VaultWiki RC 3 / Security Patch

Earlier in the week, we discovered a possible XSS vulnerability in all previous versions of VaultWiki. The new releases 2.5.7 Patch Level 1 and 3.0.0 RC 3 contain the changes that fix this hole. Even though this particular vulnerability requires some special circumstances, we recommend updating immediately to ensure you are protected.

Because of this discovery, RC 3 does not contain many of the features that were planned for its release, but it does contain roughly 60 bug fixes. Notably, we improved performance on Special pages, and fixed the subscriptions to daily and weekly wiki edit notifications.

New Directory Structure

The directory structure and file names used by VaultWiki have been changed. To have the smoothest upgrade process and avoid making your forums inaccessible, we recommend:

1. Have a copy of the /vault folder from RC 2 ready in case you need to rollback. If you follow these instructions in order, you should not have a problem.
2. Disable VaultWiki via the Product Manager in the AdminCP.
3. Delete the /vault directory on your server. MAKE SURE VaultWiki is disabled before you do this, or you'll have to replace the RC 2 folder and start over.
4. Upload the new RC 3 files.
5. Proceed to upgrade normally.