HumHub

This release also fixes security issues.

• Fix #8409: Add :focus styles for Administration left navigation menu items
• Fix #8420: Fix hover flicker and keyboard focus on profile image upload buttons
• Fix #8407: Make Select2 picker choices keyboard-accessible: the “Remove all items” button and each item’s own remove icon
• Fix #8426: Add a visible keyboard focus indicator for the stream filter toggle and its checkbox/radio filter options
• Fix #8430: Make the password show/hide icon focusable and operable via keyboard
• Fix #8439: Fix editing file-only Posts and clear fileList[] after posting so it isn’t reused on the next post
• Enh #8440: Add the user ID as tie-breaker to the default user list sorting for stable ordering and pagination
• Fix #8442: DatePicker date-format mismatches (month names, digits, whitespace) between jQuery UI and PHP intl/ICU across 35+ locales
• Fix #8445: Restrict direct space joins to free-join spaces, so “Invite and request” spaces require admin approval instead of instant membership
• Fix #8446: Restrict Topic management (create/rename/delete) on user profiles to the profile owner or users with full content management permissions
• Fix #8443: Prevent silent demotion of public content to private when saved by an editor lacking CreatePublicContent permission
• Fix #8451: Encode the redirect URL in the htmlRedirect view as a safe JS string so it can no longer break out of the inline
• Fix #8456: Block delegated admins from self-granting admin permissions and from editing/impersonating the System Administrator account
• Fix #8458: Compare old-theme Accent/Success colors to their own defaults, not the new theme defaults, in the 1.19 migration
• Fix #8485: Prevent group managers from removing default-space associations for spaces they don’t administer
• Fix #8486: Enforce InviteUsers permission on space membership search-invite to prevent member user enumeration
• Fix #8482: Remove stray ‘callback’ array key from Space event config
• Fix #8489: Add unique index on user_follow to stop race-condition follower-count inflation; catch duplicate-key errors in follow/like/friendship
• Fix #8490: Prevent private Content changes and comments from being emailed to subscribers who can no longer view them
• Fix #8493: A guest posting to the logout action (e.g. a stale tab resubmitting the logout form after the session already ended) triggered a TypeError in getCurrentAuthClient()
• Fix #8499: Encode the fieldset legend and class attribute rendered by the compat HForm