diff options
Diffstat (limited to 'phpBB')
-rw-r--r-- | phpBB/docs/CHANGELOG.html | 68 | ||||
-rw-r--r-- | phpBB/includes/constants.php | 2 | ||||
-rw-r--r-- | phpBB/includes/ucp/ucp_groups.php | 17 | ||||
-rw-r--r-- | phpBB/includes/ucp/ucp_pm.php | 7 | ||||
-rw-r--r-- | phpBB/includes/ucp/ucp_pm_viewfolder.php | 7 | ||||
-rw-r--r-- | phpBB/install/convertors/convert_phpbb20.php | 2 | ||||
-rwxr-xr-x | phpBB/install/phpbbcli.php | 2 | ||||
-rw-r--r-- | phpBB/install/schemas/schema_data.sql | 2 | ||||
-rw-r--r-- | phpBB/phpbb/db/migration/data/v32x/v329.php | 37 | ||||
-rw-r--r-- | phpBB/phpbb/db/migration/data/v330/v330.php | 37 | ||||
-rw-r--r-- | phpBB/styles/prosilver/style.cfg | 4 |
11 files changed, 173 insertions, 12 deletions
diff --git a/phpBB/docs/CHANGELOG.html b/phpBB/docs/CHANGELOG.html index 62eef66528..ee9fbbb36c 100644 --- a/phpBB/docs/CHANGELOG.html +++ b/phpBB/docs/CHANGELOG.html @@ -50,9 +50,11 @@ <ol> <li><a href="#changelog">Changelog</a> <ul> + <li><a href="#v330rc1">Changes since 3.3.0-RC1</a></li> <li><a href="#v330b2">Changes since 3.3.0-b2</a></li> <li><a href="#v330b1">Changes since 3.3.0-b1</a></li> <li><a href="#v32x">Changes since 3.2.x</a></li> + <li><a href="#v329rc1">Changes since 3.2.9-RC1</a></li> <li><a href="#v328">Changes since 3.2.8</a></li> <li><a href="#v328rc1">Changes since 3.2.8-RC1</a></li> <li><a href="#v327">Changes since 3.2.7</a></li> @@ -144,6 +146,48 @@ <div class="inner"> <div class="content"> + <a name="v330rc1"></a><h3>Changes since 3.3.0-RC1</h3> + <h4>Bug</h4> + <ul> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-15592">PHPBB3-15592</a>] - "Place inline" button appears when BBcode is disabled (Post settings)</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-15902">PHPBB3-15902</a>] - Out of range error with Sphinx search</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16209">PHPBB3-16209</a>] - Nginx example configuration file blocks an image in the ACP</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16230">PHPBB3-16230</a>] - Check phrasing of FILESYSTEM_CANNOT_* lang keys</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16257">PHPBB3-16257</a>] - Typo in Email Settings section</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16260">PHPBB3-16260</a>] - Missing check whether the index exists in ACP - PHP 7.4</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16261">PHPBB3-16261</a>] - Missing check whether the index exists in install - PHP 7.4</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16262">PHPBB3-16262</a>] - php 7.3 compact() calls with undefined variables causing error page</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16263">PHPBB3-16263</a>] - Apache auth provider test fails on bamboo</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16266">PHPBB3-16266</a>] - Error on clean install with PHP 7.4</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16267">PHPBB3-16267</a>] - Check whether the index exists in ACP BBcodes - PHP 7.4</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16273">PHPBB3-16273</a>] - Trying to access array offset on value of type bool in Memberlist</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16274">PHPBB3-16274</a>] - compact() calls with undefined variables in search.php</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16276">PHPBB3-16276</a>] - Undefined $mode property in bbcode_firstpass class</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16278">PHPBB3-16278</a>] - Update instructions (INSTALL.html)</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16281">PHPBB3-16281</a>] - Extensions' Tab does not show up automatically</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16282">PHPBB3-16282</a>] - Default jQuery CDN URL is outdated on new installs</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16285">PHPBB3-16285</a>] - Missing sanity checks in migrations for 3.3</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16287">PHPBB3-16287</a>] - At first ACP screen after install, error message regarding statistics submission</li> + </ul> + <h4>Improvement</h4> + <ul> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16221">PHPBB3-16221</a>] - ACP statistics are ugly</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16277">PHPBB3-16277</a>] - Move from each() function</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16279">PHPBB3-16279</a>] - Add permission for Emojii in topic title</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16283">PHPBB3-16283</a>] - Update requirements for 3.3.0</li> + </ul> + <h4>Security</h4> + <ul> + <li>[SECURITY-249] - Group avatar overwrite on invalid submit</li> + <li>[SECURITY-250] - Group leader can be tricked into approving user</li> + </ul> + <h4>Hardening</h4> + <ul> + <li>[SECURITY-251] - Unwanted move of PMs to folders</li> + <li>[SECURITY-252] - PMs of unsuspecting users can be marked as important</li> + <li>[SECURITY-253] - PM export without proper validation</li> + </ul> + <a name="v330b2"></a><h3>Changes since 3.3.0-b2</h3> <h4>Bug</h4> <ul> @@ -306,6 +350,30 @@ <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16185">PHPBB3-16185</a>] - Use Xenial build environment on travis-ci</li> </ul> + <a name="v329rc1"></a><h3>Changes since 3.2.9-RC1</h3> + <h4>Bug</h4> + <ul> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-15592">PHPBB3-15592</a>] - "Place inline" button appears when BBcode is disabled (Post settings)</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16269">PHPBB3-16269</a>] - Sphinx backend indexes HTML markup as keywords</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16282">PHPBB3-16282</a>] - Default jQuery CDN URL is outdated on new installs</li> + </ul> + <h4>Improvement</h4> + <ul> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16271">PHPBB3-16271</a>] - Add support for 3.3.x API documentation</li> + <li>[<a href="http://tracker.phpbb.com/browse/PHPBB3-16279">PHPBB3-16279</a>] - Add permission for Emojii in topic title</li> + </ul> + <h4>Security</h4> + <ul> + <li>[SECURITY-249] - Group avatar overwrite on invalid submit</li> + <li>[SECURITY-250] - Group leader can be tricked into approving user</li> + </ul> + <h4>Hardening</h4> + <ul> + <li>[SECURITY-251] - Unwanted move of PMs to folders</li> + <li>[SECURITY-252] - PMs of unsuspecting users can be marked as important</li> + <li>[SECURITY-253] - PM export without proper validation</li> + </ul> + <a name="v328"></a><h3>Changes since 3.2.8</h3> <h4>Bug</h4> <ul> diff --git a/phpBB/includes/constants.php b/phpBB/includes/constants.php index e3dbdc4adb..9508ce5cfc 100644 --- a/phpBB/includes/constants.php +++ b/phpBB/includes/constants.php @@ -28,7 +28,7 @@ if (!defined('IN_PHPBB')) */ // phpBB Version -@define('PHPBB_VERSION', '3.3.0-RC2-dev'); +@define('PHPBB_VERSION', '3.3.0'); // QA-related // define('PHPBB_QA', 1); diff --git a/phpBB/includes/ucp/ucp_groups.php b/phpBB/includes/ucp/ucp_groups.php index d574549093..6eba3a03a9 100644 --- a/phpBB/includes/ucp/ucp_groups.php +++ b/phpBB/includes/ucp/ucp_groups.php @@ -534,7 +534,12 @@ class ucp_groups 'teampage' => $group_row['group_teampage'], ); - if ($config['allow_avatar']) + if (!check_form_key('ucp_groups')) + { + $error[] = $user->lang['FORM_INVALID']; + } + + if (!count($error) && $config['allow_avatar']) { // Handle avatar $driver_name = $phpbb_avatar_manager->clean_driver_name($request->variable('avatar_driver', '')); @@ -556,11 +561,6 @@ class ucp_groups $error = array_merge($error, $phpbb_avatar_manager->localize_errors($user, $avatar_error)); } - if (!check_form_key('ucp_groups')) - { - $error[] = $user->lang['FORM_INVALID']; - } - // Validate submitted colour value if ($colour_error = validate_data($submit_ary, array('colour' => array('hex_colour', true)))) { @@ -875,6 +875,11 @@ class ucp_groups trigger_error($user->lang['NO_GROUP'] . $return_page); } + if (!check_form_key('ucp_groups')) + { + trigger_error($user->lang('FORM_INVALID') . $return_page); + } + if (!($row = group_memberships($group_id, $user->data['user_id']))) { trigger_error($user->lang['NOT_MEMBER_OF_GROUP'] . $return_page); diff --git a/phpBB/includes/ucp/ucp_pm.php b/phpBB/includes/ucp/ucp_pm.php index 4d02620e89..00d1ce7149 100644 --- a/phpBB/includes/ucp/ucp_pm.php +++ b/phpBB/includes/ucp/ucp_pm.php @@ -193,6 +193,8 @@ class ucp_pm trigger_error('NO_AUTH_READ_HOLD_MESSAGE'); } + add_form_key('ucp_pm_view'); + // First Handle Mark actions and moving messages $submit_mark = (isset($_POST['submit_mark'])) ? true : false; $move_pm = (isset($_POST['move_pm'])) ? true : false; @@ -207,6 +209,11 @@ class ucp_pm $submit_mark = false; } + if (($move_pm || $submit_mark) && !check_form_key('ucp_pm_view')) + { + trigger_error('FORM_INVALID'); + } + // Move PM if ($move_pm) { diff --git a/phpBB/includes/ucp/ucp_pm_viewfolder.php b/phpBB/includes/ucp/ucp_pm_viewfolder.php index 09e7bf4d7c..ce40a2507d 100644 --- a/phpBB/includes/ucp/ucp_pm_viewfolder.php +++ b/phpBB/includes/ucp/ucp_pm_viewfolder.php @@ -32,6 +32,8 @@ function view_folder($id, $mode, $folder_id, $folder) $folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']); + add_form_key('ucp_pm_view_folder'); + if (!$submit_export) { $user->add_lang('viewforum'); @@ -197,6 +199,11 @@ function view_folder($id, $mode, $folder_id, $folder) $enclosure = $request->variable('enclosure', ''); $delimiter = $request->variable('delimiter', ''); + if (!check_form_key('ucp_pm_view_folder')) + { + trigger_error('FORM_INVALID'); + } + if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === '')) { $template->assign_var('PROMPT', true); diff --git a/phpBB/install/convertors/convert_phpbb20.php b/phpBB/install/convertors/convert_phpbb20.php index f9b7e8010e..6da6e2eb22 100644 --- a/phpBB/install/convertors/convert_phpbb20.php +++ b/phpBB/install/convertors/convert_phpbb20.php @@ -38,7 +38,7 @@ $dbms = $phpbb_config_php_file->convert_30_dbms_to_31($dbms); $convertor_data = array( 'forum_name' => 'phpBB 2.0.x', 'version' => '1.0.3', - 'phpbb_version' => '3.3.0-RC1', + 'phpbb_version' => '3.3.0', 'author' => '<a href="https://www.phpbb.com/">phpBB Limited</a>', 'dbms' => $dbms, 'dbhost' => $dbhost, diff --git a/phpBB/install/phpbbcli.php b/phpBB/install/phpbbcli.php index 9a9d320b30..cf8cfd18a3 100755 --- a/phpBB/install/phpbbcli.php +++ b/phpBB/install/phpbbcli.php @@ -23,7 +23,7 @@ if (php_sapi_name() !== 'cli') define('IN_PHPBB', true); define('IN_INSTALL', true); define('PHPBB_ENVIRONMENT', 'production'); -define('PHPBB_VERSION', '3.3.0-RC1'); +define('PHPBB_VERSION', '3.3.0'); $phpbb_root_path = __DIR__ . '/../'; $phpEx = substr(strrchr(__FILE__, '.'), 1); diff --git a/phpBB/install/schemas/schema_data.sql b/phpBB/install/schemas/schema_data.sql index b5fc4f13a5..e308c82357 100644 --- a/phpBB/install/schemas/schema_data.sql +++ b/phpBB/install/schemas/schema_data.sql @@ -278,7 +278,7 @@ INSERT INTO phpbb_config (config_name, config_value) VALUES ('tpl_allow_php', '0 INSERT INTO phpbb_config (config_name, config_value) VALUES ('upload_icons_path', 'images/upload_icons'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('upload_path', 'files'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('use_system_cron', '0'); -INSERT INTO phpbb_config (config_name, config_value) VALUES ('version', '3.3.0-RC2-dev'); +INSERT INTO phpbb_config (config_name, config_value) VALUES ('version', '3.3.0'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('warnings_expire_days', '90'); INSERT INTO phpbb_config (config_name, config_value) VALUES ('warnings_gc', '14400'); diff --git a/phpBB/phpbb/db/migration/data/v32x/v329.php b/phpBB/phpbb/db/migration/data/v32x/v329.php new file mode 100644 index 0000000000..e88e264aef --- /dev/null +++ b/phpBB/phpbb/db/migration/data/v32x/v329.php @@ -0,0 +1,37 @@ +<?php +/** +* +* This file is part of the phpBB Forum Software package. +* +* @copyright (c) phpBB Limited <https://www.phpbb.com> +* @license GNU General Public License, version 2 (GPL-2.0) +* +* For full copyright and license information, please see +* the docs/CREDITS.txt file. +* +*/ + +namespace phpbb\db\migration\data\v32x; + +class v329 extends \phpbb\db\migration\migration +{ + public function effectively_installed() + { + return phpbb_version_compare($this->config['version'], '3.2.9', '>='); + } + + static public function depends_on() + { + return array( + '\phpbb\db\migration\data\v32x\v329rc1', + '\phpbb\db\migration\data\v32x\user_emoji_permission', + ); + } + + public function update_data() + { + return array( + array('config.update', array('version', '3.2.9')), + ); + } +} diff --git a/phpBB/phpbb/db/migration/data/v330/v330.php b/phpBB/phpbb/db/migration/data/v330/v330.php new file mode 100644 index 0000000000..05baffbdbd --- /dev/null +++ b/phpBB/phpbb/db/migration/data/v330/v330.php @@ -0,0 +1,37 @@ +<?php +/** +* +* This file is part of the phpBB Forum Software package. +* +* @copyright (c) phpBB Limited <https://www.phpbb.com> +* @license GNU General Public License, version 2 (GPL-2.0) +* +* For full copyright and license information, please see +* the docs/CREDITS.txt file. +* +*/ + +namespace phpbb\db\migration\data\v330; + +class v330 extends \phpbb\db\migration\migration +{ + public function effectively_installed() + { + return version_compare($this->config['version'], '3.3.0', '>='); + } + + static public function depends_on() + { + return array( + '\phpbb\db\migration\data\v32x\v329', + '\phpbb\db\migration\data\v330\v330rc1', + ); + } + + public function update_data() + { + return array( + array('config.update', array('version', '3.3.0')), + ); + } +} diff --git a/phpBB/styles/prosilver/style.cfg b/phpBB/styles/prosilver/style.cfg index 7cc7ba4922..0c7eba6700 100644 --- a/phpBB/styles/prosilver/style.cfg +++ b/phpBB/styles/prosilver/style.cfg @@ -21,8 +21,8 @@ # General Information about this style name = prosilver copyright = © phpBB Limited, 2007 -style_version = 3.3.0-RC1 -phpbb_version = 3.3.0-RC1 +style_version = 3.3.0 +phpbb_version = 3.3.0 # Defining a different template bitfield # template_bitfield = //g= |