Totara 2.4.22 has been released. It includes bug fixes, improvements and security fixes. We recommend upgrading to this version.

Here's the changelog:

Release 2.4.22 (16th September 2014):
==================================================

Security issues:
    T-12619        Improved sesskey checks throughout the system
    T-12745        Improved capability checks around Reportbuilder scheduled reports

Improvements:
    T-12943        Improved debugging on Audience rules tab

Bug Fixes:
    T-11556        Fixed resolving Program exceptions through setting a realistic time allowance
    T-12910        Fixed required parameter checks on the edit scheduled reports page
    T-12775        Fixed incorrect trust text usage
    T-12904        Fixed Totara Sync to allow @ in directory paths
    T-12762        Fixed undefined variables on upgrade from 2.2 to 2.4
    T-13007        Fixed empty items being added to lists of parameters used in dynamic audience rules
    T-12576        Fixed the handling of dates with a zero value in Reportbuilder filters

API Changes:
    T-12713        Enforce unique property if set when importing user custom profile fields with Sync
    T-12921        Fixed generator class inheritance to resolve conflicts with PHP5.5