5.1.0 Beta 3

#6680 Fix Redis shutdown flushing sessions that were never started
#6815 Tweak color of active tab in dark mode
#6816 Remove user-select from tooltip
#6831 Added padding to TOC's paragraph
#6839 Removed Underscore JS
#6840 Upgraded jQuery to 4.0.0
#6841 Only load Safari polyfill when needed
#6857 Fix member export with php 8,5
#6867 Drip Campaigns
#6868 Limit achievement points within a time frame
#6869 Restricted Tags
#6872 Ensure previously active tab is active after page reload
#6873 Added stable scrollbar to prevent page jumping
#6874 Ensure ipsGrid--min-x and ipsGrid--max-x classes work when a gap is applied
#6875 Removed excess space in RTL Safari
#6879 Change disabled state of "Add" button
#6882 Converted ajax loading element to popover
#6891 Removed underscore dependency from iro color picker
#6907 Replaced all <a href="#"> elements with <button>
#6956 Events;
#6967 Update Google Places autocomplete to use the new API
#6968 Remove all reliance on core_theme database tables for core apps
#6983 Updated the design of error, install and upgrade pages to use v5 branding, including dark mode
#6986 Improved UX and accessibility of Notification Settings page
#6987 Simplified mention UI
#7013 Event Registration
#7016 Improved accessibility of ACP search modal
#7056 Event Tickets
#7058 Addressed multiple UI bugs and inconsistencies
#7064 Fix incorrectly formatted timestamp in quotes
#7065 Added new fonts to Theme Editor: Montserrat, Noto Sans, Noto Serif and Public Sans
#7066 Replaced data-ipssidemenu in favour of a native label/input structure
#7070 Modernized the select tree component, resulting in improved accessibility and performance
#7092 Polished member grid
#7109 Events Wrap-Up
#7117 Added new fetchcard component, improving keyboard accessibility for certain areas
#7122 Polished UI of tags page and added dates to event entries
#7137 Translate height of tabbar content
#7140 Converted color scheme picker into dropdown
#7148 Courses
#7151 Removed reference to unused loadCodeHighlightingCSS function
#7152 Tweaked background-color of the base swatch to more accurately reflect value
#7155 Ensure thumbnails in Featured Content widget are aligned into grid
#7158 Improvements to the FrontNavigation main menu
#7172 Improved alignment of navigation dropdowns in browsers which don't support popover
#7173 Removed Javascript for toggling dialogs in favour of command/commandfor
#7174 Removed references to the mini profile as it's no longer used
#7180 Remove fetchcard debug markup from globalTemplate.phtml
#7188 Improved the UI of star ratings, including full keyboard accessibility
#7193 Implement external QR code so attendees can check themselves in at events
#7201 Feature/courses reviews
#7214 Added a "password peak" button to password inputs
#7215 Added "Go to this post" link to featured comments
#7219 Implement badges and certificates for courses
#7221 Fix an issue where the Google Maps ACP notification would not be removed
#7222 Allow for digital signatures in Google Static Maps requests
#7227 Add an activity stream sidebar to the course page
#7230 Fix an issue where fluid forum views always ran exact topic counts.
#7234 Use menu() methods for profile hovercard and for messenger conversations
#7241 Reduce the number of queries for theme editor settings on each page load
#7242 Reduce the number of queries when calling Content::routedClasses()
#7243 Reduce the number of queries when loading CMS pages
#7245 Improvements to content tables
#7246 Reduce the need for joins on the core_permission_index table
#7248 Events tab UI: button spacing and scroll-to-tabs after reload
#7250 Add In-Reply-To headers to comment/review emails
#7259 Ensure priority navigation works
#7261 Updated Course index grid so it matches the design of other apps
#7267 Improved UI of Event Venue page
#7269 Improved UI of database filters
#7277 Fix an issue where the club header shows twice
#7278 Fix an exception when viewing pages revisions
#7280 Fix an exception when viewing topics on a user's profile
#7286 Fix an issue where forum topic queries always applied password filters.
#7288 Clear cached campaign reach on save
#7289 Additional achievement actions
#7292 Migrated search filters and PWA content to fetch components
#7293 Improved the UI of the Autocomplete component and the Achievement Rules form
#7294 Improved alignment of tags in "expanded topic list"
#7295 Added settings to remove icons on side panel and mobile
#7303 Resize and clip password inputs in the ACP
#7311 Add optional cutoff date for drip campaigns
#7315 Lock down the event tickets feature behind a license key flag
#7317 Limit the number of courses that can be created on individual plans
#7318 Updated the reactions UI to make it more accessible
#7320 Fix an issue where IP lookups for members with many IPs throws an exception
#7326 Improved formatting of invoice flow
#7340 Changed some instances of aria-selected to aria-current to improve Voice Over navigation
#7341 Fix broken Followed Content page
#7347 A bunch of very minor things that were getting on my nerves
#7348 Fix an issue where gallery albums could not be viewed
#7367 Add missing language string
#7376 Remove excess space from Post Feed
#7391 Fixed popovers in Safari 15
#7392 Limited Content Views
#7394 Fix stale theme editor settings cache after install
#7399 Restore stable CSS order when building theme.xml
#7400 Fix instant notifications crash when localStorage is empty
#7401 Redesigned ACP navigation to use click-based UI for improved accessibility.
#7402 Fix calendar_event_organizers primary key allowing NULL
#7408 Ensure the desktop menu can cater for multiple reactions
#7411 Disable multi-selects when the "All" checkbox is checked
#7415 Dark mode email improvements, including new logo setting
#7422 Pages API
#7423 Fix potential error with date columns in records
#7443 Reduce Tiptap typing lag from HTML sync;
#7454 Prevent the form from being submitted twice
#7455 Fixed alignment of dialog on small screens
#7456 Fixed certain for/id attributes, ensuring labels and inputs are connected correctly
#7457 Updated a few remaining menus to use aria-current instead of aria-selected
#7458 Prevented the emoji picker from becoming squashed when moving between tabs in iOS
#7465 Prevent double-click on alert buttons
#7466 Fix an issue where clearing table filters did not update the advanced search button
#7467 Prevent invalid default values on Pages custom fields
#7468 Fix an issue where invalid parameters to the redirect controller would throw an exception
#7469 Implement additional reporting for Commerce Subscriptions
#7470 Fixes member widget not caching properly
#7471 Fix meta info not showing on featured content
#7476 Fix internal URL referrer confusion
#7477 Fixes custom error messages in forums not showing
#7478 Fix REST API not logging items / comments pending approval
#7480 Tightened spacing of new ACP navigation
#7490 Remove transitions from Theme Editor tabs
#7491 Increased gap between social icons in Tell A Friend widget
#7493 Ensure the badge creator works inside dialogs
#7496 Disable the Download Pii button after click
#7497 Fix an issue where some images in posts were not being properly added to a lightbox
#7498 Restore the ability to set a custom theme for a database page
#7499 Fix timestamp on ModCP Announcements table
#7500 Make sure the user's timezone is always valid
#7501 Fixed alignment of fields in New Email Campaign form
#7502 Scroll to the active tab if it's outside of the initial view
#7503 Converted .ipsModal to <dialog> for a more accessible 2FA interface
#7504 Instantly change Theme Editor and Account Settings tabs
#7505 Use field-sizing on editable topic titles
#7507 Hide tooltips on touch devices
#7508 Improved layout of certain tables on mobile
#7513 Add some missing search keywords
#7514 Conditionally load Page Editor CSS/JS files
#7516 Use new rule properties for grid borders
#7520 Skip unnecessary query in permission checks
#7521 Adjust::usableTagsCount to use caches rather than an expensive query
#7522 Major cleanup for counts and enrollments
#7523 Fix permissions for event/guest registration
#7524 Update events API with appropriate permission checks
#7525 Fix being unable to opt-out of MFA
#7526 Hide group form options when "Can access site?" is set to No
#7533 New theme hook points for the mobile search panel
#7534 Multiple improvements  to  Commerce custom products
#7535 Show event date in all Item form fields that use the Event class
#7541 Improved rendering of certain popover elements in legacy browsers
#7553 Removed the inaccessible tooltip in favour of static text
#7554 Ensure keyboards can safely navigate .ipsData--minimal carousels
#7555 Improved contrast levels for certain text/background combinations
#7556 Prevented duplicate id/popovertarget values on pagination components
#7557 Improved keyboard navigation for Activity Streams and Events
#7559 Prevent long URLs from stretching emails in Outlook
#7560 Add a supportAccount flag to the member API output
#7561 Fix an issue with copying custom downloads fields to other categories
#7562 Fix an issue where uninstalled applications could block creation of UI extensions
#7564 Fix an issue where custom templates were always flagged as edited
#7565 Fix multiple issues with insert definitions in the developer center
#7566 Prompt admins to update quest participants when tasks are added
#7567 Change gallery_bandwidth.bsize to BIGINT
#7568 Ensure focus outlines on buttons have sufficient contrast
#7570 Added focusable links to Profile Followers and Club Members
#7571 Fixed "Share on Reddit" lang string
#7573 Added text to empty links
#7575 Fixed the aria-attributes in breadcrumbs
#7576 Added accessible text and tweaked the tooltip for mini pagination
#7582 Add captcha to alternative contacts form.
#7584 Downloads: Use pluralized lang tag instead of separate number/lang tags
#7586 Update TipTap to 3.30.6
#7590 Fix TikTok's not embedding when shared from a mobile device
#7598 Fix club members not able to submit blog entries when allowed to
#7603 PHP 8.2–8.5 compatibility
#7606 Updated UI
#7607 Only revert certain elements
#7608 Fix extension stub method signatures
#7610 Prevented database linked topics from being merged.
#7611 Fix broken calendar daily view
#7612 Fix a 404 when flagging a user as a spammer and the action is to delete content
#7616 Fix an issue where some fields were not showing when creating a new stream
#7617 Fix an issue where the username field was incorrectly recognized as a login field in the Account Settings
#7618 Fix an issue where mass moving members required multiple attempts
#7619 Fix an issue where the Quick Translation tool could not be used on dialogs in the ACP
#7627 Convert base64 images to attachments (paste from Google Docs retains images)
#7628 Removed duplicated <head> code from live topics wrapper
#7634 Display reactions in a more compact UI on mobiles
#7636 Fix editor lockup when quoting on Android Chrome
#7637 Reduce Tiptap typing lag from quote layout and node-view effects
#7640 Fix issues with showing relative dates
#7645 Fix issues with loading custom theme settings.
#7649 Fix error closing follow modal
#7653 Underscore References and Old Bundles
#7654 Added header hooks
#7658 Fix multiquote button reloading the page
#7661 Fixed blog dropdown menus
#7665 Let the editor toolbar stick on content forms.
#7615 Fix an issue where advertisements were not repeating on the page
#7680 Commerce: Prevent prices from wrapping to multiple lines in Cart dropdown
#7706 Check attachment permission before serving database storage URLs
#7794 Stop signing legacy XenForo proxy image URLs into off-site redirects
#7804 Prevent Administrator Group Assignment
#7805 Fix potential pages upload field SQL injection
#7806 Updated "Change reaction" to "Select reaction"
#7807 Fix legacy gallery URL's revealing private images
#7809 Fix various comment permissions issues
#7810 Fix revisions loading for records they don't belong to
#7811 Fix topic copy to database permission issues
#7813 Fix commerce transaction API permission check
#7814 Fix anyone being able to be able to see club pages when no one but leaders and owners should
#7815 Added mobileFooterList hook to mobile footer
#7816 Stripe Redirector & Webhook fixes
#7821 Fix MFA bypass when changing email after validating for a previous ch…
#7822 Fix loose check for security question answer
#7826 Ensure ACP tabs transition smoothly
#7828 Fix an issue where the "All" filter in Reported Content did not work
#7829 Fix an issue where some ModCP tabs were showing to users with no permission
#7835 Fix admins modifying / deleting their own admin rows via URL manipula…
#7836 Fix admins deleting cards not belonging to the member via URL manipulation
#7837 Fix admins placing themselves into other admin groups via secondary g…
#7838 Escape search term when searching email templates
#7839 Make Content Count MemberFilter safe
#7840 Normalise file/folder names in FTP nlist.
#7842 Fix an issue where the wrong member can be added to an event in an import
#7843 Fix missing ACP restriction check on referrals history
#7844 Validate poll votes submitted via GraphQL
#7845 Add permission check to uncropped club photo
#7846 Added hook to Commerce product page
#7848 Fixes issue with Pages address fields
#7851 Add missing ACP restriction checks
#7852 Fix an issue where group editors could change permissions on nodes
#7853 Fix an issue where users could delete others' attachments via GraphQL
#7854 Fix view permissions on records API
#7856 Fix an issue where the request DB parameter was used instead of the database ID
#7857 Use logged in member for react/report API calls
#7858 Check view permissions before following via API
#7860 Ensure we have a selected tab
#7861 Harden MFA validation
#7862 Fix deleting when WHERE uses table names.
#7863 Allow MemberACPManagement extensions to add filters and search parameters to the ACP list
#7865 Fix an issue where a downloads file version could be actioned using a different file ID
#7866 Fix an issue where private clubs where a GraphQL call could return private clubs
#7867 check canAcknowledge for the logged in member when acknowledging a warning
#7868 Fix SQL injection in database table sorting
#7869 Derive forced password reset links from a per-site secret
#7870 Require a signed response before storing update bulletins
#7871 Allow quest tasks to be completed for "other" members associated with a rule
#7872 Fix identifier for JoinClub achievement actions
#7873 Fix an issue where GraphQL could mark a topic solved with a post from another topic
#7874 Fix ACP restrictions on databases admin controller
#7875 Fix an issue where pending clubs were shown on the club map
#7876 Fix an issue where banned members could cancel the join request and rejoin
#7877 Fix an issue where a user could download a file for a different pages record
#7878 Add permission check when saving the sidebar for a pages page
#7879 Fix an issue where a user could download a hidden file version
#7880 Fix an issue where a user could change the status of a report they cannot view
#7881 Prevent users from searching members by staff-only fields
#7883 Block access to disabled GraphQL keys
#7884 Restrict access to member properties in GraphQL
#7885 Tighten security on task cron jobs
#7886 Block original image URLs from GraphQL responses where applicable
#7887 Prevent non-images from being uploaded as badges or ranks
#7892 Prevent shared caches from storing permissioned attachment downloads
#7893 Purify Editor-type purchase custom fields written via the REST API and when rendered in the ACP
#7894 Purify Editor-type purchase custom fields written via the REST API and when rendered in the ACP
#7895 Record failed OAuth password-grant attempts against the account lockout policy
#7896 Use the SSRF-protected request path for Downloads linked screenshots, and re-validate redirects
#7897 Count byte-range downloads that don't start at byte 0 against Downloads usage limits
#7901 Remove downloads wait cookie
#7902 Show the same message on the forgot password screen no matter what
#7904 Use verified sale amounts when processing PayPal webhooks
#7905 Prevent dummy billing agreement IDs from modifying transactions
#7906 Prevent concurrent license activations exceeding maximum uses
#7907 Fix several issues with discount pricing
#7908 Fix security issues in the upgrader login
#7909 Fix security issue on upgrade completion page
#7910 Prevent multiple redemptions of the same gift card
#7912 Remove dead code for email preview
#7913 Prevent restricted administrators from merging administrator accounts
#7916 Encode quoted author name in GraphQL comment quotes (stored XSS)
#7917 Check Club Page view permission before building canonical redirect URL
#7918 Require explicit consented scope for OAuth token front-end sessions on REST+GraphQL clients
#7919 Bind cached CAPTCHA success to session and challenge, not IP
#7920 Bound hostname length before Punycode encoding in Url parsing
#7921 Validate Web Push subscription keys and contain per-subscription encryption failures
#7922 Fix TOTP used-code cleanup comparing step numbers against timestamps
#7923 Bind pending attachment claims to the submitting user for comments, replies, reviews and edits
#7924 Route CMS RSS widget fetches through the SSRF-protected request path
#7926 Restrict OAuth profile and cover photo sync fetches to public HTTPS destinations
#7927 Update the course manager menu when switching between lessons
#7928 Add a title to the Create Lesson page
#7929 Fix an issue where viewing unpublished courses threw an exception
#7930 Fix the View Template button when customizing plugin block content
#7931 Fix an error when marking a lesson as complete
#7932 Fix bad ACP link when managing teams
#7933 Fix the menu option for unassigning items from the ModCP
#7934 Prevent empty values from being submitted for the RSVP limit
#7935 Hide the product association message on the product form where appropriate
#7936 Removed an obsolete language string
#7937 Fix "in stock" product filters to include unlimited stock
#7938 Fix an issue where form fields that use returnLabels can throw an exception with an empty selection
#7945 Fix XSS in Admin login form and stream titles.
#7947 Reject internal Web Push endpoints
#7948 Back off unsigned bulletin refreshes and hide a withdrawn bulletin immediately.
#7950 Check comment item binding in multimod merge
#7951 Enforce album privacy on embeds and hide private album titles
#7952 Stop theme editor values and custom CSS running template PHP
#7953 Refuse executable filenames in theme resource import
#7954 Store theme designer images with the detected image type
#7955 Limit theme designer SVG uploads to ACP theme managers
#7957 Claim pending attachment rows by the post key.
#7961 Skip group permission saves for nodes the admin cannot manage.
#7964 Ignore a loyalty discount when that currency has no price.
#7965 Refuse deletion of another member's unmapped editor attachment.

Known issues:

• License Key Invalid may show after upgrade. Use 'change license key' to re-enter and dismiss the banner.

These security related issues have been responsibly reported to us or identified via internal audits.

Thanks to:

Aria Akhavan for reporting the following issues found during their audit.

#7804, #7805, #7807, #7809, #7810, #7811, #7813, #7814, #7816, #7821, #7822, #7835, #7836, #7837, #7838, #7839, #7842, #7843, #7844, #7845, #7848, #7851, #7852, #7853, #7854, #7856, #7857, #7858, #7865, #7866, #7867, #7869, #7870, #7873, #7874, #7875, #7876, #7877, #7878, #7879, #7880, #7881, #7883, #7884, #7885, #7886, #7887, #7892, #7893, #7894, #7895, #7896, #7897, #7901, #7902, #7904, #7905, #7906, #7907, #7908, #7909, #7910, #7912, #7913, #7916, #7917, #7918, #7919, #7920, #7921, #7922, #7923, #7924, #7926, #7943, #7947, #7949

@Colonel_mortis for reporting

#7861, #7923, #7957

Lucas Brönner for reporting

#7965

Undisclosed customer for reporting

#7868