The 2.9.0.beta11 release includes security fixes for vulnerabilities in Discourse and several plugins, such as CVE-2022-39378, CVE-2022-39241, and CVE-2022-39356 jomaxro. New features include the General category as the default for new topics, a new require change email confirmation site setting, hiding the welcome topic until edited, and sidebar improvements allowing users to set preferred list destinations and providing admin links when default categories/tags are not configured. Additional updates include experimental new user tips, configurable user statuses via preferences, and dark mode category logos. The release also features plugin improvements for Assign and Chat, with bug fixes and UX enhancements across the platform.
Chat: Channel name and description susceptible to XSS CVE-2022-39279
Chat Integration: Insufficient Server Side Request Forgery protections CVE-2022-39241
OAuth2 Basic: Insufficient Server Side Request Forgery protections CVE-2022-39241
OpenID Connect: Insufficient Server Side Request Forgery protections CVE-2022-39241
General is the default category
For sites with the General category, it will now be automatically selected when a new topic is created.
New site setting: require change email confirmation
We’ve added a new site setting, require change email confirmation. When enabled, all users will need to confirm both their current email, and new email when changing it. When disabled, only staff users will need to confirm their current email when changing it.
Hide welcome topic if it hasn’t been edited
All Discourse sites come with a welcome topic that admins are suggested to edit when setting up their site. This topic is now hidden from non-admin users until an edit is made.
Sidebar: Allow user to set preferred list destination
Users can choose between Default or new/unread as the destination when clicking links in the sidebar.
Custom users statuses can now be configured via account preferences, /my/preferences/account in addition to the user menu. This change also allows site setting to edit and/or clear a custom status from a user as needed.
Dark mode option for category logos
Admins can now upload a second category logo which will be used for dark themes.
But wait, there’s more! We do our best to highlight new features and changes for you, but there’s always too many changes to detail. For a full list of new features, bug fixes, UX improvements, and more, be sure to review the Additional Features and Fixes listed below.
Plugin improvements
Assign
Bug Fixes
Show group icon for group notifications
Chat
New Features
Improve mobile chat index screen experience
Improved emoji selection
Enable flagging for DMs
Inline video player for video uploads
Link general chat channel to general category
Use direct_message_enabled_groups for DM access
Improve chat messages flagging.
Bug Fixes
Prevents silenced users to send messages
10ms might be too short for ios hack
Removes requestAnimationFrame
Improves iOS hack for momentum scrolling
Ensures actions backdrop is removed when collapsing on mobile
Channel index mobile issues
Move reaction emoji name from class to data attribute
Improve chat reactions store
Prevents exception when transcripting multiple messages
Don’t fail when trying to display DM flags in the review queue.
Makes emoji filtering case insensitive
Remove hijack on webhook and improve documentation
Ensures emojis have a title in the picker
Default is now only used for custom emojis
Prevents shimmer effect to apply to sidebar
Prevents selected toned emoji to append t1
Firefox uses relatedTarget for toElement/fromElement
Prevents blank screen on ios on initial load
Avoids blank screen on ios on sticky scroll
Stalled core emoji cache could return emojis without search_aliases
Ensures we reset selecting messages when switching channel
Prevents scrollbar to appear over content on android
