# 2.9.0.beta11: Beveiligingsfixes, Nieuwe algemene categorie, Verbeteringen aan de zijbalk en meer
**URL:** https://meta.discourse.org/t/2-9-0-beta11-security-fixes-new-general-category-sidebar-improvements-and-more/243627
**Category:** Announcements
**Tags:** release-notes
**Created:** [1 november 2022 om 17:34 UTC](https://meta.discourse.org/t/2-9-0-beta11-security-fixes-new-general-category-sidebar-improvements-and-more/243627 "2022-11-01T17:34:31Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [1 november 2022 om 17:34 UTC](https://meta.discourse.org/t/2-9-0-beta11-security-fixes-new-general-category-sidebar-improvements-and-more/243627/1 "2022-11-01T17:34:31Z")
## New features in 2.9.0.beta11
### Security Updates
This beta includes 3 security fixes for issues reported by our community and [HackerOne](https://hackerone.com/discourse).
- Restrict display of topic titles associated with user badges [CVE-2022-39378](https://github.com/discourse/discourse/security/advisories/GHSA-2gvq-27h6-4h5f)
- Expand and improve SSRF Protections [CVE-2022-39241](https://github.com/discourse/discourse/security/advisories/GHSA-rcc5-28r3-23rr)
- Fix invite link email validation [CVE-2022-39356](https://github.com/discourse/discourse/security/advisories/GHSA-x8w7-rwmr-w278)
#### Plugin Security Updates
Multiple plugins have also received security fixes. Be sure to update plugins in addition to Discourse.
- Patreon: [CVE-2022-39355](https://meta.discourse.org/t/critical-security-fix-for-the-discourse-patreon-plugin/242999)
- Chat: Channel name and description susceptible to XSS [CVE-2022-39279](https://github.com/discourse/discourse-chat/security/advisories/GHSA-qp62-8m3c-9jgj)
- Chat Integration: Insufficient Server Side Request Forgery protections [CVE-2022-39241](https://github.com/discourse/discourse-chat-integration/security/advisories/GHSA-xmc4-3rxg-q8jx)
- OAuth2 Basic: Insufficient Server Side Request Forgery protections [CVE-2022-39241](https://github.com/discourse/discourse-oauth2-basic/security/advisories/GHSA-qj5f-8cm8-rhf8)
- OpenID Connect: Insufficient Server Side Request Forgery protections [CVE-2022-39241](https://github.com/discourse/discourse-openid-connect/security/advisories/GHSA-xp93-7vr3-72c5)
### General is the default category
For sites with the #General category, it will now be automatically selected when a new topic is created.
### New site setting: `require change email confirmation`
We’ve added a new site setting, `require change email confirmation`. When enabled, all users will need to confirm both their current email, and new email when changing it. When disabled, only staff users will need to confirm their current email when changing it.
### Hide welcome topic if it hasn’t been edited
All Discourse sites come with a welcome topic that admins are suggested to edit when setting up their site. This topic is now hidden from non-admin users until an edit is made.
### Sidebar: Allow user to set preferred list destination
Users can choose between `Default` or `new/unread` as the destination when clicking links in the sidebar.
### Sidebar: Display link for admins when default categories/tags are not configured
We now add a link to the sidebar for admin users when they have not configured the `default_sidebar_categories` or `default_sidebar_tags` site settings
### New user tips (experimental)
> [@New User Tips](https://meta.discourse.org/t/new-user-tips-experimental-feature/243763):
>
> In the latest beta of Discourse, we introduced user tips explaining the most important features of Discourse (enabled by default; to disable it, navigate to your site setting and search for “enable user tips”). At this moment, there are user tips for: first notification topic timeline post menu topic notification level suggested topics admin guide: getting started ([shown to admins on new sites](https://meta.discourse.org/t/updates-to-new-site-experience-and-the-getting-started-guide/273189)) camera_flash Screenshots
### User status configurable via preferences
Custom users statuses can now be configured via account preferences, `/my/preferences/account` in addition to the user menu. This change also allows site setting to edit and/or clear a custom status from a user as needed.
### Dark mode option for category logos
Admins can now upload a second category logo which will be used for dark themes.
---
### Author:  [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [1 november 2022 om 17:34 UTC](https://meta.discourse.org/t/2-9-0-beta11-security-fixes-new-general-category-sidebar-improvements-and-more/243627/2 "2022-11-01T17:34:31Z")
### Even more!
But wait, there’s more! We do our best to highlight new features and changes for you, but there’s always too many changes to detail. For a full list of new features, bug fixes, UX improvements, and more, be sure to review the Additional Features and Fixes listed below.
## Plugin improvements
### Assign
> **Bug Fixes**
>
> - Show group icon for group notifications
### Chat
> **New Features**
>
> - Improve mobile chat index screen experience
> - Improved emoji selection
> - Enable flagging for DMs
> - Inline video player for video uploads
> - Link general chat channel to general category
> - Use direct\_message\_enabled\_groups for DM access
> - Improve chat messages flagging.
> **Bug Fixes**
>
> - Prevents silenced users to send messages
> - 10ms might be too short for ios hack
> - Removes requestAnimationFrame
> - Improves iOS hack for momentum scrolling
> - Ensures actions backdrop is removed when collapsing on mobile
> - Channel index mobile issues
> - Move reaction emoji name from class to data attribute
> - Improve chat reactions store
> - Prevents exception when transcripting multiple messages
> - Don’t fail when trying to display DM flags in the review queue.
> - Makes emoji filtering case insensitive
> - Remove hijack on webhook and improve documentation
> - Ensures emojis have a title in the picker
> - Default is now only used for custom emojis
> - Prevents shimmer effect to apply to sidebar
> - Prevents selected toned emoji to append t1
> - Firefox uses relatedTarget for toElement/fromElement
> - Prevents blank screen on ios on initial load
> - Avoids blank screen on ios on sticky scroll
> - Stalled core emoji cache could return emojis without search\_aliases
> - Ensures we reset selecting messages when switching channel
> - Prevents scrollbar to appear over content on android
> - Use sidebar contentCSSClass for muted channels
> - Staff should always be able to chat
> - Direct\_message\_enabled\_groups refinements
> - Closing button not visible on chat index page
> - Deleting old messages should also clear flags.
> - Prefers /chat/channel/:id/:title?messageId=x link
> - Tighten flagging restrictions for chat messages.
> - Correctly censors excerpts
> - Simplifies loading message code
> - Enforces chat\_channel\_id when present
> - Add missing translation chat\_message\_flag\_allowed\_groups
> - Make chat\_allow\_uploads apply to DM channels
> **UX Changes**
>
> - Fix link colour channel cards
> - Implements leave button on channel card
> - Adjusts composer/uploads padding
> - Ensures emoji picker search gets focus on first load
> - Double clicking one of your messages starts editing it
> - Moves new channel button to browse view
> **Accessibility**
>
> - Show emoji color options in WHCM
### discourse-voting
> **UX Changes**
>
> - Avoid double `li` tag in user-activity-bottom outlet
### discourse-calendar
> **New Features**
>
> - When user is on holiday set user status in core
> **Bug Fixes**
>
> - Calendar wasn’t resetting expired statuses
> - Disabling of header sorting now checks the correct site setting and defaults to false
### discourse-data-explorer
> **Bug Fixes**
>
> - Click not opening query
> - Errors when running query due to PG template patterns or comments
### discourse-perspective-api
> **Bug Fixes**
>
> - Add nil check for topic
### discourse-code-review
> **UX Changes**
>
> - Remove unnecessary `li` tag for user-activity-bottom plugin outlet
### discourse-subscriptions
> **Bug Fixes**
>
> - Simplify Stripe webhook handler
> **UX Changes**
>
> - Make styling consistent with everything else
### discourse-policy
> **New Features**
>
> - Email notifications for policies
> **Bug Fixes**
>
> - Adds prefix to UserOption enums to avoid collision
### discourse-cakeday
> **New Features**
>
> - Separate sidebar links for anniv and bday
### discourse-shared-edits
> **Bug Fixes**
>
> - Validate post when committing revision
> - AppEvents.off error when destroying controller:topic
### discourse-reactions
> **Bug Fixes**
>
> - Do not override core rate limiting error message
> - Handle rate limit error messages on server side
> - Deleted topic should exclude it from reactions given
> **UX Changes**
>
> - Use a regular mouse cursor in popover
> - Remove unnecessary li tag for plugin outlet
> - Remove unnecessary li tag for user-activity-bottom plugin outlet
### discourse-automation
> **New Features**
>
> - Adds settings and enable\_manual\_trigger
> - Adds once support to auto-responder script
### discourse-question-answer-discourse
> **Bug Fixes**
>
> - Adjust QA answers header sorts in RTL mode
### discourse-footnote
> **Bug Fixes**
>
> - Do not registerPlugin if no window.markdownitFootnote
### discourse-gamification
> **New Features**
>
> - Added a setting for the default leaderboard period
> **Bug Fixes**
>
> - Update plugin canon repo
> **UX Changes**
>
> - Allow picking any leaderboard in minimal component
> - Add crown
> - Leaderboard minimal styling
## Additional Features and Fixes
> **Click to expand**
>
> ### New Features
>
> - Reduce suspicious distance logins warning to 100km
> - Control topic width with variables
> - Generic hashtag autocomplete sorting
> - Add button to reset seen popups
> - Generic hashtag autocomplete part 1
> - Implement new onboarding popups
> - Show relative time when date is omitted
> - Add contentCSSClass for sidebar section-link
> - Double color for subcategories prefix
> - Adds seeded default categories to the sidebar
> - Preload resources via link header
> - Omit showing day when ‘to’ day is same as ‘from’ day
> - New outlet topic-list-main-link-bottom added to mobile
> - Handle oneboxes for complex GitHub URLs
> - When entering a topic scroll to last visited line marker
>
> ### Bug Fixes
>
> - Can’t change notification level of categories set to regular
> - Evaluate all callbacks rather than override them
> - Don’t notify topic author about small action posts
> - Follow up fixes for password-reset error page
> - Simplify display of multiple AJAX errors
> - Don’t attempt to add user again to a group when syncing groups via SSO
> - Ignore unique conflicts when backfilling sidebar defaults
> - Ensure that custom {{action}} modifier works with actions hash
> - A couple of topic elements are too wide
> - Move group-box group name from class to data attribute
> - Allow users already in automatic groups to log in
> - Add theme-color `` tag when a dark scheme is selected
> - Variable name typo
> - Reset error props on Topic model
> - Log user addition/deletion from groups when they’re changed via [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true)
> - Category chooser not updating selection when editing reviewable
> - Correctly reset `controllerReady` prop
> - Use only first line from commit message
> - Minor typo
> - Set max-width on category logo img
> - Clientside checks for personal\_message\_enabled\_groups
> - Set width on category logo img, not container
> - Do not show a 404 page when visiting messages
> - Correctly debounce various functions
> - Calculate header offset once on load
> - Skip all post validations if necessary
> - Ensure minification does not break colocated connectors
> - Do not include group less emojis in standard list
> - Sidebar\_list\_destination on CurrentUserSerializer
> - Ensure dropdown is above sibling labels
> - Sidebar list destination for tracked and tags
> - Exclude hidden topic posts and small actions from the RSS feed.
> - User card focus state appearing on click
> - Clarify security key copy
> - Reset general\_category\_id if the general category was deleted
> - Prevent layout shift while traversing dropdown
> - Adjust the users per trust level cells in RTL mode
> - Remove RS384 and RS512 cose ciphers
> - Show timelines dates as clickable
> - Action\_code\_path not being loaded for user-stream-item
> - Missing category badge for category with color stored as 3-digit hex code
> - Category sidebar link not active when filtered by none and all
> - Replace prefixCSS with prefixElementColors
> - Remove `nil` items before sorting the sha1 string array.
> - Reset related site settings on general category delete
> - Status emoji was shown on the left on mobile
> - Alignment of user status emoji on posts
> - Correctly handle HTTP errors during dominant color calculation
> - Typo
> - Warning about sidebar prefix style
> - User field styling on login
> - Change text
> - Staff action log ‘show details’ links
> - Ensure local date format shortcuts work correctly
> - Ensure poll type toggle buttons function correctly
> - Deprecated settings should not override from UI
> - Hide old PM settings
> - Show error if field is same as password
> - Remove public topic invite functionality
> - Do not show welcome CTA banner if the welcome topic is deleted
> - Ensure group inboxes in messages section is sorted by group name
> - Determining local date same range is erroring when there is no date
> - Arrive at topic must be hidden when `must_approve_users`
> - Improve error handling for `calculate_dominant_color!`
> - Do not prefill default site title value on wizard introduction step
> - Make sure first admin users are added to auto groups
> - Watched topic overcome muted category
> - Ability to trigger emoji after indented code block
> - Missing sidebar section link icon for PM tags
> - Link to `discovery.category` in sidebar`
> - Skip quality title validations for static topics when edited by admin
> - Count resulting bulk invites correctly
> - Do not show user status on posts twice
> - New general category changes preventing topic create
> - Review sidebar link showing for users that can’t review
> - Workaround a bug in the R2 gem to produce valid RTL CSS
> - Allow email login for admins in staff-writes-only-mode
> - Allow logout for admins in staff-writes-only-mode
> - Remove zero-width space when not necessary
> - Add better and more strict invite validators
> - Revert recursively tag lookup with missing ancestor tags
> - Missing theme upload should not break precompile process.
> - Removed bookmark reminder alert for reminders set in the past
> - Ensure closing sidebar tears down all callbacks.
> - Quirks around starting new uploads when one was in progress
>
> ### UX Changes
>
> - Ensure image size is maintained even after loading error
> - Switch no categories/tags configured text in sidebar to a link
> - Fix grammar typo in trust\_level\_unlocked\_tip
> - Change emoji graphic on invite error page
> - Make whole category box clickable
> - Allow linebreaks mid-word in github onebox file paths
> - Use a friendlier educational message
> - Send notification of type `replied` to topic author if they’re watching the topic
> - Drag new user menus, scroll primary user nav
> - Fix user status display in autocomplete
> - Stop falling back to topic image on embeds
> - Improve autocomplete styling
> - Show category edit button when in tag intersection
> - Extend horizontal user nav to all user pages
> - Correct capitalization
> - Fix alt text cancel button in dark mode
> - Change button to grey
> - Simplify bootstrap mode visuals
> - Prevent reply to name from being longer than 400px
> - Welcome CTA edits
> - Theme setting highlight update
> - Horitzontal scroll controls for new user nav
> - Hide keyboard shortcuts on mobile
> - Onboarding edits
> - Conditionally display sidebar tags section for user
> - Conditionally hide sidebar categories section for user
> - Hide tags section in sidebar when user has no visible tags
> - Danger colour update
> - Updated styles for user nav with sidebar
> - Hide tags section from anonymous user when site has no tags
> - Correct colour to nav instead of danger
> - Default to dark category logo on dark schemes
> - Add more spacing to tab btns
> - Ensures we don’t focus invisible button in sidebar
> - `More...` → ` `More` in Sidebar
> - Hide sidebar on 2FA route
> - Change notifications nav icon in user page to bell
> - Add max-width to digest email, format erb
> - Fix post placeholder on mobile
> - Move dismiss button on the bottom to the right of the footer message
>
> ### Performance
>
> - Exclude anon sidebar tags in site serializer for logged in user
> - Move dominant color calculation to separate job
>
> ### Accessibility
>
> - Add keyboard support to youtube embeds
> - Add title to drafts remove icon button
> - Add `for` attributes for location, website in profile
> - Sortable header elements should have pointer
> - Add `aria-label` to topic post badges
> - Return focus to header search button upon escape of search
> - Improve group search accessibility
> - Improve user card appearance in WHCM
> - Add aria labels for posts in group activity
> - Improve topic timeline in WHCM
> - Bookmarks modal
> - Add `href` to frequent poster avatars
> - Improve accessibility in WHCM themes
> - Add more information to the “reply to” button label.
> - Signal the toggle header can reorder table elements.
> - Trap focus on auth security modal
> - Make input popup errors keyboard-accessible
> - Fix tab order in “Feature topic” modal
> - Make “Load parent post” element accessible
> - Set role=presentation if alt attr is missing