News

Original post blogged on b2evolution.

Highlights

• Most pages are built in about half the time. On a stock site, on PHP 8.2 and 8.5, v2.3.13 takes 30% less server time than v2.3.12 for the front page, 45 to 60% less for other public pages, and 30 to 68% less in the admin area, with one database connection per page instead of five to eight. A heavier page saves about as many milliseconds, a smaller share. (#6704, #6696, #6724, #6697, #6732)
• Regression fixed: logout links work again. Since v2.3.12, a logout link without a security token, in a theme, a bookmark, or Site Links, left the member signed in with an error. It now asks "Are you sure you want to log out?", and Navigation offers Logout as a predefined link. (#6741, #6753)
• Sites with no site_path are back on their own media and system folders. They saved uploads, backups, and logs under a stray folder; the dashboard links to the merge. (#6498)
• Uninstalling a plugin that declares comment types no longer deletes every comment on the site. Its own comments now go only when its tables do. (#6780)
• An & stays an &. Since 2.2.0, text saved by anyone outside "Class which can post HTML" showed & for a typed & (older text until re-saved), and a bbcode link or image to ?a=1&b=2 lost its second parameter. (#6791, 94ef3d1ae4, 73227b2392)
• Social login runs on Hybridauth 3.13.0, checks the provider's TLS certificate (OpenID 2.0 providers such as Steam aside), and offers LinkedInOpenID, OktaOIDC, and X. (#6372)
• A page that cannot send its email now says so. The contact form, account removal, and most admin test emails reported success either way. (#6743)
• Regression fixed: the FAQ page no longer sends visitors to the admin login. On v2.3.12, /faqs could open the admin area instead. (#6502)

Security

An "HTML author" below may post HTML but not script: on a new install, any administrator.

BBCodes and posted HTML

Links and controls in posted HTML

Forum

Comments, search, and List New Items

Shortcodes in pages, FAQs, and lists

Admin area

Site links, pages, and menus

Media Manager and uploads

Downloads, FAQs, and news menus

Social login

Sign-in, sign-up, and requests from other sites

For Administrators

Added

• Navigation offers Logout as a predefined link, which logs out at once. Choose Logout under "Predefined link", or write index.php?logout&e-token={E_TOKEN}: e107 fills in each visitor's token, in navigation links only. (#6303)
• A logout link without a security token now asks "Are you sure you want to log out?" instead of refusing. Since v2.3.12 such links, in themes, bookmarks, and Site Links, left the member signed in with an error. Cancel returns to the page they came from if it is on this site, or to the front page. (#6741, #6753)

Changed

BBCodes and HTML

• Shortcodes now run only in text an administrator wrote. News titles and bodies, poll titles, news feeds, and notification emails with a user's text run them only for a current administrator author; others show them as typed. FAQ questions and forum posts in notifications never do. (080505b260)
  • An approved news submission keeps the member as author. Make an administrator its author for them to run.
  • A mailout with an email template saved before you upgrade shows its shortcodes as typed until you open and save it again.
  • Downloads made from uploads before 2.3.13, and uploads still waiting, can still run shortcodes in their name, description, or author website or email. Check those for {.
• Shortcode parameters in content receive quotes, angle brackets, and { as entities. Pages, news, and other stored text are covered; templates are not. A shortcode reading key=value pairs, such as {URL=search|q=O'Brien}, now gets its value cut at the quote. (GHSA-prf8-95f7-7q86)
• HTML saved by an author who may not post script now loses its data- attributes. A page or news item relying on data-toggle stops working when next saved; stored content is not changed. Since 2.3.0 a new install lets no one post script, main administrators included; choose who may in Admin » Preferences. (GHSA-7w79-c68w-m3hq)
• Re-save content an untrusted HTML author could have changed. Content saved before the upgrade keeps what the old cleaning let through; each advisory has read-only queries to find it. (GHSA-cmcq-6m83-2w77, GHSA-fhp6-g58h-v9w3, GHSA-hgqv-65ww-wq7p)
• Some unusual bbcode and markup displays differently. (GHSA-28qc-h8v2-55rf, GHSA-xj8c-p924-m7pq, GHSA-x3h8-x4r6-mc6x)
  • Inside an HTML attribute, a [code], [scode], [table], [html], or [php] block shows as typed, and another bbcode shows its HTML as text.
  • A [hide] block that opens inside an HTML tag and closes outside it shows, as typed, to every reader.
  • A bbcode tag whose ] falls inside an HTML tag or comment shows as text, and such a [hide hides nothing.
  • Shortened text counts characters, so Chinese, Japanese, or Korean text shows twice as much.
• Local images in news and pages are now resized. An [img] of a site file outside the Media Manager asked for its thumbnail with a broken size, so it got the full-size file. It now follows the Default Image Sizes (300 by 300 on a new install). (73227b2392)

Forum

• After updating, run the forum plugin's update when the admin area offers it. It changes no post, but counts edited posts holding markup their author or last editor may not post; some may be legitimate HTML. Check those whose post_user or post_edit_user may not post HTML, without viewing them on the forum as an administrator. If the author may not post HTML, saving the post from Edit strips it; fix the rest in the database. (GHSA-hj5v-m79p-4cjq)

  This read-only query lists every edited post holding <; the posts to check are among them (adjust the e107_ prefix):

  SELECT post_id, post_thread, post_user, post_edit_user FROM e107_forum_post
  WHERE post_edit_datestamp > 0 AND post_entry LIKE '%<%';

• Forum moderators are the users who hold the moderator class, including members of the classes that inherit it. On the tree "Set a default user hierarchy" builds, a forum moderated by Admins and Mods is now moderated by its members and the main administrators, no longer by every administrator; add an administrator to Admins and Mods to keep them moderating it. A forum moderated by Main Admin is now moderated by main administrators alone, who moderate every forum. (GHSA-835r-q7wf-499j)

  

• A new topic needs Thread Creation Class and Post Permission both. (GHSA-pg3x-w47r-26c2)

• A forum a member may post in but not view takes no posts from them. (GHSA-h763-2g75-85x2)

• Only an opening post's edit renames a thread, and a non-moderator's edit no longer unpins it. (GHSA-xj38-4v6m-2c83)

• Split and move list only forums the moderator moderates and can view. (GHSA-hg7j-grmq-hwwv)

• "Enable polls for" refuses a poll, not just its form. It ships set to No One. (GHSA-3qc7-83pq-gf73)

• A sub-forum is closed to whoever its forum is closed to, whatever its own Visibility says. Clear the Sub-forum setting of one meant for a wider audience. (bf9538c730)

• A [hide] block opens for a signed-in member who can view the forum and has posted in its thread. None ever opened before, so every stored block now opens to them. Hidden text also stays out of the RSS feed and the latest forum posts menu. (#6782, f28d0802aa)

• Thread names render only inline bbcode, such as bold, color, and size; other bbcode keeps only its text, and HTML stored in a name shows as typed. (GHSA-c32r-5vgh-pxmg)

• Where uploads allow SVG, an SVG attached to a forum post is offered as a download, not shown as a picture. (#6748)

Comments and List New Items

• If posting or moderating comments stops working after the update, a theme or plugin script needs updating, as comment.php now sends its answers as application/json. Sites defining e_HTTP_STATIC should clear their CDN's cache. (GHSA-vfc3-x99c-2j47)
• List New Items prints headings and info lines as each section built them. BBCode or shortcodes in a heading show as typed, as does chatbox bbcode. (GHSA-7232-gr39-h92m)

Admin area

• Admin lists check each action against its permission, so a delegated administrator may be refused where a list let them through. (#6443, GHSA-g676-96h8-qgv5, GHSA-h657-rx62-qm6j, 2aa750e4e4, e8fd7337e2)
  • Inline edits, sorting, and batch changes need the edit permission, a copy the create permission, a delete the delete permission. Without edit, inline editors are not drawn, FAQs aside.
  • Batch Copy, Export, Create Navigation Link, and Create Featurebox Item run only where offered, the last two also needing the Navigation or Feature Box permission.
  • A batch skips rows the list no longer shows, and says how many. A delete posted for a row the list does not show answers "Deletion Unsuccessful".
  • Lists sharing a table stay apart, such as user ranks and failed logins. The old user ranks editor needs the ranks permission.
  • Custom pages and menus are separate. Of the two permissions labeled "Pages/Menus", 5 covers pages and chapters, J menus; deletes need J1, page options the main administrator.
• Holders of the Theme Manager permission now see its whole menu. Upload Theme, Tools, and the rest were hidden, though each opened by address. The permission now reads "Theme Manager", without "(Preferences)". (#6274, #6428)
• With sessions kept in files, the dashboard no longer makes your next page wait while it contacts e107.org. The add-on update notice is kept site-wide, refreshed after a plugin upgrade or uninstall, a site theme change, or a cache clear. (#6700)

Site links, pages, and menus

• Link fields refuse a javascript:, vbscript:, or data: address, or one starting with a shortcode other than an {e_…} folder, unless you may post script: Navigation, social links, Custom Button URL, custom page URL fields, Linkwords, download mirrors, feature box images, hero buttons, and public uploads. Stored addresses are kept, so review yours; a heading that goes nowhere takes #. (GHSA-2vhc-52q2-2j5f)

  

• Custom page fields and hero slides no longer run script their author may not post. Field values and hero bullets saved before 2.3.13 keep their formatting but lose script and event handlers, with no re-save, except icon, tag, checkbox, and progress-bar values, which show HTML only when saved by someone who may post script. Where you narrowed who may post HTML, kept formatting can include some their author may not post. Old field labels and hero buttons show HTML as text until changed. (GHSA-86rc-hq8m-mwwr, GHSA-fhcg-cf34-cg8h)

• With caching on, a fragment holding a visitor's security token is not cached, so the comment form is built fresh. Clear Admin Area » Settings » Cache once after upgrading. (#6307)

Sign-in and accounts

• The activation resend form gives every request the same answer, and mails an account at most once every ten minutes. A repeat sends nothing unless the last email failed, and the email carries no new password. (#6519, GHSA-cvhc-885w-mm2m)
• CHAP login is discontinued, along with the Password transmission method setting. With CHAP on, the admin login form never submitted, and since v2.3.12 that included sites upgraded from cookie mode. Passwords are now checked as typed. The core database update switches the old setting off, so an old theme login template stops hiding its form. (#6653)
• After signing in, a visitor is returned only to an address with no security token and a plain query. The login menu drops a query holding a token or anything but letters, digits, and _ . , : = & -. The address remembered for after sign-in now comes only from the session, so a members-only site sends a visitor whose remembered query held %, +, or / to the front page. (GHSA-9f6g-4wp7-whmj, GHSA-hq36-v99x-77g4)

Social login

• Social login now ignores stored provider settings that only a site's own code should set. The social plugin saves provider settings only under names Hybridauth supports. Telegram's form no longer offers a callback field. Nothing stored is rewritten; a social sign-in in progress during the upgrade may have to start over. (GHSA-mg3f-xg6g-g3pc, GHSA-p4fv-hmmr-38p8)

  

• Social login checks the provider's TLS certificate, except for OpenID 2.0 providers such as Steam, and offers LinkedInOpenID, OktaOIDC, and X. The bundled Hybridauth is now 3.13.0. A host without a usable CA bundle, which already fails plugin downloads, now fails social login too. (#6372)

• Signed-in pages no longer load the social login library just to ask whether social login is on. Answering used to parse every bundled provider file on every signed-in page, even with social login off. (#6514)

Media Manager

• The Media Manager now touches files only inside its own folders, and says when it keeps one. Deleting a media item, or converting, rotating, or resizing it from the list, leaves a file outside the media folder in place and says it "lies outside the media folder, so it was kept." That covers theme, plugin, and core images, and files the 1.x upgrade listed. The Avatars page's Delete Checked does the same for the avatars folder. Imported files are stored under their cleaned names, and an upload renamed to a type that may not be uploaded is removed. (GHSA-3c5x-q658-vx68, GHSA-69r3-7r4c-6gmw, GHSA-w39w-6mq9-p36q, GHSA-7xc8-m3cv-mq65)

Search

• The core update removes a dead "Registered Members" entry from the search settings. (#6422)
• Advanced search shows the options of one search type at a time. Types share field names, so one type's filter applied to all of them. (#6321)
• A custom page's search result is summarized from its meta description, when it has one. (#6421)

Content plugins

• A news menu's order setting must name columns. The latest-news and news-grid menus accept only a list of columns, each optionally followed by ASC or DESC. Any other value now sorts newest first. (GHSA-x33v-p7mw-q88f)
• The Banner plugin's admin pages can be translated. Their help texts, placeholders, and menu notice now come from the plugin's language file. (#6520, #6354)
• The Tag Cloud menu writes its cache only while the content cache is on. With it off, as a new install leaves it, every page showing the menu wrote a cache file that nothing read. (#6728)

Site address and database

• e107 keeps path info, markup, and other hosts out of the site's web address, and files its caches under it. (GHSA-6mxv-9x4j-8rhr)
  • Expect one cache rebuild after the update. Cached pages, menus, and the combined CSS and JS file get new names; the combined file's name now carries the release, so script fixes reach visitors without emptying the cache. Empty All Cache removes the old ones.
  • On nginx with PHP-FPM: in a PHP location, use fastcgi_split_path_info with PATH_INFO, add try_files $uri =404;, or set cgi.fix_pathinfo=0; in a named location that hands unknown addresses to index.php, add fastcgi_param SCRIPT_NAME /index.php;, with the site's folder in front if it has one.
  • Behind an alias, symlink, or /~user/ address, a web folder whose name holds anything but ASCII letters, digits, and - . _ ~ is percent-encoded in the site's address, and the site's cookies are set on the folder above it. Every application under that folder receives them. Where the name holds a comma, a sign-in from before the update survives signing out until its cookie expires, within a day by default.
• e107 connects on the database port set in e107_config.php. A $mySQLport line was ignored. If yours sets one, check that your database server listens on it. (#6663)

Fixed

BBCodes and HTML

• BBCode links and images lead where their author typed them. An & in a [link], [url], [file], [email], [img], [flash], or [stream] address was encoded too often, so ?a=1&b=2 lost its second parameter. An apostrophe in an [img] alt text or caption no longer shows as an entity. (94ef3d1ae4, 73227b2392)
• A member's & is stored once. Since 2.2.0, text from anyone outside "Class which can post HTML" showed & for a typed &. Older text loses the extra level when next saved, except inside [code], where you remove it by hand. (#6791)
• The first click on a bbcode toolbar button inserts its code. It inserted nothing until you had clicked into the text box. (#6135, #6367)
• An unclosed tag such as [color=#ff0000] stays as typed, not a bare [color]. (#6444)
• Text in malformed bbcode such as [size2]hello[b]world[/size] no longer vanishes. (#6573)
• Plain-text summaries, such as a forum topic's meta description, convert bbcode whichever tags the text holds. (#6323)
• The editor and the parser keep what was typed in six more places. (GHSA-53pg-w64x-rch7, 5d9c02d80c, GHSA-x3v9-7pgp-6c4f, 7df2136d20, 605d4f5c0c, ddcf90a96e)
  • Two bbcodes inserted in one paragraph with the editor's Insert e107 BBcode both survive.
  • Saving from the editor keeps a quote that is part of an attribute value.
  • Tags inside [scode] keep the quotes around their attribute values.
  • With the editor on, a + in a field after an editor field, such as a page's meta title, is no longer saved as %2B.
  • On PHP 8, a page showing a [sanitised] block no longer fails; it shows ##Sanitised##.
  • Text such as a < b beside markup keeps its < on hosts with libxml2 2.9.10 or older, which dropped it and what followed.

Forum, comments, and List New Items

• Quoting a post keeps its bbcode in a [quote] block; one with bold text or a link was quoted as plain text. (#6782)
• Deleting or moving a thread keeps a forum's counts right when a counter was already low. (#6664)
• Forum and topic pages keep quotation marks and apostrophes in their description, and in the og:description and twitter:description copies link previews show. (0a6abeed56)
• List New Items names the guest who started a thread, not an empty link. (#6360)
• List New Items no longer stops with a fatal error with the profanity filter on, which now filters its headings too, nor on PHP 8 when its admin page had not been opened since a fresh install or reinstall. (#6375, d293ed98af)
• Guests see comment lists on PHP 8 with "Display new comment icon" on; they stopped with a fatal error. (#6491)
• Saving the comment menu's caption in one language keeps the others. (#6490)
• A news item's comment count counts only its own comments. (#6766)

Mail

• A page that cannot send its email now says so. The contact form, account removal, most admin test emails, and Users' approve, resend, and quick add all reported success. Account removal now stores no removal key when the email fails. (#6743)

Menus, pages, themes, and forms

• A menu visible to "Everyone but.." a class shows; nobody saw it. (#6279)
• Login and Online menu settings no longer report "Saved" for a failed save. (#6196)
• A popup-window link opens where its link points, not relative to the current page. (GHSA-fm7r-8pvc-x36q)
• A book listing's title, and its description when the book has none, no longer come from its chapters. (#6377)
• A missing or hidden book or chapter answers 404 instead of showing a hidden chapter's name. (#6391)
• On PHP 8, a language pack older than core no longer takes the admin area down through the admin menu. (#6223)
• A date field's calendar stays hidden until clicked on a theme that loads no Bootstrap. (#6111)
• Required fields on the signup and user settings forms are marked with an asterisk again. (#6124)
• Right-aligned dropdowns line up with their button's right edge on Bootstrap 4 themes, core's sign-in and private-message menus among them. (#6328)
• Each entry of the forum's post-options menu is clickable across its width on Bootstrap 4. (#6425)
• On the bootstrap5 theme, the "New downloads" star is drawn at its normal size. (#6656)
• A plugin filed under About appears under About in the admin menu, not in an untitled section. (#6801)
• {UPLOADFILE} and upload.php stay closed while public uploads are switched off, as on a new install. (a7f86886a9)

Search

• The advanced Author filter finds what the picked member wrote. The form sent the member under a name no search area read. (05e772dbb2)
• The custom result prefix set in Admin » Search appears, followed by a space. (#6327)
• Excerpts drop bbcode payloads such as an image's path. (#6299)
• The PHP sort method works on MySQL 8, matches punctuation as typed, ranks on every weighted column, and keeps the words beside a stray +. (#6330, #6313, #6357, #6439)
• A keyword holding # after a space finds matches on the default sort method. (#6478)
• Comments search is offered when no plugin search area is configured. (#6422)
• Leftover entries for removed plugins no longer list their comments or break the search pages on PHP 8. (#5267)
• The search form's advanced button opens on Bootstrap 4 and unframed themes. (#6312)
• Each advanced search label names its own field. (#6300)

Content plugins

• Regression fixed: the FAQ page sent visitors to the admin login. On v2.3.12, /faqs could open the admin area for administrators and the admin login for everyone else. After upgrading, delete e107_plugins/faqs/controllers/ if it is still on disk, then run the FAQs update in Admin » Plugin Manager, which rebuilds the URL settings. (#6502)
• Forum polls display on PHP 8. A topic with a poll, the preview of a new topic with a poll, and the archived polls page stopped with an error. (#5267)
• Deleting a private message deletes its attachment. The file stayed on disk and the member was told the deletion failed. It now goes once neither another copy of the message nor a queued bulk send carries it. The PM plugin's update to 3.2 adds an index for that check. (#6159, #6420)

Users, sign-in, and social login

• Users » Manage offers the built-in Members class in the edit form, Quick Add User, the list filter, and the batch menu. (#6137)
• The delete button on a custom user rank deletes it. (#6527)
• The Signin plugin's navbar form hides where nobody can sign in, as login.php already closes with User Registration/Login disabled and no social login. (#6501)
• Password reset requests are rationed per account, as intended. (#6731)
  • Asking twice within ten minutes is answered "A request has already been sent" instead of mailing a second link.
  • A member whose login name is another account's id, such as 42, is no longer refused a link while that account has a reset outstanding.
• Regression fixed: a guest who opens a logout link is no longer told about a missing security token. With a token, that link added one to every guest's flood-protection hit count. (#6306)
• On PHP 5.6 to 7.2, a sign-in that Alternate Authentication passes on, such as a wrong password, no longer fatals. (#6469)

Bans and the request filter

• Saving text that mentions wget, curl -o, lwp-download, or onmouse no longer ends on a blank page. The request filter answered any posted value or query string holding them with an empty 400 error. (#6759)
• A flooding address is banned once, however many of its requests arrive together. Each parallel request over the threshold added its own ban row and sent its own flood notification. The core database update removes ban rows that repeat an address and type, keeping the first live one, else the earliest, then allows one per address and type. Admin » Users » Banlist refuses an entry already listed with its type, and a failed login logs an automatic ban, and fires user_ban_failed_login, only when it adds one. (#6771)
• The ban list works as documented again. (#6077, #6115, #6408, #6409)
  • The CSV import on the Import/Export page runs. It stopped on a fatal error. It now lists skipped lines and why, refuses a file over 2 MiB, and enforces what it imports at once.
  • Replace all existing imported bans deletes the previous import once the whole file has imported, and a second one started meanwhile is refused.
  • Retriggering extends only the ban that matched, not every ban on the list or every row for the address.

Admin area, plugins, and media

• Site URL can be a bare path such as / again. The Site Information tab silently refused to save it. Until it includes the site's host, the admin home warns main administrators that links in mail sent by scheduled tasks will be relative. (#6117)
• Optimize SQL database now optimizes the site's tables. It named each table without the site's table prefix, reported success, and optimized nothing. Tables that fail are listed with the reason; on a large database the button takes a while. (#6665)
• A Save stopped by the form's own checks now outlines the field at fault in red on the Corporate admin skin, and on K-Admin Inspired once the field loses focus, where nothing showed. (#6523)
• Language Verify's editor for plugin and theme files shows Save beside Close, as it does for core files. (#6760)
• Each Preferences tab is headed with its own name. Email & Contact Info was headed "Display Information". (#6524)
• Uninstalling a plugin whose plugin.xml names comment types in <commentID> no longer deletes every comment on the site, nor fails with a single type on PHP 8. Its own comments are now removed only when its tables are, and kept when they are kept. No bundled plugin declares any. (#6780)
• Regression fixed: the core database update no longer keeps asking to hash stored session ids. A stored session whose new key was already taken stayed behind, so pressing Update repeated the same step; that session is now removed. (#6691)
• Installing or updating a plugin or theme from an archive works when e107_system is on another file system, such as a container volume of its own; it used to stop at "Couldn't Move". If the move into place fails during an update, the installed copy is put back. (#6713)
• Admin » Public Uploads fixes. (#6385)
  • Accepting an upload whose plugin is gone is refused with a message naming it, not a fatal error.
  • The list shows every category name, and the edit form keeps the upload's category on save.
  • Renaming an upload in the list now saves.
• The Media Manager's import list shows files such as stmp.jpg, whose second to fourth characters are tmp. (#6777)

Site address and database

• A site with no site_path in e107_config.php is back on its own media and system folders. From v2.3.4 every such site saved uploads, backups, and logs under the folder 5058f1af83. If files saved since are missing, follow the dashboard's link to Database Utilities » Multi-Site and merge the folder marked Known bad. (#6498)
• Download category links appear on MySQL 8 with binary logging on, its default. The Downloads "Download Categories" link list came back empty there for every account, because the server refused the stored functions it was built with. (#6297)
• Canonical and og:url links are full addresses again where the Site URL holds only a folder, as a subfolder install's does. (#6601)
• URL settings take effect at once where OPcache is set not to recheck changed files. (#6730)

For Developers

Added

• e_parse::toBBCodeUrlAttribute() and e_parse::bbcodeTextAsTyped() encode a bbcode's values once. Give toBBCodeUrlAttribute() a bbcode's stored address; it returns '' for a refused scheme. bbcodeTextAsTyped() gives back any other parameter as typed, for the bbcode to encode once. A bbcode encoding $parm as stored shows & for &. (GHSA-9jr4-3wxc-m2cm, GHSA-x2x3-xr6p-4xc2)

  

New public API

Changed

• Vendored guzzlehttp/psr7 is 2.13.1, so the global GuzzleHttp\Psr7\* functions are gone and a plugin calling them fatals. Use the static methods on Message, Utils, Query, Header, and MimeType. psr7 and what it requires are downgraded to run on PHP 5.6; Hybridauth 3.13.0 needs no downgrade. (#6372)

• e_HTTP is cut at the running script and percent-encodes all but letters, digits, and - . _ ~ / %, unless its folders are the install's own on disk. e_REQUEST_URI and e_REQUEST_HTTP start with one slash, never /\ or /&, and e_SELF and e_REQUEST_URI spell the site's folders as e_HTTP does. (GHSA-6mxv-9x4j-8rhr, GHSA-wjmf-r4mf-m9vg)

  

• e107\User\LogoutConfirmation asks a member who opens a logout link without a token whether to log out. index.php serves it through e107\Routing\RouteTable with e107\Http\Request, Response, and e107\Theme\Page, from the new logout_template.php, which a theme can override. A customized index.php that does not set $_E107['route_table'] keeps the old refusal. (#6753)

• Inside an HTML attribute, print a custom page field with mode=raw, as in alt="{CPAGEFIELD: name=x&mode=raw}", and never a rich text or text area field or a hero bullet's text: printed normally, a value can end the attribute and run script, whoever saved it. (GHSA-86rc-hq8m-mwwr, GHSA-fhcg-cf34-cg8h)

Behavior changes for plugin and theme authors

Fixed

Parser, shortcodes, and themes

• usubstr() and html_truncate() keep the text they should. usubstr() without a length returned '' below PHP 8; html_truncate() with $exact = false lost text that had no space. (#6464, #6475)
• A shortcode class that sets a property before parent::__construct(), or never calls it, no longer fatals on PHP 8, and keeps the value. (#6658)
• The Theme Manager's style form saves only for the site theme, refusing a post that names another. (#6177)
• On PHP 8, cleanHtml() no longer fatals on the call after a <pre> inside a stripped tag, nor e_form::uc_checkbox() on an array value. (#6801)

Admin UI and debug

• "(Add all)" and "(Clear all)" batch options now dispatch, as they never had in v2. (#6089)
• A field with no usable optArray leaves the batch and filter menus with a debug line instead of breaking the list page. (#6403)
• Admin navigation reads its phrases through defset(), so a pack missing one no longer stops the page on PHP 8. (#6526)

Database, preferences, and files

• selectTree() creates no stored functions, and siblings sharing an order no longer interleave. (#6297)
• isTable() sees tables the same instance creates, drops, or renames. (#6374)
• tables(), isTable(), and hasLanguage() no longer list another prefix's tables. (#6672)
• e_db_mysql::lastInsertId() answers for the instance's own last statement. (#6715)
• A multi_row plugin or theme preference keeps its own cache file and object. (#6338)
• e107MailManager reads a queued email back as saveEmail() stored it; a raw apostrophe in its sender, copies, or attachment emptied all three. (34591e2243)
• e_file::copy() passes its options into subfolders and returns false at the first entry it cannot copy; the theme converter's clone stops there. (#6713)
• e_file::get_files()'s standard filter skips only names that start with .tmp. (#6777)

Core

• Who's Online values are defined on every request. (#6362, #6396, #6522)
  • Where goOnline() is skipped, as on AJAX, the online constants are empty strings, so online.php no longer fatals.
  • With an empty online table, MEMBERS_ONLINE is 0.
  • {ONLINE_TABLE_MEMBERS_ONLINE} and {ONLINE_TABLE_GUESTS_ONLINE} were swapped.

Acknowledgments

Thanks to

• @jamyiahxg954-arch for reporting the moderator who could split posts into a forum they did not moderate; to
• @Jimmi08 for reporting the forum poll that a new thread could overwrite, for the forum poll error on PHP 8 (#5267) and the advanced search labels (#6295), for her Download plugin observations (#6497) and the Downloads breadcrumb built too early (#6525), and for the theme logout links refused since v2.3.12 (#6741); to
• @dimante for the images missing since the v2.3.4 upgrade (#5810); to
• @Taffman for the menu shown to all but one class, which nobody saw, and the Logout link v2.3.12 refused (#6275), and the date picker on a theme without Bootstrap (#6111); to
• @KuroiPhoenix for the Site URL that would not save as / and the admin area an old language pack took down (#6101); to
• @sindizzy for the Signin form shown where nobody can sign in (#6501) and the Preferences save that failed without a sign (#6103); to
• @Alex-e107nl for the required fields shown without an asterisk (#6106); to
• @NECPWAweb for the page-sized "New downloads" star on bootstrap5 (#6652); to
• @tgtje for the debug logs in #6355 and #6479 behind six fixes (#6360, #6361, #6362, #6375, #6378, #6491); for reporting the FAQ page that sent visitors to the admin login (#6502); and for the pull requests that made the Banner admin pages translatable (#6520, #6354) and added the forum's admin help phrases (#6647); to
• @fizi for the comment menu caption that saving one language overwrote (#6490, from #6479), and the core database update that kept asking to hash stored session ids (#6691); to
• @Kanonimpresor for the Language Verify editor whose Save button stayed inside it (#6760), and for reporting the request filter that refused text mentioning wget and the pull request that removed it (#6759, #6762); and to
• @ericc-dream for the search pages that leftover entries of removed plugins broke on PHP 8 (#5267).

Full changelog: v2.3.12...v2.3.13