Discuss: phpBB 3.3.11 Release

[indy_gopher]

Using the recommended procedure for updating, this update was reported as "database only". Can someone confirm that this is a database-only update?

[Paul]

What recommended method did you use? Replacing all files? If not, no, it is definitely not a database only update, please post in support with the steps you followed, so we can provide instructions on how to properly finish the update.

[Tommy Herrmann]

Hello,

thank you very much for this update. I have PHP 8.2.11 on the server.

I had this Ajax error too...

... other than this everything worked out perfectly.

[halil16]

Isn't something like "Database update only..." normal? We've already changed the files, doesn't it say that because what's left is the database? I was always seeing him.

[stevemaury]

Isn't something like "Database update only..." normal? We've already changed the files, doesn't it say that because what's left is the database? I was always seeing him.

Yes, if you use the file replacement method.

[Sniper_E]

Since phpbb moved from mods to extensions I have used the 'Advanced Update' method. I would recommend this method to everyone.
The phpBB-3.3.10_to_3.3.11.zip package update went as smoothly as all my other past updates.
Never any problems or issues. Not to mention the hash issue this time round, because that was no big deal.

None of my core files are modified so after uploading the downloaded updated core files then the database is updated and done.
Then for the styles I download the updated prosilver and replaced all the files, unmodified also.
And on any custom styles I have, like mine, I manually edited the style changes listed for the new version.

Thanks for the packages guys, you make updating effortless.

[warmweer]

Since phpbb moved from mods to extensions I have used the 'Advanced Update' method. I would recommend this method to everyone.

This isn't what you describe in the following

None of my core files are modified so after uploading the downloaded updated core files then the database is updated and done.
Then for the styles I download the updated prosilver and replaced all the files, unmodified also.
And on any custom styles I have, like mine, I manually edited the style changes listed for the new version.

This sounds as though you're using the Changed Files package rather than the Advanced Update method.

[Sniper_E]

This is the method I described above that I have been using. https://www.phpbb.com/downloads/3.3/adv ... ion=3.3.10

As per the instructions you download and extract those files and upload them to your server.
Then you go to the /install directory and select update.
It checks the difference in the core files and gives you a download of all the changed files it found.
You download those changed files and upload them to your server.
It then checks the files again and moves on to updating the database.
And when complete all you have to do is update the changes in the style files.

This is exactly what I described in my post above. How could you possibly get confused on what I posted?

[warmweer]

...
This is exactly what I described in my post above. How could you possibly get confused on what I posted?

You did mention:

None of my core files are modified

Which implies that the Changed Files package is all you need.
Even for the prosilver files: the styles/prosilver contains only prosilver files that were changed, so those are the only files you would need to transfer your style edits to.

It's just that what you described is not wrong as such, but you probably had edits in some 3.3.10 prosilver files which were not changed in 3.3.11 prosilver so those didn't need updating.

[Mick]

I have used the 'Advanced Update' method. I would recommend this method to everyone.

You should be careful recommending the advanced update to everyone. Not everybody has the same skills as you and there is only limited support for modified boards as phpBB no longer supports modifications.

Warning: The advanced update is for expert users that have made custom edits to core files. If you have a standard installation of phpBB that only includes downloaded extensions or styles this update package is not applicable to you and SHOULD NOT be used.

[Sniper_E]

I understand now guys. I retract recommending using the Advanced Update method.
I compared the files in the Changed Files download with the Update Archive I downloaded and they are the same files. Same update results.

I'll use the Changed Files method on the next release. It looks to be a little more simple the way I update.
Thanks for the guidance warmweer and Mick toward the correct way I should be updating. You guys are correct.

[invenio]

Another flawless upgrade. Thank you to the development team.

[calvi]

After doing to upgrade from 3.3.10 to 3.3.11, I ran "composer audit" with the following result:

Code: Select all

Found 1 security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | symfony/http-kernel                                                              |
| CVE               | CVE-2022-24894                                                                   |
| Title             | CVE-2022-24894: Prevent storing cookie headers in HttpCache                      |
| URL               | https://symfony.com/cve-2022-24894                                               |
| Affected versions | >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5 |
|                   | .0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.8.0|>=2.8.0,<3.0.0|>=3.0.0,<3.1.0|>=3.1.0,<3 |
|                   | .2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<4.0.0|>=4.0.0,<4.1.0|>=4.1.0,<4.2.0| |
|                   | >=4.2.0,<4.3.0|>=4.3.0,<4.4.0|>=4.4.0,<4.4.50|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5. |
|                   | 2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.20|>=6.0.0,<6.0.20|>=6.1.0,<6.1.12|>=6.2. |
|                   | 0,<6.2.6                                                                         |
| Reported at       | 2023-02-01T08:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
Found 3 abandoned packages:
+---------------------------------+---------------------------------+
| Abandoned Package               | Suggested Replacement           |
+---------------------------------+---------------------------------+
| symfony/debug                   | symfony/error-handler           |
| zendframework/zend-code         | laminas/laminas-code            |
| zendframework/zend-eventmanager | laminas/laminas-eventmanager    |
+---------------------------------+---------------------------------+

That security vulnerability is fixed in symfony/http-kernel 4.4, but I couldn't get the forum to work after updating all symfony components to 4.4. Is a fix for this in hand?

[GanstaZ]

Just updating components via composer will not solve it. You will need to modify core files to support that version.

PS. Post below answers all questions)

[Marc]

After doing to upgrade from 3.3.10 to 3.3.11, I ran "composer audit" with the following result:

Code: Select all

Found 1 security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package           | symfony/http-kernel                                                              |
| CVE               | CVE-2022-24894                                                                   |
| Title             | CVE-2022-24894: Prevent storing cookie headers in HttpCache                      |
| URL               | https://symfony.com/cve-2022-24894                                               |
| Affected versions | >=2.0.0,<2.1.0|>=2.1.0,<2.2.0|>=2.2.0,<2.3.0|>=2.3.0,<2.4.0|>=2.4.0,<2.5.0|>=2.5 |
|                   | .0,<2.6.0|>=2.6.0,<2.7.0|>=2.7.0,<2.8.0|>=2.8.0,<3.0.0|>=3.0.0,<3.1.0|>=3.1.0,<3 |
|                   | .2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<4.0.0|>=4.0.0,<4.1.0|>=4.1.0,<4.2.0| |
|                   | >=4.2.0,<4.3.0|>=4.3.0,<4.4.0|>=4.4.0,<4.4.50|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5. |
|                   | 2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.20|>=6.0.0,<6.0.20|>=6.1.0,<6.1.12|>=6.2. |
|                   | 0,<6.2.6                                                                         |
| Reported at       | 2023-02-01T08:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
Found 3 abandoned packages:
+---------------------------------+---------------------------------+
| Abandoned Package               | Suggested Replacement           |
+---------------------------------+---------------------------------+
| symfony/debug                   | symfony/error-handler           |
| zendframework/zend-code         | laminas/laminas-code            |
| zendframework/zend-eventmanager | laminas/laminas-eventmanager    |
+---------------------------------+---------------------------------+

That security vulnerability is fixed in symfony/http-kernel 4.4, but I couldn't get the forum to work after updating all symfony components to 4.4. Is a fix for this in hand?

phpBB does not use the code that is affected by this issue and hence is also not affected by the mentioned issue. The target version for the next major release of phpBB will be Symfony 6.4.