Autor Thema: phpBB ... (Gelesen 5877 mal)

SiLæncer · « **Antwort #15 am:** 23 Dezember, 2018, 13:30 »

Whats new:>>

The fixed issues include, among others, a BBCode parsing regression in the generate_text_for_display() function, a missing variable cast on the ACP extensions page, as well as a fix to how the assets version gets appended to JavaScript files included via INCLUDEJS.

http://www.phpbb.com/

SiLæncer · « **Antwort #16 am:** 29 April, 2019, 18:15 »

Changelog

Notable Bug Fixes

Cookies for domains with special chars – Added support for cookies on domains with special characters [1]
Support Q&A plugin on MySQL 5.7 – An SQL query in the Q&A plugin failed to execute while using MySQL 5.7 [2]

Notable Changes

Update dependencies to latest versions – Updated dependencies like Symfony and the TextFormatter to their latest versions [3][4]
Deny installations of 3.2 on PHP 7.3 – Due to the dependencies used in phpBB 3.2 and its minimum PHP version 5.4.7, it’s currently not possible to run phpBB 3.2 on PHP 7.3 [5]

Hardening

Remove support for backup download – Removed support for downloading database backups via the ACP UI. This is to prevent the possibility of a database compromise on gaining access to a founder account

[close]

http://www.phpbb.com/

SiLæncer · « **Antwort #17 am:** 05 Mai, 2019, 11:15 »

Release Notes

The fixed issues include, among others, issues with form token validation during login, the inability to change topic types after posting, an issue with viewing private message folders, and potentially incorrectly shortened URL links when using the BBCode.
Full backwards compatibility for styles released before phpBB 3.2.6 has been introduced, which will enable logins even though these styles have not yet been updated with the latest style changes.

[close]

http://www.phpbb.com/

SiLæncer · « **Antwort #18 am:** 21 September, 2019, 11:10 »

Release Notes

Today we’re announcing the release of phpBB 3.2.8. This release is dedicated to the memory of Maria Wilhelmina Theodora 'Marian' Verhoog-Wienk [08 October 1958 - 18 September 2019], who you may know as marian0810. Rust in vrede, Marian.

This version is a maintenance and security release of the 3.2.x branch which fixes three security issues, introduces further hardening, and resolves various issues reported in previous versions.

Previous versions of phpBB did not properly enforce form tokens on two seperate pages which could have been used to trick users into carrying out unwanted actions. We’d like to thank kevinoclam (via HackerOne) and Yuval Kanarenstein of SecuriTeam Secure Disclosure for their report and responsible disclosure. The issues have been assigned CVE-2019-16107 and CVE-2019-13376 respectively.
In addition to this, improper validation of BBCode parameters allowed modifying the style attribute and injecting arbitrary CSS into the page. We’d like to thank Hanno Böck for his report and responsible disclosure. The issue has been assigned CVE-2019-16108.

For further hardening phpBB against potential attacks, we have integrated the Referrer-Policy header and disabled the MySQLi local infile setting. The Referrer-Policy header will prevent sending any kind of referrer information to less secure destinations or third party sites while disabling the MySQLi local infile setting will prevent MySQL servers from potentially requesting local files from the client side.

The fixed issues include, among others, multiple issues with OAuth logins, improved login form token check that should now work in all templates, restoring the ability to restore database backups, and support for newer TLS versions for SMTP connections on the latest PHP versions.
Searching for users by their last visit time has been modified to prevent potentially unwanted results from showing up.

In order to help the support team in assessing issues in phpBB, we have now disabled the uninstallation of prosilver. Prosilver can however still be deactivated.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release on the wiki at https://wiki.phpbb.com/Release_Highlights/3.2.8 and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=15090

[close]

https://www.phpbb.com/

SiLæncer · « **Antwort #19 am:** 07 Januar, 2020, 20:15 »

Release Notes

The new phpBB 3.3 Proteus builds upon 3.2 Rhea and is a big step towards a more modern base while maintaining a clear update path. It is now shipped with Symfony 3.4, Twig 2, and jQuery 3.4. The improvements include, among others, support for Invisible reCAPTCHA, Argon2i and Argon2id password hashing, improved reset password functionality, and minor changes to the UI.
The minimum supported PHP version has been increased to PHP 7.1.3 while support for PHP 7.3 and PHP 7.4 has been added. Fixed security issues in 3.2.9 are part of this release as well.

[close]

https://www.phpbb.com/

SiLæncer · « **Antwort #20 am:** 08 August, 2020, 09:15 »

Release Notes

We are pleased to announce the release of phpBB 3.3.1 "Bertie’s Twenty". This version is a maintenance and security release of the 3.3.x branch which fixes one security issue, introduces further hardening, and resolves various issues reported in previous versions.

Previous versions of phpBB did allow limiting the dimensions of images posted. This could however also be used to e.g. check for the existence of services that should only be accessible from the internal network. We would like to thank FVD for reporting this issue to us via hackerone. The issue has been assigned CVE-2020-8226.

The fixed issues include, among others, issues with using Emojis in multiple text fields, the inability to delete or mark PMs read in the UCP folder view, issues with resetting a password, and a slow search on PostgreSQL. The amount of emails sent for notifications related to topics have been improved and new and improved enable and disable mechanisms for newer profile field types have been integrated. We would like to dedicate this last addition to javiexin.

[close]

https://www.phpbb.com/