VaultWiki News

VaultWiki 4.0.0 Release Candidate 5 is now available to all licensed customers. Thanks to some intensive testing by various members of the community in the past month, RC 5 is among the largest maintenance releases we've ever released, in terms of the sheer number of issues resolved. Thus, we maintain the Release Candidate status with this release.

There are also a number of minor features and other significant changes in RC 5 that deserve some mentioning.

Sidebar and Discussion Management

We have added a new setting to the Area Manager which allows admins to tailor which Sidebar Blocks might be best suited in particular wiki areas. For example, maybe you don't want Recent Activity to tempt readers away when they are viewing a product details page, or perhaps Custom HTML blocks are only relevant to specific areas.

It is now possible to tailor Sidebar Blocks and Allowed Discussions for the Wiki Index itself. Previously, every sidebar block and every discussion would be shown on the index and area-based permissions would have no effect in this context. Beginning with RC 5, the wiki index has its own settings in the Admin Panel that resolve this issue.

XenForo Admin Merge

As of RC 5, the standard VaultWiki Admin Panel is no longer available on XenForo platforms. Under XenForo, all of the wiki admin panels have been added to XenForo's own Admin Control Panel under a new "Wiki" tab.

Further, reported wiki content and wiki content awaiting moderation have been merged into the respective XenForo centers for reported and moderated content.

MediaWiki Offer Ends

With the release of RC 5, our previous offer of free MediaWiki migrations has now expired. Thanks to the participation and excitement of those who redeemed the offer earlier this month, we believe that the MediaWiki importer is probably the most solid of any importer we currently offer.

From this announcement, you should now purchase an Import Service if you wish to have one of our staff perform a MediaWiki import on your behalf.

Release Notes

VaultWiki 4 RC 5 should be usable on vBulletin-based and XenForo-based production sites.

VaultWiki 4 RC 5 is proposed as stable for community evaluation. Further significant bugs will delay a 4.0.0 release and result in further release candidates.

Over the past several days, while helping clients manage migrations from MediaWiki, we received reports of a possible performance issue. It turned out that this issue was actually quite insidious, because under the right circumstances and completely unprovoked by any external malicious intent, XenForo was able to use VaultWiki to launch a DDoS (distributed denial of service) attack against itself, while using normal forum traffic as pawns to carry out the attack.

We immediately patched the issue from VaultWiki's side, and have released Patch Level releases for Release Candidates in the VaultWiki 4.x series:

• 4.0.0 RC 4 Patch Level 1
• 4.0.0 RC 3 Patch Level 2
• 4.0.0 RC 2 Patch Level 2
• 4.0.0 RC 1 Patch Level 2

We highly recommend that all users running VaultWiki 4.x in a production environment upgrade to a patched release as soon as possible.

This vulnerability affects all supported versions of VaultWiki 4.x, including VaultWiki Lite. It does not affect VaultWiki 3.x.

Details

This attack cannot be launched by any malicious user against your forum. It occurs when an administrative task in VaultWiki that requires deferred.php functionality returns an error response and causes a chicken-and-egg problem, because deferred.php is not equipped to handle error responses.

For XenForo sites, there are elements in both XenForo and VaultWiki that contribute to make the attack particularly unyielding, but we have patched the issue from VaultWiki's side. Note that it is not possible to halt the attack once it begins in XenForo without making manual changes to the database; even temporarily disabling VaultWiki will not reliably stop the attack.

Furthermore, ongoing attacks have been known to result in race conditions that have the potential to increase the size of some database tables and that eventually result in memory limit errors throughout the website while VaultWiki remains enabled. These runaway database entries are not the focus of this patch, but the race condition should be mostly avoided by closing the attack vector. The unwanted database entries will be automatically cleaned by an upgrade script bundled with a future release (Patch Level releases do not utilize the upgrade process).

The attack is also possible under vBulletin, but it is possible to halt the attack once it begins in vBulletin by disabling VaultWiki.

If you were previously under attack and stopped it, it is possible for the attack to 'reboot' at unexpected times in an unpatched environment.

Whether you are currently under attack or not, the best defense is to upgrade to a patched version. In a patched release, VaultWiki will be able to detect a scenario where its deferred tasks are being used to launch a DDoS attack and will automatically prevent those tasks from executing.

Temporary Mitigation

If you cannot upgrade at this time, and you believe you are under a deferred.php or wiki_ajax.php?c=deferred attack, you should be able to mitigate an attack manually by executing the following MySQL command:
Note that this will stop all currently queued deferred tasks from running, such as cleanup tasks, and will likely affect the integrity of some wiki data. This option should only be used as a last resort.

VaultWiki 4.0.0 Release Candidate 4 is now available to all licensed customers. This is mainly a maintenance release, which fixes a small number of minor bugs that were reported since RC 3.

MediaWiki Imports

With RC 4, the ability to import data from MediaWiki has returned. There are several improvements over the VaultWiki 3 system, including the ability to import edits of deleted pages, old versions of attachments, and customizations to the index page.

Until the next release, we are offering 1 month of VaultWiki and an Import Service for free for new users who wish to migrate from MediaWiki. This should help us iron out any remaining issues in the import process fairly quickly. Simply send a PM to pegasus after signing up.

Release Notes

VaultWiki 4 RC 4 should be usable on vBulletin-based and XenForo-based production sites.

VaultWiki 4 RC 4 is proposed as stable for community evaluation. Further significant bugs will delay a 4.0.0 release and result in further release candidates.

This past weekend, while investigating a minor bug, our development team discovered a serious security vulnerability in VaultWiki's FILE BB-Code.

We immediately patched the issue, and have released Patch Level releases for Release Candidates in the VaultWiki 4.x series:

• 4.0.0 RC 3 Patch Level 1
• 4.0.0 RC 2 Patch Level 1
• 4.0.0 RC 1 Patch Level 1

We highly recommend that all users running VaultWiki in a production environment upgrade to a patched release as soon as possible. Note that because the FILE BB-Code does not exist in VaultWiki Lite, VaultWiki Lite is unaffected by this issue.

Details

The FILE BB-Code vulnerability can allow any user with posting permissions to embed malicious Javascript code on site pages that allow BB-Code. It is relatively easy to exploit, provided the wiki has been setup using a specific configuration that we have historically and will continue to recommend on our web site.

This vulnerability affects all versions of VaultWiki with the FILE BB-Code active (or a variation of it), including VaultWiki 3.x series, and VaultWiki 2.x series with the Special:Images add-on. Please note that since VaultWiki 3.x received its End-of-Life almost a year ago, there is no patch for that family or earlier, and it is now no longer available for download.

If you are currently using an unpatched version of VaultWiki, it is highly recommended that you upgrade immediately or disable the FILE BB-Code completely via VaultWiki's Syntax Manager (in 3.x series and earlier, this was called the Wiki Code Manager).

If you cannot upgrade yet for any number of reasons and disabling the BB-Code is not an option for your site, alternatively you can purchase an Upgrade Service and use it as a request that we manually apply a patch your installed version.

Please understand that we cannot post specific line-by-line patching instructions without risking being more specific about how to exploit the vulnerability.

VaultWiki 4.0.0 Release Candidate 3 is now available to all licensed customers. This is mainly a maintenance release, which fixes a significant number of minor bugs and regressions from the 3.x series, and brings the known unresolved bug count below 5.

Please note that with RC 3, cleanup tasks related to the phrasing and language systems have been completed. Beginning with RC 3, anywhere in VaultWiki that phrases appear to be missing should be logged as a bug.

More Extensible for Third-Party Plugins

VaultWiki 4 RC 3 introduces a Class Proxy System which allows third-party add-on developers to extend VaultWiki's core classes without interfering with VaultWiki's ability to extend those classes internally, and without interfering with other add-ons that wish to do the same.

XenForo add-on developers are familiar with this kind of approach, although VaultWiki's system allows further extension out "sideways" due to its abstract nature and the ability to support multiple forum platforms.

The new plugin/event locations vw_load_controller, vw_load_model, and vw_load_view allow you to do just this. XenForo's Code Event Listener creation interface features a detailed explanation of how to implement this system in modifications. The comments in /vault/core/model/vw.php offer a bit more information if needed or if you are using vBulletin.

WIDGET BB-Code

The new WIDGET BB-Code allows users to create a variety of different blocks, including:

• Multi-page: Small blocks of content split into multiple views or pages
• Multi-page-auto: Animated "paged" content
• Book: Book table of contents
• Forum: Titles of recent threads in a forum
• Thread: Thread-list view of recent threads in a forum
• Special: Output from a Special page
• Area: Titles of recent wiki pages in an area
• Group: Titles of recent wiki pages in a group
• Category: Titles of wiki pages in a category

Widgets can be styled with DIVs, placed inline, or promoted to the sidebar.

Support for DigitalPoint Sphinx Search (vB4 only)

VaultWiki 4 RC 3 ships with a module for DigitalPoint's Sphinx Search add-on for vBulletin 4, which will allow your users to search your forum again without receiving missing index errors while both mods are installed.

The module is included in the do_not_upload folder and should be uploaded to the same directory as DigitalPoint's Sphinx configuration. After uploading the module, you will need to issue a rotate-all command before Sphinx will be able to read the wiki indexes.

Release Notes

VaultWiki 4 RC 3 should be usable on vBulletin-based and XenForo-based production sites.

VaultWiki 4 RC 3 is proposed as stable for community evaluation. Further significant bugs will delay a 4.0.0 release and result in further release candidates.

We are pleased today to announce the immediate availability of VaultWiki 4.0.0 Release Candidate 2. This release features significant stability improvements, as well as a handful of new functions designed to improve social interactions for wiki content.

Social Sharing

VaultWiki 4 RC 2 comes with a new "Share This Page" sidebar block, which should be enabled by default. On forums that already allow other forum pages to be shared on social media sites, this adds those same sharing links so that users can now promote your wiki pages to friends around the globe.

For vBulletin users, this means Facebook Like or Recommend functionality is now available. Social bookmarks like Digg, del.icio.us, StumbleUpon, or whatever you have setup in vBulletin's Social Bookmarking Manager are there, too.

For XenForo users, this means Facebook Like, Twitter, and Google Plus buttons are available, as well as integration with the AddThis service.

VaultWiki provides the option to hide your visitors' browsing data from these third-parties until each user is actually ready to use the service. Keep in mind, however, that this proxies requests to third-party sites through your own web server, and therefore has a slight impact on server performance.

How to Link

In the same Sharing box, VaultWiki also shows how to link to the current page from other posts in the same web site, via BB-Code, and other sites around the web. If the current page represents a special resource, like an image or a template, the box will also show how to make use of that resource.

New Comment Features: Reputation for vB, Selective Quote for XF

The headline says it all. VaultWiki now allows vBulletin users to give each other reputation points for wiki comments that they've posted, just as they can with other vBulletin forum posts.

For XenForo users, we've added support for the new Selective Quote feature, which streamlines the process of quoting comments made by other users.

Printable Wiki Pages

If you've ever had a particularly informative wiki page that you or your users wished they could store on hard-copy to read or reference later, to show someone else, or just to file away, then you've been aware that VaultWiki's wiki pages have never been particularly printer-friendly.

That has changed in RC 2. Each wiki page now includes a printer-friendly version that can be accessed by clicking the printer icon next to the page's title.

The printer-friendly version of every wiki page is a simple document, focusing almost entirely on the page content, with default styles that should make it easier to read on paper. The top of the document also includes the site logo, site name, as well as the wiki page title, some of the page's contributors, and the original page URL.

Changes to Sidebar Blocks

Previously it was only possible to have one copy of each Sidebar Block on a wiki page. While this was okay for the blocks that were available already, RC 2 now includes the ability to make your own Sidebar Blocks based on Custom HTML.

For this reason, and to support more use cases moving forward, we've changed all the existing blocks into primitive Block Types. Now admins can create multiple copies of sidebar blocks based on any of these types.

In theory, this means you can have 3 search boxes on one page, but we expect it to be used more often for 3 different Custom HTML blocks.

Release Notes

VaultWiki 4 RC 2 should be usable on vBulletin-based and XenForo-based production sites.

VaultWiki 4 RC 2 is proposed as stable for community evaluation. Further significant bugs will delay a 4.0.0 release and result in further release candidates.