5.0.21

#7680 Commerce: Prevent prices from wrapping to multiple lines in Cart dropdown
#7706 Check attachment permission before serving database storage URLs
#7794 Stop signing legacy XenForo proxy image URLs into off-site redirects
#7804 Prevent Administrator Group Assignment
#7805 Fix potential pages upload field SQL injection
#7807 Fix legacy gallery URL's revealing private images
#7809 Fix various comment permissions issues
#7810 Fix revisions loading for records they don't belong to
#7811 Fix topic copy to database permission issues
#7813 Fix commerce transaction API permission check
#7814 Fix anyone being able to be able to see club pages when no one but leaders and owners should
#7815 Added mobileFooterList hook to mobile footer
#7816 Stripe Redirector & Webhook fixes
#7821 Fix MFA bypass when changing email after validating for a previous ch…
#7822 Fix loose check for security question answer
#7828 Fix an issue where the "All" filter in Reported Content did not work
#7829 Fix an issue where some ModCP tabs were showing to users with no permission
#7835 Fix admins modifying / deleting their own admin rows via URL manipula…
#7836 Fix admins deleting cards not belonging to the member via URL manipulation
#7837 Fix admins placing themselves into other admin groups via secondary g…
#7838 Escape search term when searching email templates
#7839 Make Content Count MemberFilter safe
#7840 Normalise file/folder names in FTP nlist.
#7842 Fix an issue where the wrong member can be added to an event in an import
#7843 Fix missing ACP restriction check on referrals history
#7844 Validate poll votes submitted via GraphQL
#7845 Add permission check to uncropped club photo
#7848 Fixes issue with Pages address fields
#7851 Add missing ACP restriction checks
#7852 Fix an issue where group editors could change permissions on nodes
#7853 Fix an issue where users could delete others' attachments via GraphQL
#7854 Fix view permissions on records API
#7856 Fix an issue where the request DB parameter was used instead of the database ID
#7857 Use logged in member for react/report API calls
#7858 Check view permissions before following via API
#7861 Harden MFA validation
#7863 Allow MemberACPManagement extensions to add filters and search parameters to the ACP list
#7865 Fix an issue where a downloads file version could be actioned using a different file ID
#7866 Fix an issue where private clubs where a GraphQL call could return private clubs
#7867 check canAcknowledge for the logged in member when acknowledging a warning
#7868 Fix SQL injection in database table sorting
#7869 Derive forced password reset links from a per-site secret
#7870 Require a signed response before storing update bulletins
#7871 Allow quest tasks to be completed for "other" members associated with a rule
#7872 Fix identifier for JoinClub achievement actions
#7873 Fix an issue where GraphQL could mark a topic solved with a post from another topic
#7874 Fix ACP restrictions on databases admin controller
#7875 Fix an issue where pending clubs were shown on the club map
#7876 Fix an issue where banned members could cancel the join request and rejoin
#7877 Fix an issue where a user could download a file for a different pages record
#7878 Add permission check when saving the sidebar for a pages page
#7879 Fix an issue where a user could download a hidden file version
#7880 Fix an issue where a user could change the status of a report they cannot view
#7881 Prevent users from searching members by staff-only fields
#7883 Block access to disabled GraphQL keys
#7884 Restrict access to member properties in GraphQL
#7885 Tighten security on task cron jobs
#7886 Block original image URLs from GraphQL responses where applicable
#7887 Prevent non-images from being uploaded as badges or ranks
#7892 Prevent shared caches from storing permissioned attachment downloads
#7893 Purify Editor-type purchase custom fields written via the REST API and when rendered in the ACP
#7894 Purify Editor-type purchase custom fields written via the REST API and when rendered in the ACP
#7895 Record failed OAuth password-grant attempts against the account lockout policy
#7896 Use the SSRF-protected request path for Downloads linked screenshots, and re-validate redirects
#7897 Count byte-range downloads that don't start at byte 0 against Downloads usage limits
#7901 Remove downloads wait cookie
#7902 Show the same message on the forgot password screen no matter what
#7904 Use verified sale amounts when processing PayPal webhooks
#7905 Prevent dummy billing agreement IDs from modifying transactions
#7906 Prevent concurrent license activations exceeding maximum uses
#7907 Fix several issues with discount pricing
#7908 Fix security issues in the upgrader login
#7909 Fix security issue on upgrade completion page
#7910 Prevent multiple redemptions of the same gift card
#7912 Remove dead code for email preview
#7913 Prevent restricted administrators from merging administrator accounts
#7916 Encode quoted author name in GraphQL comment quotes (stored XSS)
#7917 Check Club Page view permission before building canonical redirect URL
#7918 Require explicit consented scope for OAuth token front-end sessions on REST+GraphQL clients
#7919 Bind cached CAPTCHA success to session and challenge, not IP
#7920 Bound hostname length before Punycode encoding in Url parsing
#7921 Validate Web Push subscription keys and contain per-subscription encryption failures
#7922 Fix TOTP used-code cleanup comparing step numbers against timestamps
#7923 Bind pending attachment claims to the submitting user for comments, replies, reviews and edits
#7924 Route CMS RSS widget fetches through the SSRF-protected request path
#7926 Restrict OAuth profile and cover photo sync fetches to public HTTPS destinations
#7945 Fix XSS in Admin login form and stream titles.
#7947 Reject internal Web Push endpoints
#7948 Back off unsigned bulletin refreshes and hide a withdrawn bulletin immediately.
#7950 Check comment item binding in multimod merge
#7951 Enforce album privacy on embeds and hide private album titles
#7952 Stop theme editor values and custom CSS running template PHP
#7953 Refuse executable filenames in theme resource import
#7954 Store theme designer images with the detected image type
#7955 Limit theme designer SVG uploads to ACP theme managers
#7957 Claim pending attachment rows by the post key.
#7961 Skip group permission saves for nodes the admin cannot manage.
#7964 Ignore a loyalty discount when that currency has no price.
#7965 Refuse deletion of another member's unmapped editor attachment.

These security related issues have been responsibly reported to us or identified via internal audits.

Thanks to:

Aria Akhavan for reporting the following issues found during their audit.

#7804, #7805, #7807, #7809, #7810, #7811, #7813, #7814, #7816, #7821, #7822, #7835, #7836, #7837, #7838, #7839, #7842, #7843, #7844, #7845, #7848, #7851, #7852, #7853, #7854, #7856, #7857, #7858, #7865, #7866, #7867, #7869, #7870, #7873, #7874, #7875, #7876, #7877, #7878, #7879, #7880, #7881, #7883, #7884, #7885, #7886, #7887, #7892, #7893, #7894, #7895, #7896, #7897, #7901, #7902, #7904, #7905, #7906, #7907, #7908, #7909, #7910, #7912, #7913, #7916, #7917, #7918, #7919, #7920, #7921, #7922, #7923, #7924, #7926, #7943, #7947, #7949

@Colonel_mortis for reporting

#7861, #7923, #7957

Lucas Brönner for reporting

#7965

Undisclosed customer for reporting

#7868