Discuss: phpBB 3.3.2 Release

Post by **Marc** » Fri Nov 06, 2020 3:59 pm

Please discuss the announcement here.

Meis2M · Post by **Meis2M** » Fri Nov 06, 2020 4:26 pm

Hello
congratulation

halil16 · Post by **halil16** » Fri Nov 06, 2020 4:29 pm

Thank you so much. I love phpBB. Some say it's too difficult. Yes, I was very sleepless.

Is there more time for the new style to come with phpBB 4? If I remember correctly, it was announced in 2018. Very exciting.

P_I · Post by **P_I** » Fri Nov 06, 2020 4:38 pm

My localhost testbed (CentOS 8.2 with PHP 7.4) successfully (and smoothly) updated by phpBB 3.3.1 using the Full Package and following https://www.phpbb.com/support/docs/en/3 ... date_full/.

Sanity testing looks good and therefore I'll be updating my production boards later today.

Many thanks to all the work behind the scenes and volunteer their time.

Added later: Since phpBB 3.3 is now the flagship release, when in this board going to upgrade to phpBB 3.3? Inquiring minds would like to know.

Post by **Paul** » Fri Nov 06, 2020 5:07 pm

P_I wrote: ↑
Fri Nov 06, 2020 4:38 pm

Added later: Since phpBB 3.3 is now the flagship release, when in this board going to upgrade to phpBB 3.3? Inquiring minds would like to know.

When it is done. Like always, we don't provide timelines on things. We are working on it, but had some issues that needed solving first.

Gumboots · Post by **Gumboots** » Fri Nov 06, 2020 6:31 pm

Is the diff for 3.3.2 RC1 still applicable to the final version?

https://gist.github.com/marc1706/b8988d ... cd62a38ac4

RMcGirr83 · Post by **RMcGirr83** » Fri Nov 06, 2020 6:40 pm

EDIT never mind forum_fn.js had a DIFF in it.

JoshyPHP · Post by **JoshyPHP** » Fri Nov 06, 2020 6:53 pm

Marc wrote: ↑
Fri Nov 06, 2020 3:59 pm
Please discuss the announcement here.

I've just read about SECURITY-264. I think it's bogus and the "fix" is wrong, which makes the situation worse. Where should I post?

Post by **Marc** » Fri Nov 06, 2020 6:58 pm

JoshyPHP wrote: ↑
Fri Nov 06, 2020 6:53 pm

Marc wrote: ↑
Fri Nov 06, 2020 3:59 pm
Please discuss the announcement here.
I've just read about SECURITY-264. I think it's bogus and the "fix" is wrong, which makes the situation worse. Where should I post?

You can open a ticket or contact me via PM or on Discord if you want to maybe discuss this more in detail since I was also the person that implemented this.

JoshyPHP · Post by **JoshyPHP** » Fri Nov 06, 2020 7:07 pm

Marc wrote: ↑
Fri Nov 06, 2020 6:58 pm
You can open a ticket or contact me via PM or on Discord if you want to maybe discuss this more in detail since I was also the person that implemented this.

How about a topic on Area 51? I don't have Discord and I think a topic will be easier to reference.

I'll create a ticket with a proposed fix. I can't find SECURITY-264 or I don't have access to it. Are security tickets made public after release?

Post by **Marc** » Fri Nov 06, 2020 7:20 pm

A topic on Area51 works as well. You can also reach me on IRC if that's maybe easier for you.
Security tickets are typically not made public.

PlanetStyles.net · Post by **PlanetStyles.net** » Fri Nov 06, 2020 7:41 pm

Gumboots wrote: ↑
Fri Nov 06, 2020 6:31 pm
Is the diff for 3.3.2 RC1 still applicable to the final version?

https://gist.github.com/marc1706/b8988d ... cd62a38ac4

I believe so

Gumboots · Post by **Gumboots** » Fri Nov 06, 2020 7:42 pm

Cool. Thought it might be, but wanted to double check.

P_I · Post by **P_I** » Fri Nov 06, 2020 7:54 pm

P_I wrote: ↑
Fri Nov 06, 2020 4:38 pm
Sanity testing looks good and therefore I'll be updating my production boards later today.

JoshyPHP wrote: ↑
Fri Nov 06, 2020 6:53 pm
I think it's bogus and the "fix" is wrong,

I'm not overly concerned with 'bogus', but 'fix is wrong' has me concerned and wondering if that means updating to 3.3.2 might break something.

Is this a 'blocker' type problem or just a bug?

JoshyPHP · Post by **JoshyPHP** » Fri Nov 06, 2020 8:09 pm

No, in practical terms it fixes phpBB's actual behaviour so that's good. After reading more about it, I don't think the report is *bogus*, although I don't have access to it. I believe there was an XSS and that it's been fixed, but it was fixed at the wrong level, which changed the meaning of a little-used API. I'm jumping on it ASAP so that the API can be restored and nobody will ever be affected.

advertisements