phpBB News

phpBB 3.3.15 Release - Please update

Greetings everyone,

We are pleased to announce the release of phpBB 3.3.15 “In Memory of Mark D. Hamill”. This version is a maintenance and security release of the 3.3.x branch which fixes one security issue, introduces a number of improvements aimed at enhancing the user experience and overall stability of the software and resolves some issues noticed in previous releases.

Since the introduction of phpBB 3.1, phpBB has been using JavaScript and jQuery to improve the responsiveness of prosilver. We did receive a report about a potentially dangerous code in this section. After an internal audit of this and related code, we noticed that some of the handling of data added by an admin is potentially insecure and could lead to cross site scripting.

The improvements include better handling of HTTPS connections in the version check since switching to Guzzle in the previous release as well as the introduction of proper support for TLS v1.3 with SMTP servers.

Notable bug fixes in this release include resolving an issue that resulted in PHP fatal errors when converting from phpBB 2 with Attachment MOD and issues with the pagination resulting in incorrect ordering when searching for users posts. Furthermore, an issue with duplicate users being displayed on the memberlist while sorting and a potential overflow of the topic views count have been addressed.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16790

The packages can be downloaded from our downloads page.

The development team thanks everyone who contributed code to this release: rxu, Kailey M Snay, Alexey Dolzhenko, Neo-CTC, NeoDev, battye, cabot, phpBB TR

If you have any questions or comments, we'll be happy to address them in the discussion topic.

- The phpBB Team

Read more...

Posted April 2, 2025 | 6:58 am

phpBB 3.3.14 Release

Greetings everyone,

We are pleased to announce the release of phpBB 3.3.14 “Bertie All Along”. This version is a maintenance release of the 3.3.x branch which introduces a number of improvements aimed at enhancing the user experience and overall stability of the software and resolves some issues noticed in previous releases.

The improvements include the introduction of separate lists for disabled and not installed Extensions in the ACP as well as the addition of the ability to force reparsing BBCodes via the command line interface (CLI).

We fixed an issue that resulted in AJAX errors when deleting cookies on some pages and added proper handling of E_USER_ERROR in PHP 8.4. Furthermore, an issue with occasionally incorrect results displaying in the trace permission feature and non-working pages when testing out user’s permissions have been resolved. Another issue that resulted in missing buttons for approving new topics or posts has also been fixed.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16691

The packages can be downloaded from our downloads page.

The development team thanks everyone who contributed code to this release: rxu, Daniel James, Jeff Verkoeyen, Matt Friedman, battye

If you have any questions or comments, we'll be happy to address them in the discussion topic.

- The phpBB Team

Read more...

Posted November 20, 2024 | 7:59 am

phpBB 3.3.13 Release

Greetings everyone,

We are pleased to announce the release of phpBB 3.3.13 “Bertie & Ted”. This version is a maintenance release of the 3.3.x branch which introduces a number of improvements aimed at enhancing the user experience and overall stability of the software and resolves some issues noticed in previous releases.

The improvements include Gravatar URLs now using the updated URL format, an enhanced user interface for removing PM recipients, as well as the possibility to remove users by ID via the command line interface. Error handling in PHP 8 has also been improved for errors that were previously suppressed intentionally.

An issue that was introduced in 3.3.12 and resulted in the “new posts” page being updated too often that caused new posts to disappear has been resolved. Further notable fixes include the automatic rehashing of phpBB2 passwords after an upgrade as well as reCAPTCHA in cases where form validation errors were encountered during the registration phase.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16491

The packages can be downloaded from our downloads page.

The development team thanks everyone who contributed code to this release: Daniel James, rxu, battye, LukeWCS, Micha Ober, crowjake

If you have any questions or comments, we'll be happy to address them in the discussion topic.

- The phpBB Team

Read more...

Posted August 29, 2024 | 11:23 am

phpBB 3.3.12 Release

Greetings everyone,

We are pleased to announce the release of phpBB 3.3.12 "Bertie: A phpBB Saga". This version is a maintenance release of the 3.3.x branch which introduces a number of improvements aimed at enhancing the user experience and overall stability of the software, resolves some issues noticed in previous releases, and introduces further security hardening.

In order to reduce the potential of accidentally submitting duplicate posts, we have added extra checks to the frontend and backend that should reduce this possibility in the future. The database queries that are used when searching for unanswered posts and topics have been improved to be faster and more efficient. Some further improvements include enhanced error messages with MySQL when using PHP 8.1 and newer as well as better compatibility with parsing of posts with PHP 8.3.

Reparsing of posts, which is performed when upgrading from previous minor versions of phpBB, will now treat URLs in posts based on the original post content and should no longer cause magic URLs to appear if they were not previously displayed. Additionally, issues with updating phpBB to the latest version should no longer be an issue when having removed the YouTube profile field.

As a means to further strengthen the security of phpBB, we have added additional safeguards against requesting a resend of the activation email too often and have resolved an issue that could cause cron jobs to not run as expected.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16390

The packages can be downloaded from our downloads page.

The development team thanks everyone who contributed code to this release: rxu, Christian Schnegelberger, GanstaZ, Prosk8er, LukeWCS

If you have any questions or comments, we'll be happy to address them in the discussion topic.

- The phpBB Team

Read more...

Posted May 31, 2024 | 10:49 am

End of Support for phpBB 3.2.x

Hello,

As of August 1st, 2024, we will no longer be providing support for phpBB 3.2.x. The support forums will be locked, but will be still be available in a read-only form for reference. All download links for phpBB 3.2.x will be removed. If you still need those packages, you will be able to obtain them from https://download.phpbb.com.

It is recommended that you use these six months to prepare for converting to phpBB 3.3.x. While support for 3.2.x will not be available, support for converting to 3.3.x from 3.2.x will be available in the 3.3.x support forum.

For those who receive support from an international support site, they will dictate their own support schedules and you should seek information from them.

As a reminder, phpBB 3.2.x has already reached End of Life and is no longer receiving maintenance or security fixes. While there are no known vulnerabilities in phpBB 3.2.11, it is recommended that you upgrade to a fully supported version.

Thank you,
The phpBB Team

Read more...

Posted February 1, 2024 | 7:06 pm

phpBB 3.3.11 Release

Greetings everyone,

We are pleased to announce the release of phpBB 3.3.11 “Bertie’s trip to Zagreb”. This version is a maintenance release of the 3.3.x branch which increases the minimum required PHP version, adds a new search index progress bar with added statistics, optimizes our support for PHP 8.2, and adds further security hardening.

In order to ensure compatibility with PHP 8 while using the OAuth login, we have decided to increase the minimum required PHP version to PHP 7.2. While some operating system distributions might still be offering long-term support for PHP 7.1, it is no longer possible for us to offer this while supporting current versions of PHP.

The new search index progress bar will keep admins informed about the progress of the search indexing while displaying statistics about the current state like indexed posts and indexing rate. In order to optimize our support for PHP 8.2, we have resolved some deprecations and added improved checks to avert any unexpected side effects due to changed behavior in the latest PHP versions.

As a means to further strengthen the security of phpBB, we have changed how exceeding the maximum number of CAPTCHA attempts are handled. Users who have attempted to solve a CAPTCHA too many times will now have to wait until their session has expired.

Additionally, we have also improved the handling of smiley packs in the ACP. Previous releases did not enforce the smiley format as strictly, enabling admins to potentially add JavaScript code via these. While admins do have some freedoms, we deemed it to not be expected behavior and have added safeguards against this in this new release. We’d like to thank shin24 for contacting us about this issue via HackerOne.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16291

The packages can be downloaded from our downloads page.

The development team thanks everyone who contributed code to this release: rxu, Christian Schnegelberger, battye, toxyy, Matt Friedman, im4bb, Andrii Dembitskyi, Dark❶, LukeWCS, MannixMD, Micha Ober, lionel-rowe

If you have any questions or comments, we'll be happy to address them in the discussion topic.

- The phpBB Team

Read more...

Posted October 22, 2023 | 5:48 am

phpBB 3.3.10 Release

Greetings everyone,

We are pleased to announce the release of phpBB 3.3.10 “The Way of Bertie”. This version is a maintenance release of the 3.3.x branch which improves support for PHP 8.2, and resolves various issues reported in previous versions.

Previous versions of phpBB started showing a “broken image” icon next to the browser’s fallback emoji due to the service of the Emoji Content Delivery Network (CDN) being shut down. In order to resolve this, the emoji CDN has been replaced alongside other fixes which include improved handling of errors while using the Spamhaus blocklist, and proper handling of emojis when adding feedback in the Moderator Control Panel (MCP).

In addition to this, we have improved support for the use of reCAPTCHA for countries where the main domain might not be accessible, and the explanation of the ACP setting for allowing the “usage of third party content delivery networks” has been improved.

Further hardening has been added to the cron redirect to prevent exceptions from being left unhandled.

Thanks to recent changes to the phpBB repository on GitHub, contributing to phpBB has become easier than ever with the support of GitHub Codespaces. Check out our blog post on how to use GitHub Codespaces with phpBB or find out more on GitHub.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16195

The packages can be downloaded from our downloads page.

The development team thanks everyone who contributed code to this release: Patrick Webster, Christian Schnegelberger, LukeWCS, Matt Friedman, SagePtr, wordlesswind

If you have any questions or comments, we'll be happy to address them in the discussion topic.

- The phpBB Team

Read more...

Posted February 5, 2023 | 12:40 pm

phpBB Collective

Hi everyone,

Following many other open source projects, the phpBB project has created the phpBB Collective on the Open Collective platform. Going forward, we will be able to accept donations from individual contributors, and you will be able to track those donations through the Open Collective platform. We have also joined the GitHub sponsors program, so as a GitHub user, you can now sponsor the phpBB project on GitHub!

Funds acquired through the phpBB Collective will be used to pay project and development related expenses, like server or code hosting bills as well as expenses for in-person events like team meetings or conference attendance costs for phpBB Team Members.

phpBB Collective’s fiscal host, the Open Source Collective 501(c)(6), is a non-profit and allows us to accept donations. Unfortunately, the IRS does not classify donations to this type of entity as tax-deductible charitable contributions.

- The phpBB Team

This announcement can be discussed in the Discuss: phpBB Collective Topic

Read more...

Posted January 12, 2023 | 2:26 pm

Intermediate fix for emoji loading issues

Hi all,

We have noticed that the CDN that provides loading of emojis in phpBB has stopped working.
While a new version that takes care of this is already in the works, you will most likely notice issues with pages taking longer to load and issues with the display of emojis (see e.g. here: viewtopic.php?t=2634321).

Until the next version of phpBB is released, you can resolve this issue by applying the following fix that will be included in the next release:

Open phpbb/textformatter/s9e/factory.php

Find (~ line 359): Replace with: Find (~ line 362): Replace with: Afterwards go to the ACP and purge the cache.

Once the next version of phpBB is released, you should be able to simple overwrite this file again. Preparations for the next release are already underway and it will be published as soon as possible.

- The phpBB Team

Read more...

Posted January 9, 2023 | 1:08 pm

phpBB 3.3.9 Release

Greetings everyone,

We are pleased to announce the release of phpBB 3.3.9 “Bertie’s lunar flyby”. This version is a maintenance release of the 3.3.x branch which improves PHP 8.0 and 8.1 support and clarifies the message when using an unsupported PHP version. Multiple third party libraries like Guzzle and twig were also updated to include their latest bug and security fixes. Please note that the changes in twig might result in issues with loading template files and hence with loading pages of your forum (see viewtopic.php?t=2631681). Check if installed extensions are compatible before updating or disable them prior to the update to 3.3.9.

In addition to this, we have also resolved an issue that was preventing users from updating after having removed the default YouTube profile field. Furthermore, some issues with malformed emails due to special characters in usernames as well as differing behavior related to line endings in newer PHP versions were fixed.

Finally, more hardening was added in the form of ensuring that after a password reset through the “Forgot Password” functionality, all user sessions are also reset. This is now in line with the already existing behavior when changing one’s password.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16194

The packages can be downloaded from our downloads page.

The development team thanks everyone who contributed code to this release: Christian Schnegelberger, Patrick Webster, Dark❶, ＡＮＤＲＩ Ｈ.Ｕ

If you have any questions or comments, we'll be happy to address them in the discussion topic.

- The phpBB Team

Read more...

Posted November 28, 2022 | 11:16 am