[XB] Badges 2.4.0

Better Badge Management, Security & Customization!​

This update modernizes badge presentation and icon handling, improves administration and export/import workflows, and includes a large set of security, criteria, queue, and badge management fixes.

Important: This version now requires [XB] Core Library.
The Core Library also adds an optional xenBaker branding link to the badges help page and member badge tab. The branding is enabled by default and can be disabled in the add-on options without payment.

Click to expand...

New Features​

• Added configurable grid layouts for the badges help page and member badge tab.
• Added a searchable Font Awesome icon picker for badges and badge categories.
• Replaced the locally hosted Material Design Icons webfont with on-demand inline SVG icons.
• Organized badge options into General, Appearance, and Award Reasons tabs.

Improvements​

• Disabled the legacy badges help page route filter during upgrades to prevent broken redirects.
• Improved badge export/import to preserve the badge active state, HTML icon, link, and link attributes.
• Improved badge imports to avoid overwriting existing tiers and categories with matching IDs.

Bug Fixes​

• Fixed the Feature / Unfeature Badge action being vulnerable to CSRF.
• Fixed ACP user badge management pages being accessible without the badges admin permission.
• Fixed REST API user badge edit and feature endpoints not requiring the user_badges:write scope.
• Fixed REST API badge, category, and tier deletion not checking the badges admin permission for user API keys.
• Fixed REST API badge editing not validating the award reason length.
• Fixed awarded user lists being accessible for inactive badges.
• Fixed taking away a badge from one user deleting award alerts for that badge from all users.
• Fixed deleting a badge removing award alerts belonging to other badges.
• Fixed User has all of the badges criteria matching when only the last selected badge was awarded.
• Fixed User has no more than X badges criteria not matching users without badges.
• Fixed the user badge update queue skipping badges when an update required multiple job runs.
• Fixed changing a badge stacking parent reversing badge display order within its category.
• Fixed taking away a badge when its awarded counter was already zero.
• Fixed an undefined index error when a user badge cache referenced a deleted badge.
• Fixed errors in the ACP user badge batch update and badge batch award jobs.
• Fixed batch unaward listing only manually awardable badges instead of all badges that can be unawarded.
• Fixed the user badge deletion job potentially skipping badges due to unordered batches.
• Fixed DBTech Credits event settings failing to save with some event trigger implementations.

If you're enjoying this update, please consider leaving a rating and sharing your feedback.

Fix: wrap user badge update in single DB transaction
Fix: ensure consistent badge award conditions by fetching the latest user record with a row-level lock

Minor code optimization when awarding repetitive user badges
Fixed awarding duplicate non-repeatable badges when running updating user badges from multiple instances
Automatically re-order badges in category when changing stacking badge to ensure correct stacking behavior
Fixed "helper_account" template modification apply on XF 2.3.10+
Fixed "Element.querySelectorAll: '.dataList-cell--toggle input:checkbox' is not a valid selector" error in ACP

Fix: provide canonical user profile URL in badge award email template