Security

One low-level and two moderate-level security issues were fixed in this release:

    * Moderate Priority: Core - com_users XSS.
    * Moderate Priority: Core - ja_purity XSS.
    * Low Priority: Core - Front-end XSS.

For additional information, visit the Mitra Security Center.
Components

    * Prev and Next links no longer create duplicate content with SEF URLs (13890)
    * Atom feed validates for Contact Category and Weblinks Category layouts (15446)
    * Article Category layout sorts correctly (15541)
    * Form correctly uses JRoute for action (15551)
    * Improved control over who is able to upload files (15691)
    * Search results work correctly for multiple search terms with SEF URLs enabled (15853)
    * RSS 2.0 feeds try to turn mailto links into absolute URLs (15909)
    * Atom link in RSS feed causes validation problems (16211)

Modules

    * Login correctly uses view=register (15740)
    * Module cache, ID, ItemID (15727)

Plugins

    * No plugin issues were fixed in this release.

Legacy

    * No legacy issues fixed for this release.

Templates

    * Khepri template has correct CSS icon for Article (15912)
    * Align attribute in mod_mainmenu no longer causes problems for some templates (15963)
    * Updated the helpsites.xml files (16397)

Language

    * Translated description for Component, Module, Plugin, etc. after installation (13898)
    * Change in Montenegrin language ISO Code (16112)
    * Modified Montenegrin language code to be ME from SLA for consistency (16349)
    * Install language changes (16405)

Administrator

    * Global Configuration "Undefined Variable" warning now resolved (15699)
    * Legacy code in installer premigration system causes unrelated errors (16236)

System

    * Installation of some packages no longer fails (15701)
    * Installation Version Display corrected (15913)
    * JFile::getName() loses first character (16007)
    * db->updateObject function outdated (15417)
    * PHPDoc Comment for JFactory getDocument method incorrect (16314)
    * offline.php file now has correct stylesheet (16500)