phpBB 3.3.15 Release - Please update

[Marc]

Greetings everyone,

We are pleased to announce the release of phpBB 3.3.15 “In Memory of Mark D. Hamill”. This version is a maintenance and security release of the 3.3.x branch which fixes one security issue, introduces a number of improvements aimed at enhancing the user experience and overall stability of the software and resolves some issues noticed in previous releases.

Since the introduction of phpBB 3.1, phpBB has been using JavaScript and jQuery to improve the responsiveness of prosilver. We did receive a report about a potentially dangerous code in this section. After an internal audit of this and related code, we noticed that some of the handling of data added by an admin is potentially insecure and could lead to cross site scripting.

The improvements include better handling of HTTPS connections in the version check since switching to Guzzle in the previous release as well as the introduction of proper support for TLS v1.3 with SMTP servers.

Notable bug fixes in this release include resolving an issue that resulted in PHP fatal errors when converting from phpBB 2 with Attachment MOD and issues with the pagination resulting in incorrect ordering when searching for users posts. Furthermore, an issue with duplicate users being displayed on the memberlist while sorting and a potential overflow of the topic views count have been addressed.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16790

The packages can be downloaded from our downloads page.

The development team thanks everyone who contributed code to this release: rxu, Kailey M Snay, Alexey Dolzhenko, Neo-CTC, NeoDev, battye, cabot, phpBB TR

If you have any questions or comments, we'll be happy to address them in the discussion topic.

- The phpBB Team

[Marc]

Release highlights

• Security Issues
  • Use jQuery to generate HTML from page data: SECURITY-283
• Notable Improvements
  • Improved handling of version check with Guzzle: PHPBB-17443
  • Support TLS v1.3 for SMTP servers: PHPBB-17467
• Notable Bugfixes
  • Fatal error when converting from phpBB 2 with Attachment MOD: PHPBB-17436
  • Incorrect ordering of pagination in user posts search: PHPBB-17422
  • Duplicate users on memberlist: /PHPBB-17227
  • Overflow of topic views column: PHPBB-17381

[Marc]

Event changes

PHP Events

• core.acp_account_activation_edit_add
  Placement: includes/acp/acp_board.php
  Arguments: act_ary, act_options
  Added in Release: 3.3.15-RC1
  Explanation: Event to add and/or modify account activation configurations

• core.acp_main_add_actions
  Placement: includes/acp/acp_main.php
  Arguments: action, id, mode
  Added in Release: 3.3.15-RC1
  Explanation: Event to add custom ACP quick actions

• core.acp_main_add_actions_confirm
  Placement: includes/acp/acp_main.php
  Arguments: action, confirm, confirm_lang, id, mode
  Added in Release: 3.3.15-RC1
  Explanation: Event to add confirm box for custom ACP quick actions

• core.group_add_user_before
  Placement: includes/functions_user.php
  Arguments: add_id_ary, group_id, group_name, pending, user_id_ary, username_ary
  Added in Release: 3.3.15-RC1
  Explanation: Event before users are added to a group

Template Events

• None

ACP Template Events

• None