Self-host ejabberd

Release notes copied from the original ejabberd 26.09 announcement post:

We are pleased to announce the publication of ejabberd 26.09, which includes several security fixes, some improvements and other minor bugfixes. It is strongly encouraged that you update ejabberd as soon as possible.

Contents:

• Security fixes
• Fixed the ordering of some XML child elements
• New option for CAPTCHA POW
• ChangeLog
• Acknowledgments
• Improvements in ejabberd Business Edition
• ejabberd 26.09 download & feedback

Security fixes

This release contains fixes for those security issues:

• Unauthenticated Remote Code Execution on ejabberd (reported by Gia Bui) when:
  • ejabberd versions is at least 25.10
  • BOSH is enabled on any port
  • S2S is enabled
  • mod_adhoc_api is loaded
  • outbound connectivity from ejabberd on ports epmd (default 4369), s2s (default 5269) and Erlang distribution port (dynamically assigned, typically in the range 49152-65535 unless FIREWALL_WINDOW is set in ejabberdctl.cfg).
• DoS attack on 16.12+ versions if BOSH is enabled on any port.
• Cross-Tenant MUC, Roster and Shared-Roster unauthorized access (reported by Hoang Gia).

Fixed the ordering of some XML child elements

There was a reference-ordering problem in the fast_xml generator, it generated XML encoders that could reorder child elements in a different order from the one declared in the codec specification. From now, the order is the one declared in the codec specification. See details in processone/fast_xml#53

Additionally there was an incorrect sasl2_continue declaration order in the xmpp erlang library: it declared "additional-data, text, tasks". Now it follows the ordering defined in XEP-0388 schema: "additional-data, tasks, text". See details in processone/xmpp#112

New option for CAPTCHA POW

New toplevel option captcha_pow adds a SHA-256 hashcash challenge as described in XEP-0158 in the CAPTCHA form, alongside the image challenge or on its own.

Unlike the image challenge, this does not require setting the option captcha_cmd.

This option is used only by mod_register when registering a new account using In-Band Registration, not in MUC rooms or in mod_register_web. It is disabled by default.

Improved support for vhost-admins

It is well known how to grant administrative privileges to an account: by adding that account to an acl called admin:

acl:
  admin:
    user: admin1@localhost

The default ejabberd configuration uses this admin ACL in many places:

• the announce access rule used by mod_announce
• the configure access rule used by mod_configure and WebAdmin
• several api_permissions entries used to execute API commands in WebAdmin, mod_adhoc_api, mod_http_api, ...
• some shaper_rules
• many options modules, for example access_admin option in mod_muc

Consequently, that admin account can administer all of ejabberd: all the global features, all the modules, in all the vhosts... For now let's call it a "global admin".

If you have several vhosts, you can allow specific accounts to administer only specific vhosts. Let's call them "vhost-admins". In this example admin1@localhost can execute commands on all vhosts. Additionally, localhost has a vhost-admin, second has two vhosts-admins, and third has a vhost-admin:

hosts:
 - localhost
 - second
 - third

acl:
  admin:
    user: admin1@localhost

append_host_config:
  localhost:
    acl:
      aclhostadmin:
        - user: hostadmin@localhost
  second:
    acl:
      aclhostadmin:
        - user: hostadmin@second
        - user: hostadmin@third
  third:
    acl:
      aclhostadmin:
        - user: hostadmin@second

api_permissions:
  "vhost http access":
    from: mod_http_api
    who:
      access:
        allow:
          - acl: admin
        allow:
          - acl: aclhostadmin
    what: "*"

Example call of a vhost command by a vhost-admin:

$ curl --basic --user hostadmin@third:somepass -k \
  'https://localhost:5443/api/status_num_host?host=second&status=dnd'
7

If a vhost-admin tries to execute an API command directed to a vhost he does not administer, or a global command (that has no host argument, and affects all ejabberd), they are rejected:

$ curl --basic --user hostadmin@third:somepass -k \
  'https://localhost:5443/api/status_num_host?host=third&status=dnd'
{"code":32,
 "message":"AccessRules: Account does not have the right to perform the operation.",
 "status":"error"}

$ curl --basic --user hostadmin@third:somepass -k \
  'https://localhost:5443/api/stats?name=registeredusers'
{"code":32,
 "message":"AccessRules: Account does not have the right to perform the operation.",
 "status":"error"}

ChangeLog

Security fixes

• Unauthenticated Remote Code Execution on ejabberd
• DoS attack on BOSH
• Cross-Tenant MUC, Roster and Shared-Roster unauthorized access

Core

• Add force value to auth_external_user_exists_check option
• Add XEP-0158 SHA-256 hashcash CAPTCHA challenge (#4594)
• Add gen_mod:get_module_proc_check()
• Fix to preserve reference order in XML, done in fast_xml and xmpp (#4606)
• Get rid of couple *_to_atom
• Make ejabberd_cluster:*call operate only on known nodes
• More fixes for arguments in commands for vhost-admin
• Optimize acl:load_tab()
• ejabberd_systemd: Prefer matching over length/1
• Updated Portuguese-Brazil and Chinese-Simplified translations

Modules

• mod_auth_fast: Make sure that fast tokens can be used only with method that they were created for
• mod_invites: don't apply overuse limit if max_invites is infinity (#4615)
• mod_invites: don't crash in get_invite_by_invitee_t if reset_token present (#4620)
• mod_invites: now that Conversations is for free we remove Yaxim (#4621)
• mod_mix: Make access_create rule be applied when creating channel
• mod_mqtt: Add lower limits for pre-auth packets
• mod_muc_room: Fix handling of hats request with missing xdata
• mod_muc_rtbl: Accept also plain account and domain JIDs
• mod_muc_rtbl: Fix handling of remote ban servers (#4622)
• mod_register: After changing password disallow password change on currently authenticated sessions

SQL

• Add db_serialize to mod_privacy and mod_pubsub
• Add rename_column op to ejabbrd_sql_schema update routines
• Make rename_column compatible with older mysql versions
• ejabberd_sql_schema: Escape all column/table names
• Update mod_roster serializer with info about approved field

Administration

• Allow vhost-admin to execute MUC commands for his vhost (#4603)
• Fix method to check vhost-admin permission in Host API (#4619)
• WebAdmin: Fix shared roster page when visited by vhost-admin
• WebAdmin: For vhost-admins, hide useless link to node page
• WebAdmin: Show proper domain in URLs, not the first configured vhost

Installers and Container

• make-binaries: Bump Elixir to 1.19.6
• make-binaries: Bump Erlang/OTP version to 28.5.0.7
• make-binaries: Bump Expat version to 2.8.5
• make-binaries: Bump JPEG version to 10
• make-binaries: Bump OpenSSL 3.6.4
• make-binaries: Bump PNG version to 1.6.58
• make-binaries: Bump SQLite version to 3530400
• make-binaries: Bump WebP version to 1.6.0
• Dockerfile: Workaround to get image with amd64 (#4598)

Full Changelog

26.07...26.09

Acknowledgments

We would like to thank for the security reports provided by:

• Gia Bui from Calif.io
• Hoang Gia
• Nguyễn Huy Hoàng
• Pham Kiet
• On3nvm

the contributions to the source code by:

• rallep71 for the fixes in fast_xml and xmpp XML child ordering
• MrEddX for fixes in mod_muc_rtbl
• Pounceandmiss for improvement in CAPTCHA
• Stefan Strigler for Invites improvements
• Andreas Aaberge Eide for SQL improvements
• Holger Weiß for installers updates

and the translation by:

• Daltux for updating the Portuguese (Brazil) translation
• Sketch6580 for updating the Chinese (Simplified) translation

And also to all the people contributing in the ejabberd chatroom, issue tracker...

Improvements in ejabberd Business Edition

Customers of the ejabberd Business Edition, in addition to all those bugfixes, also get the following changes:

• Improve p1db serialization
• Fix SQLite backend for push
• Recognize gateway_sandbox option inside mod_applepush service (to change sandbox connection endpoint)

Changes in SQL schema

MySQL

When using multihost schema:

ALTER TABLE push_gate CHANGE COLUMN user username text NOT NULL;
CREATE INDEX i_push_gate_username_server_host USING BTREE ON `push_gate`(username(191), server_host(191));

Otherwise:

ALTER TABLE push_gate RENAME COLUMN user TO username;
CREATE INDEX i_push_gate_username USING BTREE ON `push_gate`(username(191));

PgSql

When using multihost schema:

ALTER TABLE push_gate RENAME COLUMN "user" TO "username";
CREATE INDEX i_push_gate_token_server_host ON "push_gate" USING btree ("username", "server_host");

Otherwise:

ALTER TABLE push_gate RENAME COLUMN "user" TO "username";
CREATE INDEX i_push_gate_token ON "push_gate" USING btree ("username");

ejabberd 26.09 download & feedback

As usual, the release is tagged in the Git source code repository on GitHub.

The source package and installers are available in ejabberd Downloads page. To check the *.asc signature files, see How to verify ProcessOne downloads integrity.

For convenience, there are alternative download locations like the ejabberd DEB/RPM Packages Repository and the GitHub Release / Tags.

The ecs container image is available in docker.io/ejabberd/ecs and ghcr.io/processone/ecs. The alternative ejabberd container image is available in ghcr.io/processone/ejabberd.

If you consider that you've found a bug, please search or fill a bug report on GitHub Issues.

Release notes copied from the original ejabberd 26.07 announcement post:

We are publishing this security release ejabberd 26.07, which includes several security fixes, some improvements and other minor bugfixes. It is strongly encouraged that you update ejabberd as soon as possible.

Contents:

• Changes in SQL schemas
• Security fixes
• mod_invites: New pages to create invites and WebAdmin
• mod_conversejs: Support ConverseJS 14
• Erlang/OTP 27.0 as a soft minimum
• Rebar/Rebar3: Update binaries to work with Erlang/OTP 26-29
• ChangeLog
• Acknowledgments
• Improvements in ejabberd Business Edition
• ejabberd 26.07 download & feedback

Changes in SQL schema

If you upgrade ejabberd from a previous release to 26.07, there are no changes in SQL schemas, but there is one for ejabberd Business Edition (see below).

Security fixes

This release contains fixes for those security issues:

• It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one.
• mod_caps persistent cache can be poisoned by using legacy version requests.This cache was only used to determine list of nodes that should trigger notifications in PubSub presence-based delivery.
• SQL injection in mod_pubsub handling of paging requests.
• Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api.
• It was possible to make ejabberd send redirect response for OAuth requests to unvetted url. This required enabling ejabberd to act as OAuth provider (by adding request handler for ejabberd_oauth in http listener). As part of this fix we changed oauth_client_id_check default value to db.
• using ejabberd as OAuth provider will be only allowed by clients
  that were previously registered with oauth_add_client_password or oauth_add_client_implicit commands.
• Tokens generated by mod_bosh, captcha, mod_auth_fast, mod_http_upload and mod_invites used not cryptographically strong random number generators.
• Files server by mod_http_upload didn't have XSS prevention headers.
• Issues in authentication of SIP requests.
• Request to web_admin were lacking CSRF protection.
• It was possible to skip captcha verification in mod_register_web.
• mod_conversejs allowed putting unescaped value from url in page content.

mod_invites: New pages to create invites and WebAdmin

mod_invites now includes a startpage where regular users can use their account credentials to generate new account creation invites.

This is useful for people using XMPP clients that do no support that feature. The URL of that page is the root of mod_invites; you can find a link to that page in the bottom of WebAdmin left menu.

There are also new WebAdmin pages to view the existing invites, generate new invites, expire, delete ... Go and take a look at WebAdmin > "Virtual Hosts" > one of your hosts > "Invites"

mod_conversejs: Support ConverseJS 14

ConverseJS published version 14.0.0 recently, and it requires some changes in the web server. In this sense, mod_conversejs is updated to support ConverseJS 14, and also got other minor cosmetic improvements.

Erlang/OTP 27.0 as a soft minimum

Are you compiling ejabberd with Erlang/OTP 25 or 26? Then please try to update to Erlang/OTP 27, 28, or 29. For example, the ejabberd installers are compiled with Erlang/OTP 28.5.0.4.

ejabberd supports compilation with Erlang/OTP 25 and 26, and those versions are still tested in runtime.yml and weekly.yml, but those Erlang/OTP versions are not actively maintained anymore by Erlang/OTP.

Following the erlang security recommendation to Use Actively Maintained Versions of Erlang/OTP, from now ejabberd softly rejects compilation with Erlang/OTP lower than 27.

What does softly mean? If you really want to compile ejabberd with Erlang/OTP lower than 27 at your own risk, you can bypass that soft requirement by defining this option (Erlang/OTP 25.0 included Erlang Run-Time System 13.0, and that is the number to provide in that option):

./configure --with-min-erlang=13.0

Rebar/Rebar3: Update binaries to work with Erlang/OTP 26-29

ejabberd source code includes Rebar and Rebar3 binaries, in case you don't have installed in your system. But those programs only support four Erlang releases (26 up to 29).

If you want to compile ejabberd with Erlang 25, then you need to grab a compatible Rebar3 (or Rebar) binary: either install one from your operating system, or you can download the old binaries included with ejabberd 26.04 (those still supported Erlang 25):

https://github.com/processone/ejabberd/raw/26.04/rebar
https://github.com/processone/ejabberd/raw/26.04/rebar3

ChangeLog

Security fixes

This release contains fixes for those issues:

• It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one.
• mod_caps persistent cache can be poisoned by using legacy version requests.
  This cache was only used to determine list of nodes that should trigger notifications in PubSub presence-based delivery.
• SQL injection in mod_pubsub handling of paging requests.
• Possible atom exhaustion that can be triggered by issuing REST requests to mod_http_api
• It was possible to make ejabberd send redirect response for OAuth requests to unvetted url. This required enabling ejabberd to act as OAuth provider (by adding request handler for ejabberd_oauth in http listener). As part of this fix we changed oauth_client_id_check default value to db
• using ejabberd as OAuth provider will be only allowed by clients
  that were previously registered with oauth_add_client_password or oauth_add_client_implicit commands.
• Tokens generated by mod_bosh, captcha, mod_auth_fast, mod_http_upload and mod_invites used not cryptographically strong random number generators.
• Files server by mod_http_upload didn't have XSS prevention headers.
• Issues in authentication of SIP requests.
• Request to web_admin were lacking CSRF protection.
• It was possible to skip captcha verification in mod_register_web.
• mod_conversejs allowed putting unescaped value from url in page content.

Core

• Fixes delete_old_messages_batch command when used on pgsql
• Adds export_db_ext which allows exporting db content to json files
• Use constant time functions when doing password checks
• Optimize room_unused_* commands when room hibernation is configured
• We no longer add flag requesting client certificate for tls connections
  where certificate authentication is not enabled

Modules

• mod_auth_fast: Fixes exception for session that didn't set user agent
• mod_invites: Add page for creating invites.
• mod_invites: Fix generation of CSRF tokens.
• mod_invites: Update to changes in latest XEP-0401
• mod_http_upload: Attach custom headers from config when serving files.

Full Changelog

26.04...26.07

Acknowledgments

We would like to thank for the security reports provided by:

• arthurscchan
• EkiXu
• kah-ja
• LautaroPetaccio
• Marius Schwarz
• tinyb0y
• X1AOxiang

the contributions to the source code by:

• Stefan Strigler for the new features, improvements and fixes in mod_invites
• Christian Dröge
• Holger Weiß
• Jonathan Davies
• Kirill A. Korinsky

and the translation by:

• Mr. EddX for updating the Bulgarian translation
• Arif Budiman for updating the Indonesian translation
• TamilNeram for updating the Tamil translation

And also to all the people contributing in the ejabberd chatroom, issue tracker...

Improvements in ejabberd Business Edition

Customers of the ejabberd Business Edition, in addition to all those bugfixes, also get the following changes:

Changes in SQL schema

This release modifies the push_customizations table in the SQL database schemas to support the new push notifications mute option (see below). This task is performed automatically by ejabberd by default.

However, if your configuration file has disabled update_sql_schema toplevel option, you must perform the SQL schema update manually yourself. Those instructions are valid for MySQL and PostgreSQL, both default and new schemas:

MySQL

ALTER TABLE push_customizations MODIFY COLUMN mute smallint;

PostgreSQL

ALTER TABLE push_customizations ALTER COLUMN mute TYPE smallint USING mute::int;

Push notifications

• Add a push customization option to allow mentioned users (as described in XEP-0513) to be notified even in muted conversation.
• Make proxy connections in applepushv3 always use http connect
• Report push gate tokens in the results of the user_push_state command
• Implement push errors reporting in the results of the user_push_state command.
• Make mod_webpush reject tokens that don't have correct format.
• Fix mod_webpush key parser.
• Add ability to retrieve user nodes from push_gate.
• Handle wildcard certificates now used by Google FCM service.

Commands

Add a new local_health_status command to return information about local node state.

Client certificate authentication

• Add option require_xmpp_addr that forces client certs to have XmppAddr.
• New recognize_email_addr option for mod_crl/mod_ocsp to add emailAddress from cert subject to be used beside xmppAddr for matching against provided user id.

p1db backend

• Make mam_p1db serialization properly serialize MUC archives.
• Fix JID encoding in roster_p1db serialization.
• Fix decoding of fast_tokens in p1db backend

Clustering

Make join_cluster robust to race conditions on leave_cluster.

Docker

sqlite backend has been fixed in Docker image.

ejabberd 26.07 download & feedback

As usual, the release is tagged in the Git source code repository on GitHub.

The source package and installers are available in ejabberd Downloads page. To check the *.asc signature files, see How to verify ProcessOne downloads integrity.

For convenience, there are alternative download locations like the ejabberd DEB/RPM Packages Repository and the GitHub Release / Tags.

The ecs container image is available in docker.io/ejabberd/ecs and ghcr.io/processone/ecs. The alternative ejabberd container image is available in ghcr.io/processone/ejabberd.

If you consider that you've found a bug, please search or fill a bug report on GitHub Issues.

Release notes copied from the original ejabberd 26.04 announcement post:

We are publishing this security release ejabberd 26.04, which includes options to limit XML parser, and other minor bugfixes. It is strongly encouraged that you update ejabberd as soon as possible.

Contents:

• New limits options for XML parser
• ChangeLog
• Acknowledgments
• ejabberd 26.04 download & feedback

New limits options for XML parser

This release adds new options that limit max memory used by XML parser used to process XMPP payloads, to prevent potential Denial of Service attack. The default values for pre-auth provide sufficient protection for ejabberd against non-authenticated users on c2s and s2s, so there is no need to change your configuration.

The option max_stanza_elements sets a limit on the maximum number of XML elements that an individual stanza can contain. By default, this option is set to infinity.

The pair of options pre_auth_max_stanza_elements and pre_auth_max_stanza_size define separate limits for sessions that haven't authenticated yet. The session will switch to the limits defined by the options max_stanza_elements and max_stanza_size after the client has successfully authenticated. The default values for these options are: 32 for pre_auth_max_stanza_elements and 8192 for pre_auth_max_stanza_size.

All those options are recognized inside listener sections, and can be applied to ejabberd_c2s and ejabberd_s2s_in listeners.

ChangeLog

Core

• Add new listener options to limit xml parser accepted input
• Improve leave_cluster command to work even in own node
• New predefined keyword DATABASE_PATH that points to the Mnesia spool dir
• Support HOST keyword in sql_database toplevel option, set nice default value
• Provide more details in log messages when using SQLite
• Update documentation of jwt_key to match the Docs site
• ejabberd_config: New default_ram_db/3 clause that checks module support
• ejabberd_sm: Remove session_counter, used for get_vh_session_number now removed

Modules

• mod_http_fileserver: Use integer in ejabberd_hooks:add as expected by "make hooks"
• mod_invites: Add --enable-bootstrap=no to configure options to bypass download (#4558)
• mod_invites: don't crash in get_invite_by_invitee_t for sql backend (#4566)
• mod_invites: quick howto for creating integrity check checksums
• mod_invites: remove dependency on jquery
• mod_mqtt: Define RAM callbacks as optional
• mod_mqtt: Use default_ram_db only if it really supports RAM storage
• mod_roster: Fix bug introduced in 26.03 in commit d5c1440 (#4564)
• mod_roster_sql: Cast approved integer as boolean when exporting Mnesia to SQL
• mod_shared_roster_sql: Fix typo introduced 10 years ago in commit 0ea0ba3

Container and Installers

• Bump Erlang/OTP 28.4.2
• make-binaries: Bump OpenSSL to 3.5.6

Full Changelog

26.03...26.04

Acknowledgments

We would like to thank the contributions to the source code, documentation, and translation provided for this release by:

• Stefan Strigler for the improvements in mod_invites

And also to all the people contributing in the ejabberd chatroom, issue tracker...

ejabberd 26.04 download & feedback

As usual, the release is tagged in the Git source code repository on GitHub.

The source package and installers are available in ejabberd Downloads page. To check the *.asc signature files, see How to verify ProcessOne downloads integrity.

For convenience, there are alternative download locations like the ejabberd DEB/RPM Packages Repository and the GitHub Release / Tags.

The ecs container image is available in docker.io/ejabberd/ecs and ghcr.io/processone/ecs. The alternative ejabberd container image is available in ghcr.io/processone/ejabberd.

If you consider that you've found a bug, please search or fill a bug report on GitHub Issues.

Release notes copied from the original ejabberd 26.03 announcement post:

We are pleased to announce another bugfix release: ejabberd 26.03. This brings support for roster pre-approval, and more than 100 commits with bugfixes all around, many of them dedicated to the new mod_invites, including also many security fixes.

If you are upgrading from a previous version, there is a change in the SQL schemas, please read below. There are no changes in configuration, API commands or hooks.

Contents:

• Changes in SQL schemas
• SASL channel binding changes
• ChangeLog
• Acknowledgments
• Improvements in ejabberd Business Edition
• ejabberd 26.03 download & feedback

Changes in SQL schema

This release adds a new column to the rosterusers table in the SQL database schemas to support roster pre-approval. This task is performed automatically by ejabberd by default.

However, if your configuration file has disabled update_sql_schema toplevel option, you must perform the SQL schema update manually yourself. Those instructions are valid for MySQL, PostgreSQL and SQLite, both default and new schemas:

ALTER TABLE rosterusers ADD COLUMN approved boolean NOT NULL AFTER subscription;

SASL channel binding changes

This version adds ability to configure handling of client flag "wanted to use channel-bindings but was not offered one".
By default ejabberd will abort connections that present this flag, as that could mean that between server and client is
rogue MITM proxy that strips exchanged data with informations that are required for this.

This can cause problems for servers that use proxy server that terminated TLS connection (there is MITM proxy, but approved by server admin). To be able to handle this situation, we added code that ignore this flag, if server admin disable channel-binding handling by disabling -PLUS auth mechanisms in config file:

disable_sasl_mechanisms:
  - SCRAM-SHA-1-PLUS
  - SCRAM-SHA-256-PLUS
  - SCRAM-SHA-512-PLUS

We also ignore this flag for SASL2 connections if offered authentication methods filtered by available user passwords did disable all -PLUS mechanisms.

ChangeLog

Core

• Fix mysql authentication for tls connections that required auth plugin switch
• Improve handling of scram "wanted to use channel-bindings but was not offered one" flag
• Add ability for mod_options values to depend on other options
• Don't fail to classify stand-alone chat states
• Fix some warnings compiling with Erlang/OTP 29 (#4527)
• ejabberd_ctl: Document how to set empty lists in ejabberdctl and WebAdmin
• ejabberd_http: Add handling of Etag and If-Modified-Since headers to files served by mod_http_upload
• ejabberd_http: Ignore whitespaces at end of host header
• SQL: Add ability to mark that column can be null in e_sql_schema
• Tests: Add tests for sasl2
• Tests: Make table cleanup in test more robust

Modules

• mod_fast_auth: Offered methods are based on available channel bindings
• mod_http_api: Always hide password in log entries
• mod_mam: Call store_mam_message hook for messages that user_mucsub_from_muc_archive was filtering out
• mod_mam_sql: Only provide the new XEP-0431 fulltext field, not old custom withtext
• mod_muc_room: Fix duplicate stanza-id in muc mam responses generated from local history (#4544)
• mod_muc_room: Fix hook name in commit 7732984 (#4526)
• mod_pubsub_serverinfo: Don't use gen_server:call for resolving pubsub host
• mod_roster: Add support for roster pre-approval (#4512)
• mod_roster: Fix display of groups in WebAdmin when it's a list
• mod_roster: in WebAdmin page, first execute SET actions, later GET
• mod_roster_mnesia: Improve transformation code

mod_invites

• Makefile: Run invites-deps only when files are missing
• Fix path to bootstrap files
• Check at start time the syntax of landing_page option (#4525)
• Send 'Link' http header (#4531)
• Set meta.pre-auth to skip redirect_url if token validated (#4535)
• Many security fixes (#4539)
• Add favicon and change color to match ejabberd branding
• Enable dark mode
• Add support for webchat_url
• Migrate to bootstrap5 and update jquery
• No inline scripts
• Make format csrf token
• Add csrf token to failed post
• Include js/css deps in static dir
• Correct hashes for bootstrap 4.6.2
• Hint at type for landing_page opt
• Many more security fixes (#4538)
• Check CSRF token in register form
• Add integrity hashes to scripts and css
• Comment unused resources
• Add security headers
• Remove debug log of whole query parameters (including pw)
• Don't crash on unknown host from http host header
• Make creating invite transactional
• Set overuse limits (#4540)
• Fix broken path when behind proxy with prefix (#4547)

Container and Installers

• Bump Erlang/OTP 28.4.1
• make-binaries: Bump libexpat to 2.7.5
• make-binaries: Bump zlib to 1.3.2
• make-binaries: Enable missing crypto features (#4542)

Translations

• Update Bulgarian translation
• Update Catalan and Spanish translations
• Update Chinese Simplified translation
• Update Czech translation
• Update French translation
• Update German translation

Acknowledgments

We would like to thank the contributions to the source code, documentation, and translation provided for this release by:

• Stefan Strigler for the roster pre-approval feature, sponsored by NLnet
• Stefan Strigler for the improvements in mod_invites
• Holger Weiß for improvements in binary installers
• Mr. EddX for updating the Bulgarian translation
• Sketch6580 for updating the Chinese (Simplified) translation
• ffunk for updating the Czech translation
• Dyxux for updating the French translation
• Stefan Strigler for updating the German translation

And also to all the people contributing in the ejabberd chatroom, issue tracker...

Improvements in ejabberd Business Edition

Customers of the ejabberd Business Edition, in addition to all those improvements and bugfixes, also get the following changes:

• Add p1db backend for mod_auth_fast
• Fix issue when cleaning MAM messages stored in p1db
• mod_unread fixes
• Web push fixes

Full Changelog

26.02...26.03

ejabberd 26.03 download & feedback

As usual, the release is tagged in the Git source code repository on GitHub.

The source package and installers are available in ejabberd Downloads page. To check the *.asc signature files, see How to verify ProcessOne downloads integrity.

For convenience, there are alternative download locations like the ejabberd DEB/RPM Packages Repository and the GitHub Release / Tags.

The ecs container image is available in docker.io/ejabberd/ecs and ghcr.io/processone/ecs. The alternative ejabberd container image is available in ghcr.io/processone/ejabberd.

If you consider that you've found a bug, please search or fill a bug report on GitHub Issues.

Release notes copied from the original ejabberd 26.02 announcement post:

Contents:

• ChangeLog
• Acknowledgments
• Improvements in ejabberd Business Edition
• ejabberd 26.02 download & feedback

ChangeLog

• Fixes issue with adding hats data in presences send by group chats (#4516)
• Removes mod_muc_occupantid modules, and integrates its functionality directly into mod_muc (#4521)
• Fixes issue with reset occupant-id values after restart of ejabberd (#4521)
• Improves handling of mediated group chat invitations in mod_block_stranger (#4523)
• Properly install mod_invites templates in make install call (#4514)
• Better errors in mod_invites (#4515)
• Accessibility improvements in mod_invites (#4524)
• Improves handling of request with invalid url encoded values in request handled by ejabberd_http
• Improves handling of invalid responses to disco queries in mod_pubsub_serverinfo
• Fixes conversion of MUC room configs from ejabberd older than 21.12
• Fixes to autologin in WebAdmin

If you are upgrading from a previous version, there are no changes in SQL schemas, configuration, API commands or hooks.

Notice that mod_muc now incorporates the feature from mod_muc_occupantid, and that module has been removed. You can remove mod_muc_occupantid in your configuration file as it is unnecessary now, and ejabberd simply ignores it.

Check also the commit log: 26.01...26.02

Acknowledgments

We would like to thank the contributions to the source code and translations provided by:

• Stefan Strigler for the improvements in mod_invites
• Mr. EddX for updating the Bulgarian translation
• Sketch6580 for updating the Chinese (Simplified) translation
• ffunk for updating the Czech translation
• Stefan Strigler for updating the German translation

And also to all the people contributing in the ejabberd chatroom, issue tracker...

Improvements in ejabberd Business Edition

Customers of the ejabberd Business Edition, in addition to all those improvements and bugfixes, also get the following change:

• Change default_ram_db from mnesia to p1db when using p1db cluster_backend

ejabberd 26.02 download & feedback

As usual, the release is tagged in the Git source code repository on GitHub.

The source package and installers are available in ejabberd Downloads page. To check the *.asc signature files, see How to verify ProcessOne downloads integrity.

For convenience, there are alternative download locations like the ejabberd DEB/RPM Packages Repository and the GitHub Release / Tags.

The ecs container image is available in docker.io/ejabberd/ecs and ghcr.io/processone/ecs. The alternative ejabberd container image is available in ghcr.io/processone/ejabberd.

If you consider that you've found a bug, please search or fill a bug report on GitHub Issues.