| Dir : /home2/bookbymarye/.caldav/info@macbp.us/ans_sym/root/var/softaculous/phpbb/ |
| Server: Linux server1.superfastcloudhosting.com 5.14.0-687.31.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Aug 1 05:38:01 EDT 2026 x86_64 IP: 65.109.111.76 |
| Dir : /home2/bookbymarye/.caldav/info@macbp.us/ans_sym/root/var/softaculous/phpbb/changelog.txt |
Changes since 3.3.18
Security & Hardening
[SECURITY-298] - Resend rate limiting incorrectly updating expiration time
[SECURITY-300] - Attachment comment hijacking by other users
[SECURITY-301] - Reflected XSS via data passed to registration page
[SECURITY-302] - Hide oauth provider secrets in ACP
[SECURITY-303] - Potential stored XSS for string profile fields when allowing any character
[SECURITY-305] - Missing permission type check when applying role based permissions
[SECURITY-306] - Disclosure of hidden or unapproved topic title when emailing topic
[SECURITY-307] - Banned Users can email members despite ban status:
[SECURITY-308] - Releasing of held private messages missing CSRF protection
[SECURITY-309] - Missing encoding of username in anti abuse header
[SECURITY-310] - MCP topic view mixing access checks for post and topic
[SECURITY-311] - Moderators with f_user_lock permission may close other user's topics
[SECURITY-312] - Unauthenticated SMTP Command Injection via Contact Form
[SECURITY-313] - Moderators can close/delete reports outside their forum permissions
[SECURITY-314] - MCP make normal action for topics missing check for forum-scoped moderators
Changes since 3.3.17
Bug
[PHPBB-17134] - BBCode UID Throwing Deprecation Errors
[PHPBB-17607] - Missing language key for copy_file in convertor
[PHPBB-17652] - set_custom_style() in acp_extensions uses hardcoded adm path instead of $phpbb_admin_path
[PHPBB-17662] - Inline attachments are not sorted correctly in other topic viewers
[PHPBB-17694] - Incorrect "disapprove whole topic" detection due to undefined $topic_id in disapprove_posts()
[PHPBB-17697] - Bot can be added with no name
Improvement
[PHPBB-17623] - switch twitter to x in profile
[PHPBB-17640] - Add php event for custom quick actions in groups
[PHPBB-17643] - Github actions merging branches should only occur in source repo
[PHPBB-17656] - Add shorter guest session time and AI bots group
[PHPBB-17661] - Add event to 'View topic' in MCP to modify template
New Feature
[PHPBB-17665] - Add automatic admin notifications on security updates
Security & Hardening
[SECURITY-298] - Resend rate limiting incorrectly updating expiration time
[SECURITY-300] - Attachment comment hijacking by other users
[SECURITY-301] - Reflected XSS via data passed to registration page
[SECURITY-303] - Potential stored XSS for string profile fields when allowing any character
[SECURITY-305] - Missing permission type check when applying role based permissions
[SECURITY-306] - Disclosure of hidden or unapproved topic title when emailing topic
[SECURITY-307] - Banned Users can email members despite ban status:
[SECURITY-308] - Releasing of held private messages missing CSRF protection
[SECURITY-309] - Missing encoding of username in anti abuse header
[SECURITY-310] - MCP topic view mixing access checks for post and topic
[SECURITY-311] - Moderators with f_user_lock permission may close other user's topics
[SECURITY-312] - Unauthenticated SMTP Command Injection via Contact Form
[SECURITY-313] - Moderators can close/delete reports outside their forum permissions
[SECURITY-314] - MCP make normal action for topics missing check for forum-scoped moderators
Changes since 3.3.16
Bug
[PHPBB-17639] - Installation under PHP 8.4 failed with timeout detection reason check_filesystem.php
[PHPBB-17650] - Migrator bug prevents complete uninstallation for certain extensions
[PHPBB-17651] - Notification manager tests fail on mssql
[PHPBB-17658] - Testing for 3.3.x is broken on PHP 8
Improvement
[PHPBB-17659] - Move oauth login to controllers
Hardening
[SECURITY-292] - Improve secure downloads referer checking
[SECURITY-295] - Hardening of hostname lookups
Security Issue
[SECURITY-293] - Improper state verification in OAuth implementation
[SECURITY-294] - Improper access verification when setting permissions in ACP
[SECURITY-296] - Ensure proper casting in profile field migration
Changes since 3.3.16-RC1
Hardening
[SECURITY-289] - Hardening against non-rasterized image uploads
Security Issue
[SECURITY-285] - Password Reset Link Poisoning
[SECURITY-286] - IDOR when composing PMs
[SECURITY-287] - CSRF on report submission
[SECURITY-290] - Cross-User Notification Read State Manipulation
Changes since 3.3.16-RC1
Hardening
[SECURITY-289] - Hardening against non-rasterized image uploads
Security Issue
[SECURITY-285] - Password Reset Link Poisoning
[SECURITY-286] - IDOR when composing PMs
[SECURITY-287] - CSRF on report submission
[SECURITY-290] - Cross-User Notification Read State Manipulation
Changes since 3.3.15
Bug
[PHPBB-14401] - Sphinx: Remove ending slash from binlog_path
[PHPBB-15085] - HTTP authentication from feeds served via controller
[PHPBB-17034] - Rank post limit
[PHPBB-17157] - Read Topic Permission With Search permission
[PHPBB-17399] - Add select attribute for British English the default language
[PHPBB-17475] - Overflow on resynchronize statistics when running on MSSQL with large number of attachments
[PHPBB-17477] - Problem with Whois lookups returning incorrect information due to ARIN/RIPE changes
[PHPBB-17486] - Upgrade from 3.0 to 3.3 fails with SQL "Incorrect integer value" error
[PHPBB-17491] - Ascending posts pagination in version 3.3.15
[PHPBB-17504] - Tests fail because of changed label of ondrej/php repo
[PHPBB-17506] - PHP fatal error on install
[PHPBB-17510] - CodeSniffer ruleset is reported as DEPRECATED
[PHPBB-17519] - Cron URLs are encoded incorrectly
[PHPBB-17527] - PHP fatal error when decorating Twig phpBB extension service in phpBB extension
[PHPBB-17533] - Reverting migrations may cause restoring incorrect data and throw "module exists" exceptions
[PHPBB-17563] - CodeSniffer ruleset (PPSSE) not fully compatible with CS 4
[PHPBB-17565] - Incorrect exporting PM as CSV for Excel
[PHPBB-17580] - Downloading files with a byte range of 8192 bytes causes fatal error
[PHPBB-17589] - QA captcha appears on every other login attempt
[PHPBB-17622] - Version helper may return update from newer branch
Improvement
[PHPBB-13481] - Explain in ACP Attachment settings images get resized (at client-side)
[PHPBB-15007] - Add Restart link to installer
[PHPBB-16941] - Add Sphinx search backend tests
[PHPBB-17498] - Move GitHub Actions Ubuntu 20.04 runners to Ubuntu 22.04
[PHPBB-17536] - Add event to Edit forum in ACP to modify template
[PHPBB-17538] - Terms and Policy wording improvements
[PHPBB-17555] - Improve running of tests on windows runners in GitHub Actions
[PHPBB-17570] - Replace an old CSS accessibility hack with a modern, recommended and W3C compliant method
[PHPBB-17598] - Deny access to composer files in apache
[PHPBB-17605] - Fix homestead and use a fork since is no longer maintained
[PHPBB-17620] - Skip whois test when daily rate-limit is reached
[PHPBB-17621] - Change U_WARN to use new warn_allowed variable
New Feature
[PHPBB-17515] - Add new event to: ucp_pm_viewmessage.html
Task
[PHPBB-17110] - Reword "slander" to "libel" in registration legalese
[PHPBB-17545] - Improve handling of DDoS/brute force attacks on login form
[PHPBB-17584] - Exclude tests from PSR1 code sniffs
[PHPBB-17591] - Update to Code Sniffer 4
[PHPBB-17593] - Allow functional tests on a secure local server
[PHPBB-17612] - Remove imageset to css converter
[PHPBB-17613] - Remove support for retired WebPI packages
[PHPBB-17628] - Update composer and node dependencies