard PHP CLI path should ensure that it points to a valid PHP executable.

    
    

2. Security

• [+] Language: block path traversal and PHP injection in translation editor
  • Prevent path traversal and PHP injection vulnerabilities in the translation editor when handling custom language files.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10904/

• [+] File Gallery: secure indexing handlers and reindexing
  • Prevent shell command injection in File Gallery indexing handlers and add CSRF protection to the file reindexing action.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10926/

• [+] Wiki rankings: prevent SQL injection via category filtering
  • Secure Wiki ranking category filters by validating category IDs and using parameterized SQL queries to prevent SQL injection.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10908

• [+] Authentication: prevent unauthenticated password changes for new users
  • Require server-side session validation before allowing new-user password changes, preventing forged validation parameters from bypassing authentication.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10909

• [+] Rankings: validate and sanitize request parameters
  • Improve ranking pages by restricting ranking types to allowed values and validating limit and category inputs before processing.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10910

• [+] Email 2FA: improve secure token generation
  • Use cryptographically secure random generation for Email 2FA tokens and improve custom character set handling, including reversed ranges and empty sets.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10911

• [+] Email 2FA: decrypt stored token before comparing OTP
  • Fix Email 2FA verification by decrypting the stored token before securely comparing it with the user-provided OTP.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10944

• [+] Performance stats: prevent SQL injection in sorting
  • Sanitize the ORDER BY direction used in performance statistics to prevent SQL injection through manipulated sort parameters.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10965

• [+] Installer: harden base image loading
  • Restrict installer base images to local SQL files within the db/ directory and disable remote URL loading to prevent unsafe file ingestion.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10972

• [+] API: prevent tracker/form data from being cached in wiki page responses
  • Prevent wiki page API responses containing tracker or form data from being cached, avoiding stale or inappropriate dynamic data being returned.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11008

• [+] PHP CLI: prevent arbitrary command execution
  • Validate the configured PHP CLI path before use to ensure it points to a legitimate PHP executable and prevent arbitrary command execution.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11004

• [+] Score: add missing indexes to object score history
  • Add missing indexes to tiki_object_scores to avoid repeated full-table scans and improve performance when calculating scores and user rankings.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11023

3. Dependency Updates

• [+] Update composer.lock
  • Updated composer.lock to include the latest fixes and features for various dependencies.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10862/

4. References

• Complete changes since Tiki24.15