phpBB • Free and Open Source Forum Software

Updated the first post to add changes between 3.2.2 & 3.2.3-RC1.

While tests like the mentioned are helpful for doing basic checks of the server setup, it's also important to understand what each of these mean. The BREACH exploit is a server side and browser side issue. It's unrelated to the software being used. In fact, the reason why there is a difference betwe...

As we mentioned in the announcement and the follow-ups, we've taken an extensive amount of time to investigate and try to track how this was possible. Neither Cloudflare nor we were able to find out how the attacker was able to acquire the API key. The very limited number of team members that had ac...

API access with an API key does not require a login to the Cloudflare account, 2FA has no effect on that either. There was no login to our account.
DNSSEC wouldn't have changed anything as the DNS info was not forged or manipulated but rather just modified.

We will post an update with more details once the third-party site has finished its investigation.
Please refrain from trying to guess any involved parties or trying to draw conclusions.
Our detailed investigation has confirmed what has been stated in the announcement.

Until we have resolved the issue with our website update script you should enjoy our reminder that it's cold outside and appreciate the warmth of summer.

Correct. We generally don't replace packaged versions unless there was a packaging issue.

The code you're referring to is not part of the 3.2.2 package. I guess this was added by a manual edit or is part of a custom style. I guess Chrome does no longer like inline JavaScript. This does actually make sense as unobtrusive JavaScript is what should be unused nowadays (and since a few years ...

Please check your server's error log. A 500 error is usually a sign of a PHP error which should be logged into your error log. The exact error message will help quite a bit with actually figuring out what is causing the 500 error for you.

phpBB should have released a 3.2.2-pl1 or something, containing the fixes for the three major bugs reported so far! Many won't know how to fix, and there is going to be months of questions all asking for help on the same issues. Yeah, they in fact should have tested this them selves to see if there...

Thanks for the input. The actual fix is slightly different from the temporary fix but the pointer certainly helped with tracking this down.

Pull request that will go into 3.2.3:
https://github.com/phpbb/phpbb/pull/5082

With the above in mind, I restored the phpBB Gallery extension and can now access ACP again. Reverted to prosilver style and ran the update (with phpBB Gallery installed but disabled). Timeout exactly the same. Restored database, logged into ACP, then deleted phpBB Gallery and ran update again. Tim...

It's kind of difficult for us to support any special type of package. phpBB itself will always try to connect to the database that it's offered. If you upgrade to MariaDB 10 and phpBB is trying to connect to MariaDB 5, then the Synology package is passing the MariaDB 5 settings to it. If you upload ...

We have noticed a similar issue in our appveyor builds with the release of PHP 7.1.13. So far I wasn't able to track down the actual reason for the crash but it sure seems like a segfault in PHP itself. For now I think your safest bet is staying with PHP 7.1.12 and wait for the next update.

Please refer to this topic for the recommended fixes for the migration issues: https://www.phpbb.com/community/viewtopic.php?f=556&t=2453611 If you now get a 500 error, chances are that your cache is corrupted. In your cache folder (should contain folders production & installer) remove everything ex...