Tiki 27.8

Tiki 27.8 is a security maintenance release that also includes selected bug fixes and enhancements since Tiki 27.7.

Users of Tiki 27.7 are strongly encouraged to upgrade.

1. Upgrade Notes

• [+] Installer base images must be local
  • Loading installer base images from remote URLs is no longer supported for security reasons. Administrators using custom base images should place the SQL file in the appropriate local db/ directory and reference it locally.

• [+] Verify custom PHP CLI configuration
  • PHP CLI paths are now validated before execution. Administrators using a custom or non-standard PHP CLI path should ensure that it points to a valid PHP executable.

2. Security

• [+] Graph formula: replace eval() with Math_Formula library
  • Replace unsafe eval() usage in graph formulas with the Math_Formula library and a whitelist of supported mathematical functions for safer formula evaluation.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10921

• [+] File Gallery: block shell injection and add CSRF protection
  • Secure File Gallery indexing handlers against shell metacharacter injection and add CSRF validation to the reindexing action.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10926

• [+] Wiki rankings: prevent SQL injection via categId
  • Validate category IDs and use parameterized queries in Wiki rankings to prevent SQL injection through the categId parameter.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10932

• [+] Authentication: prevent unauthenticated password changes for new users
  • Require server-side session validation before allowing new-user password changes, preventing forged validation parameters from bypassing authentication.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10934

• [+] Rankings: validate and sanitize request parameters
  • Improve ranking pages by restricting ranking types to allowed values and validating limit and category inputs before processing.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10935

• [+] Email 2FA: improve secure token generation
  • Use cryptographically secure random generation for Email 2FA tokens and improve custom character set handling, including reversed ranges and empty sets.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10936

• [+] Email 2FA: decrypt stored token before comparing OTP
  • Fix Email 2FA verification by decrypting the stored token before securely comparing it with the user-provided OTP.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10943

• [+] Performance stats: prevent SQL injection in sorting
  • Sanitize the ORDER BY direction used in performance statistics to prevent SQL injection through manipulated sort parameters.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10964

• [+] Installer: harden base image loading
  • Restrict installer base images to local SQL files within the db/ directory and disable remote URL loading to prevent unsafe file ingestion.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10971

• [+] Harden auth tokens and tighten token access controls
  • Strengthen authentication tokens with HMAC-SHA256 signing and a per-installation secret, improve token validation and usage limits, and add support for rotating the signing secret to revoke existing tokens.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10989

• [+] TikiAccessLib: refactor CSRF handling and remove unnecessary logging
  • Improve CSRF handling for login and password changes, add brute-force protection to password-change attempts, and avoid logging sensitive GET/POST request data in CSRF error logs.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10995

• [+] Installer: prevent SQL injection in database user provisioning
  • Validate database names and users, safely quote credentials in GRANT queries, and restrict database-user creation to initial installation to prevent SQL injection during setup.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11002

• [+] API: prevent tracker/form data from being cached in wiki page responses
  • Prevent wiki page API responses containing tracker or form data from being cached, avoiding stale or inappropriate dynamic data being returned.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11008

• [+] PHP CLI: prevent arbitrary command execution
  • Validate the configured PHP CLI path before use to ensure it points to a legitimate PHP executable and prevent arbitrary command execution.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11015

• [+] Score: add missing indexes to object score history
  • Add missing indexes to tiki_object_scores to avoid repeated full-table scans and improve performance when calculating scores and user rankings.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11022

3. Bug Fixes

• [+] Search Controller: Add raw option to action_lookup for exact value retrieval
  • Add a raw option to search lookups so callers can retrieve exact stored values, such as ItemLink item IDs, instead of rendered text labels.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10790

• [+] Users: avoid fatal error when updating user email
  • Fix a fatal error when changing a user's email without changing their password, particularly when the pass_first_login option is enabled.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10795

• [+] ES and Lucene indexing: resolve max clause count
  • Prevent Elasticsearch and Lucene indexing failures for items with more than 1,024 related items by processing related-item queries in batches.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10808

• [+] Tabular: correct import-export permissions link and permission filter handling
  • Fix the Tabular permission link to use the correct import-export object type and allow permission feature filters containing characters not accepted by the stricter word filter.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10810

• [+] Tabular: fix CSV/JSON synchronization and separator handling
  • Fix CSV/JSON Tabular synchronization through the API and correctly normalize CSV/TSV separators to prevent JSON sync data from being corrupted.
    https://gitlab.com/tikiwiki/tiki/-/commit/e864d76c8827903d9ab567368a0c57fa63550e99

• [+] ListExecute: respect pagination and selected objects
  • Add options to the ListExecute command to run actions on a specific page or a selected set of objects, matching the capabilities available in the UI.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10813

• [+] Attachments migration: update image plugin source type
  • Fix attachment migration so
     Plugin Image

    No image specified. One of the following parameters must be set: fileId, randomGalleryId, fgalId, attId or src.
    plugins referencing wiki attachment download URLs are correctly converted to use fileId, including updating the source type accordingly.
    https://gitlab.com/tikiwiki/tiki/-/commit/925959566dbf3f45bde7e31b4b3ecb05ea5e6fe2

    
    

• [+] FileGals: make file delete permissions consistent across all views
  • Standardize file deletion permission checks across File Gallery views, allowing file owners to delete their files consistently in both the standard gallery and elFinder interfaces.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10764

    
    

• [+] ItemsList: handle empty field selection in link field ID option
  • Fix ItemsList tracker fields when no linked field is selected, preventing errors during display, saving, and import processing.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10844

• [+] Trackers: make rule parent selector respect render mode
  • Fix Tracker rules so the parent selector is chosen according to the active render mode instead of always using the default selector.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10843

• [+] Installer: avoid duplicate filename_hash column during upgrade
  • Make the tiki_secdb migration idempotent by checking whether the filename_hash column already exists before adding it, preventing upgrade failures on instances where the migration was previously applied.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10817

• [+] Realtime: prevent empty WebSocket token from reusing admin permissions
  • Reset the user and permission context when a WebSocket connection has no valid session token, preventing stale administrator permissions from being reused.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10950

• [+] Calendar: prevent all-day events from displaying on an extra day
  • Fix all-day calendar events so they no longer appear on an additional day beyond their intended date range.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10881

• [+] Calendar: correctly import all-day events from ICS files
  • Detect all-day events from ICS DTSTART values even when the Tiki-specific X-Tiki-Allday property is absent, ensuring imported events are correctly marked as all-day.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10967

• [+] Pdflib: convert PDF cover image URL to local path
  • Resolve File Gallery cover images to local filesystem paths before PDF generation, allowing mPDF to load them directly without an HTTP request.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10902

• [+] Login: add missing MFA date update function
  • Add the missing updateLastMFADate() user function to update last_mfa_date after MFA authentication, preventing a fatal error during login.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11030

4. Enhancements

• [+] System configuration: support multiple INI files
  • Allow Tiki to load multiple system configuration INI files in a defined order, with later files overriding earlier ones while preserving compatibility with the legacy single-file configuration.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10840

• [+] GetStringsCommand: add custom translation and string preservation options
  • Enhance getstrings with support for extracting custom translations, including strings from wiki pages, and add --skip-remove to preserve translations no longer found during scans.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10873

• [+] Calendar: export all events from selected calendars
  • Update the Export calendars option to export all events from the selected calendars, without limiting the export to the currently displayed date range.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10899

• [+] Calendar: add landscape layout option for PDF export
  • Add a landscape orientation option when exporting calendars to PDF, providing a wider layout better suited to calendar content.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/11027

5. Dependency Updates

• [+] Update composer.lock
  • Updated composer.lock to include the latest fixes and features for various dependencies.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10860

• [+] Build: add Node.js 22 support
  • Extend the supported Node.js range to include Node.js 22 build and development tooling.
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10886

• [+] Tiki-Webmail: update Cypht to 2.12.1
  • Update the bundled Cypht dependency from 2.12.0 to 2.12.1
    https://gitlab.com/tikiwiki/tiki/-/merge_requests/10892

6. References

• Complete changes since Tiki 27.8