Q2A 1.7.5 - security release

Question

A security issue has been discovered in Q2A (affecting all versions) so we're releasing a new version, 1.7.5. Big thanks to 'l3m0n' who reported the issue. I've informed Gideon, who should prepare a download and update the website soon. UPDATE: v1.7.5 now available here.

In the meantime, the quickest and simplest fix is to replace the file qa-include/qa-install.php in your site with this one from the Q2A Github repository. I recommend all site owners do this asap. (Alternatively you could delete the file as it's not required after you've installed Q2A.)

The fix has also been pushed to the master and dev branches on Github so you can download the latest code from there if you like. This also includes some other minor bug fixes that were in the dev branch and due to be part of 1.8, but they will be in 1.7.5 instead:

• Use site language for reCAPTCHA.
• Add site language to HTML tag.
• Change from / reply-to for feedback form.
• Fix missing icon on private messages in SnowFlat theme.
• Fix users being unable to see all their own profile fields.
• Minor validation fixes.

Comments

To see the changes, just use the compare feature in github: https://github.com/q2a/question2answer/commit/6013ca1c83bf232008f7be815c0e4821fb6b120a#diff-956d4bd1a1cac02a9a381ffc25913c20

---

After update my site url link not use cyrillic symbol.
Example: Q2A 1.7.5 - security release
http://www.example.com/58970/q2a-1-7-5-security-release
Example: Как это работает?
http://www.example.com/58970/ not show Humanly understandable URL. Not use "Как это работает?" symbol.

---

@yerbol89kz, it will be good if you provide site url. Difficult to know what is happening just from your statements.

You can remove site url from post once issue is resolved.

---

@yerbol89kz I think that's due to the option "remove accents from URLs". Sounds like from your other problem that you're using v1.8 not 1.7.5. In v1.8 that option removes all non-ASCII characters i.e. everything except a-z or 0-9.

Answer 1

I wished we had a newsletter or another notification system for security flaws. Most CMS for instance have something like this in their admin panel. Q2A checks for new versions also on /admin/stats

Answer 2

After update my site category list not show. Why?

Comments

Not show url question id after text.
https://habrastorage.org/web/84e/9bb/732/84e9bb732f5a4dfebc0808120b67bec8.png

---

Strange, I can't see any reason why that would happen. First double check you still have the appropriate options set e.g. Admin > General > Question classification.

Then if you're using a custom theme, check any theme mods you've done in case something is stopping sidebar output.

---

https://surak.baribar.kz/
I checked. There everything is in order.
Classification of questions:  Tags and categories

---

I tried a fresh install of 1.7.5 and categories work fine for me. It must be something with your theme. Have you changed any of the theme functions like sidepanel() or nav() etc?

---

I previously installed the current version of q2a version 1.8. Work good. And i download in github https://github.com/q2a/question2answer/tree/1.8 this version.

---

If you're using Q2A 1.8 then the categories are now a widget. It should have added the widget automatically when upgrading to 1.8 but if not you can add it manually on the Layout admin page.