Phorum Support Forums - Announcements

Version 6.0.4 Released (no replies)

Brian Moon — Mon, 20 Jul 2026 10:26:35 -0500

Version 6.0.4 is released. This fixes a bug where the editor toolbar was not showing.

[github.com]

Phorum 10.0.0-alpha-4 available (no replies)

Brian Moon — Sat, 18 Jul 2026 10:07:16 -0500

Phorum 10.0.0-alpha-4 available

[github.com]

New features

RSS, Atom, and JSON Feed subscriptions — every forum, and every thread, now has a feed, alongside a site-wide "recent posts" feed. Available in three formats (.rss, .atom, .json) so readers can pick whatever their feed app supports, with an admin on/off switch and proper autodiscovery tags for feed readers to pick up automatically.
Icons throughout the interface — the navigation bar, forum and folder listings, thread list, post actions (Reply, Edit, Delete, Follow), and announcements all now carry icons, making the UI easier to scan at a glance.
A cleaner moderator toolbar — moderator actions (Review Queue, Reported Content, Close, Move, Merge, Delete) are now tucked behind a single "Moderate" dropdown instead of a wall of same-weight buttons sitting next to Reply and Follow.
Admins can now pick up schema patches without a full version bump — visiting /upgrade?force=1 while logged in re-runs the upgrade/patch process on an already-installed site, for cases where a patch ships between releases.

Fixes

Editing a forum in the admin panel no longer silently turns a folder back into a regular forum on save.
Upgrading from Phorum 6 no longer hits a MySQL syntax error partway through the schema check.
A partially-applied schema patch (e.g. from an interrupted upgrade) no longer blocks every later patch from applying — already-applied changes are now detected and skipped instead of aborting the whole run.
Sites upgrading from Phorum 6 now get the pm_new_count column they were missing, backfilled from existing unread private messages instead of starting everyone at zero.

Polish

Font sizes across the Emerald theme (and everything that builds on it) are now driven by a shared, named type scale instead of scattered one-off values — more consistent typography sitewide.
Assorted sizing and spacing refinements: thread author byline, forum descriptions, announcement subject text and spacing, RSS button placement and styling.

Phorum 10.0.0-alpha-3 available (no replies)

Brian Moon — Fri, 17 Jul 2026 14:12:12 -0500

Phorum has been fully rewritten from the ground up — and yet, if you're running Phorum 6 today, you can upgrade in place. The database schema is unchanged and fully compatible. Same tables, same columns, same data. What's changed is everything around it.

(If you're still on Phorum 5.x, you'll need to upgrade to Phorum 6 first before moving to Phorum 10.)

In this version:

Added

In-place upgrade from an existing Phorum 6 database. A new /upgrade flow detects a Phorum 6 database (identified by its own internal_version setting) and brings it up to Phorum 10's schema — adding new tables and columns without touching anything Phorum 6 already created. No data is changed, deleted, or converted.
Forced password change. Admins can flag a user account to require a new password before it can do anything else; the user is redirected to a dedicated change-password page until they comply.
Per-forum edit permission + site-wide edit time limit. Editing your own posts is now gated by a real permission bit (configurable per forum/group, alongside the existing reply/post/moderate bits) and an optional site-wide time limit after which a post can no longer be edited.
Thread merge. Moderators can fold one thread into another as a single-form action — the merged thread's posts, permalinks, and search index entries are preserved.

Changed

Custom fields storage now matches real Phorum 6. Field values live in one user_custom_fields table (previously two invented tables), and field definitions are stored as a settings blob rather than a separate config table — mirroring how Phorum 6 itself has always done it.
Note: forum-level and message-level custom fields — which never existed in real Phorum 6 — are no longer supported, only user-profile fields. If your alpha-2 install has data in the old tables, it is not migrated or read by this release; it will need to be handled manually if it needs to be preserved.

Fixed

/upgrade could stay reachable and mutate the database on an already-installed site; it's now guarded the same way the installer is.
The upgrade flow didn't mark the site as installed on completion, so it would loop back to /upgrade forever after a successful upgrade.
The post-password-change redirect could double up base_path (when configured) and dropped the original query string.
Two admins editing different custom fields at the same time could silently overwrite one another's change; saves are now conflict-safe.
Merging a thread didn't carry over the target thread's open/closed state, and could leave already-read posts marked unread after a cross-forum merge.
A flagged admin account could use the entire admin panel indefinitely without ever being forced to change its password.
A database upsert helper used by several mappers could silently swallow a genuine constraint-violation error instead of surfacing it.

Improved

Reduced duplicated logic around URL building, open-redirect validation, schema migration, and thread moderation.
Extended translation coverage to the installer/upgrade screens and several previously English-only validation messages.
Reduced database queries on thread pages (permission checks are now resolved once per request instead of once per message) and on the upgrade confirmation screen.

Dependencies

Bumped league/commonmark to 2.8.3.

Phorum 10.0.0-alpha-1 available (no replies)

Brian Moon — Sat, 11 Jul 2026 21:00:39 -0500

# Phorum 10 — A Complete Rewrite, Built for Modern PHP

*A note on the version number: Phorum 10 is a ground-up rewrite, schema-compatible with earlier versions but otherwise entirely new code. The version number reflects that break, not a count of ten sequential releases.*

Phorum has been fully rewritten from the ground up — and yet, if you're running **Phorum 6** today, you can upgrade in place. **The database schema is unchanged and fully compatible.** Same tables, same columns, same data. What's changed is everything around it.

*(If you're still on Phorum 5.x, you'll need to upgrade to Phorum 6 first before moving to Phorum 10.)*

## A modern foundation

The old procedural, PHP4-era codebase is gone. Phorum now runs on:

- **PHP 8.3+**, with a proper class-based architecture — controllers, services, and data mappers replace the global `$PHORUM` superglobal and bare procedural functions
- **Composer** for dependency management and autoloading (PSR-4)
- **Twig 3** templates instead of Phorum's custom template syntax
- **PHPUnit**, with nearly 700 tests covering the application

Existing plugins aren't abandoned: the classic `phorum_api_hook()` plugin hook system is preserved (via a compatibility wrapper), and the BBCode module has already been ported over.

## New capabilities

- **Markdown support**, alongside BBCode — posts can use either, per-message
- **A real admin panel**, including a moderation audit log, ban management, custom fields, and user groups with per-forum permissions
- **Automatic redirects from old URLs** — legacy `read.php?1,2,3`-style links 301-redirect to the new clean URL structure, so old bookmarks and search rankings survive the migration
- **Flood control** and **edit-history diffs** (line-level, so you can see exactly what changed in an edited post)
- **A web-based installer**

## Built for search engines and social sharing

- Canonical URLs and `rel=prev`/`rel=next` pagination hints on every listing page
- OpenGraph tags on forums and threads, so links posted to Slack, Discord, or social media get proper title/description previews
- Schema.org structured data (JSON-LD) on forum and thread pages
- Smart pagination that scales to forums with tens of thousands of pages, instead of rendering every page number

## Design

- All six original themes — Emerald, Topaz, Sapphire, Ruby, Diamond, Amethyst — carried forward, rebuilt with modern CSS (custom properties, no more table-layout hacks)
- Fully responsive: table-based lists collapse into touch-friendly cards on mobile
- Accessibility built in: skip links, ARIA labels, visible focus rings, proper heading structure

## Speaks your language

16 locales ship out of the box (Arabic, Bengali, Chinese Simplified/Traditional, Dutch, French/Canadian French, German, Hindi, Indonesian, Portuguese/Brazilian Portuguese, Russian, Spanish, Urdu), with English as the reference translation and a fallback chain so partial translations never show blank strings.

## Security

CSRF protection is enforced on every form submission, and output is auto-escaped by Twig by default — the two most common ways old-school forum software gets exploited.

Phorum 6.0.3 Released (no replies)

Brian Moon — Thu, 09 Jul 2026 21:32:02 -0500

Phorum 6 brings PHP 8 support to Phorum.

Download on the download page.

Move complete! (1 reply)

Scott Finegan — Tue, 16 Nov 2021 10:51:14 -0600

If you find something not working here, and it worked previously, let me know.

Future of Phorum.org Hosting (1 reply)

Thomas Seifert — Sun, 07 Nov 2021 08:59:37 -0600

Hello everyone,

while I couldn't work at all on Phorum anymore, I was hosting the phorum.org site for the last couple years.
As I'm not running public servers anymore from 15th of November this year, I also can't continue hosting the phorum.org site anymore.

Any proposals or takers who can reliably and trustfully continue the hosting adventure?

Get in touch through PM here!

thomas

Phorum 5.2.23 released (12 replies)

Oliver Riesen-Mallmann — Sun, 12 Jul 2020 10:01:43 -0500

I'm happy to announce our latest stable release Phorum 5.2.23.

It is a bug fix release over 5.2.22 fixing some issues reported since the last release.

You can download this new release from our downloads page or our github page.

Missing column force_password_change added.
Quoted text lines truncated after 50 characters (fixing #1020).

Phorum 5.2.22 released (10 replies)

Oliver Riesen-Mallmann — Thu, 01 Dec 2016 16:28:23 -0600

I'm happy to announce our latest stable release Phorum 5.2.22.

It is a bug fix release over 5.2.21 fixing some issues reported (including patches, thanks folks!) and other collected changes since the last release.

You can download this new release from our downloads page or our github page.

Redirect to index.php when there's no query string (fixing #1000).
Replaced shortened array syntax as of PHP 5.4.
Workaround for corrupted serialized meta data. When database encoding changed from single to multibyte character set unserialize function fails for data with multibyte characters.
Check banlists for addon.php.
random_int function defined too late.
Force password change option. Start of renovation of our password system. First step: New administrator option to force a password change for individual or all users via the control center. After reload a page or after logging-in
the user lands directly on the (already existing) "change password" dialog in the control center. A message in a red box says "For security reasons, you are required to change your password.". The user can only move inside the control center until he changed the password. Every other link is redirected to the change password dialog.
Filter link for IP address in user admin panel. Provides an IP address filter clickable link without opening "details". Provided by Scott Finegan.

Template changes:

Changed some indents and removed comment to closed trac issue 213.
Unnecessary closing div removed.
Revision of emerald template.

Phorum 5.2.21 released - Minor Security Fixes (no replies)

Oliver Riesen-Mallmann — Tue, 20 Sep 2016 08:47:24 -0500

I'm happy to announce our latest stable release Phorum 5.2.21.

It is a bug fix release over 5.2.20 fixing some issues reported (including patches, thanks folks!) and other collected changes since the last release.

Also includes some minor security fixes as can be seen below.

You can download this new release from our downloads page or our github page.

Convert $PHORUM = $GLOBALS['PHORUM'] to global $PHORUM (fixing #598)
Fixing various invalid index warnings
W3C validator: There is no attribute "onChange" (fixing #908)
W3C validator: Value of attribute "method" cannot be "POST"
Missing alt-attributes added
Module Tidy Output is corrupting avatar images (fixing #911)
Id and name attribute value mismatch (fixing #917)
Fix character set for search title
Multi byte safe word wrapping
Do not substitute smileys in html entities (fixing #827)
Replace nobr by css
Create thumbnails as PNG (fixing #895)
Fix Group Membership filtering
Random Extension: Implements a PHP 5.x fallback for random_bytes and random_int functions
Data validation enhanced (fixing #1001 partly)
Set cookies with httponly (fixing #1001 partly)
X-Frame-Options added
Add posting token to login and register (fixing #1001 partly)
Obsolete assignment by reference (&new) removed
Replaced ENT_COMPAT by ENT_QUOTES
Made admin interface XHTML 1.0 Transitional compliant
Replace PHP short tags
BBCode Module: New settings for stripping message bodies
Event Logging Module: Support for for ipv6
SMTP Module: Upgrade phpmailer

Phorum 5.2.20 released - Minor Security Fixes (9 replies)

Thomas Seifert — Thu, 03 Mar 2016 14:45:10 -0600

We are happy to announce our latest stable release Phorum-5.2.20.
It is a bug fix release over 5.2.19 fixing some issues reported (including patches, thanks folks!) and other collected changes since the last release.
Also includes some minor security fixes as can be seen below.

You can download this new release from our downloads page or our github page.

- fixed message pruning with umlauts in forum name
- fixed possible stored and reflected XSS on attachment preview (minor, only could affect the author himself)
- fixed minor security flaw on IIS and open redirect, reported by Curesec
- send 500 HTTP status code in case of database error
- Fix access check for user given only by user_id (fixing #892 )
- Fixed PHP 5.4 notice for iScramble code

Phorum.org now hosted in Germany! Please report any issues you encounter (5 replies)

Thomas Seifert — Mon, 06 Feb 2017 09:40:18 -0600

Phorum.org is now hosted in Germany, let me know if you run into any issues on the site!

What do YOU expect from the next major phorum release? (31 replies)

Thomas Seifert — Tue, 17 Nov 2015 19:13:02 -0600

We are currently discussing on how to go forward with the next major release of phorum.
How we should build it, what should be included, what should be possible with it.

Therefore we are asking for your opinion:
What would you like to see in the next major Phorum release?

If you are a (module or other) developer
What kind of extendability, integration or other development support would you like to see in Phorum?

Just dream wildly ;-).

Phorum 5.2.19 released - SECURITY FIX (no replies)

Thomas Seifert — Fri, 24 Aug 2012 08:47:20 -0500

We are happy to announce our latest stable release Phorum-5.2.19.
It is a bug fix release over 5.2.18 fixing some issues reported (including patches, thanks folks!) and other collected changes since the last release.

It also includes a security fix for an XSS issue reported by High-Tech Bridge Security Research Lab in the group moderation screen in the controlcenter. Thanks!

You can download this new release from our downloads page.

This is the excerpt from the changelog:

Fri Aug 24 15:20:02 2012 +0200: Thomas Seifert
* Correction phrase search in non-fulltext mode ( fixes #880 )

Fri Aug 24 15:08:24 2012 +0200: Thomas Seifert
* Removed TYPE= create table options. Default table types should be used wherever possible.

Fri Aug 24 14:37:09 2012 +0200: Thomas Seifert
* fixed possible XSS reported by High-Tech Bridge Security Research Lab

Fri May 25 08:57:17 2012 +0200: Thomas Seifert
* Fix moderator list retrieval

Performance improvements for moderator list (version for 5.2, by GroM)
Thu Mar 8 15:04:14 2012 +0100: GroM
* Performance fix for moderator list (exclude inactive) - DB

Mon Dec 19 14:59:53 2011 +0100: Thomas Seifert
* fixed a fatal error in moderation actions when the message cache is enabled (thanks for the patch to Jurij Kovacic)

Mon Dec 19 14:56:12 2011 +0100: Thomas Seifert
* fixed even logging logviewer

Fri Oct 7 16:28:33 2011 -0500: Brian Moon
* don't include PATH_INFO in the current URL.

Tue Oct 4 00:57:03 2011 +0200: Maurice Makaay
* Fixes for XSS issues in admin interface URLs.

Phorum 5.2.18 Released - SECURITY FIX (no replies)

Brian Moon — Fri, 09 Sep 2011 11:37:58 -0500

We are happy to announce our latest stable release Phorum-5.2.18.

It includes a security fix for an XSS issue reported by Paul Davis in the admin login screen. Thanks Paul!

You can download this new release from our downloads page.

Phorum 5.2.17 released - SECURITY FIX (no replies)

Thomas Seifert — Fri, 26 Aug 2011 05:59:58 -0500

We are happy to announce our latest stable release Phorum-5.2.17.
It is a bug fix release over 5.2.16 fixing some issues reported (including patches, thanks folks!) and other collected changes since the last release.

It also includes a security fix for an XSS issue reported by Russ McRee @ holisticinfosec in the real name screen in the controlcenter. Thanks Russ!

As there were again some users having problems while running phorum on PHP4 we made PHP5 a requirement with this version. Effectively that means that users running PHP4 won't be able to install Phorum anymore and the install screen will tell them so.

You can download this new release from our downloads page.

This is the excerpt from the changelog:

Thu Aug 25 16:22:59 2011 +0200: Thomas Seifert
* fixed XSS reported by Russ McRee @ holisticinfosec

Sun Jul 31 12:46:18 2011 +0200: Maurice Makaay
* Fixed a Safari prompt() issue for the editor tools.

Fri Jul 8 15:15:16 2011 +0200: Thomas Seifert
* fixing thread title in first merge thread screen (thanks to vrtisworks, fixes #868)

Fri Jul 8 10:54:49 2011 +0200: Thomas Seifert
* first part of "Make Ajax calls without enabled cookies work". Server-side work is done with this commit. Now only the JS-part in the phorum ajax lib is missing (related to #816)

Fri Jul 8 10:22:10 2011 +0200: Thomas Seifert
* fixed "multibyte chop corruption" (fixes #865, thanks to Phorum user glen!)

Fri Jul 8 10:10:15 2011 +0200: Thomas Seifert
* fixed "Follow mode is not kept when quoting" (fixes #869, thanks to mariusmuja)

Tue Jul 5 12:17:27 2011 +0200: Thomas Seifert
* getting rid of warning when uploading zero sized file in controlcenter. Thanks to hsn! (fixes #859).

Tue Jul 5 12:12:50 2011 +0200: Thomas Seifert
* fixing "invalid" sql. Thanks to hsn. (fixes #858)

Tue Jul 5 11:58:27 2011 +0200: Thomas Seifert
* unified the webserver check in console scripts and added shebang-line. Thanks to glen! (fixing #866)

Tue Jul 5 11:42:59 2011 +0200: Thomas Seifert
* fixing invalid message but upon splitting threads. Thanks to rfc! (Fixing #870)

Tue Jul 5 11:38:55 2011 +0200: Thomas Seifert
* fixing php warning when Phorum is set to Read-Only. Thanks to rfc! (fixes #871)

Tue May 10 03:37:34 2011 +0000: brian
* if the current running script has defined PHORUM_ADMIN, we don't need to check file access permissions

Tue Apr 12 10:23:04 2011 +0000: ts77
* better message cache invalidation on moderation actions. now using the correct forum_id for messages moderated in a different forum than the current one and invalidation just once for each forum.

Sun Mar 13 10:10:47 2011 +0000: ts77
* added option to phorum_strip_body to skip stripping tags - and use that for the plain text quoting to avoid missing data in the quotes.

Tue Feb 8 05:05:47 2011 +0000: brian
* Adding a new hook to allow for alternate methods of retrieving private messages. e.g. for doing a module that pages the results.

Mon Jan 24 05:27:29 2011 +0000: mmakaay
* Added Brazillian Portuguese translation for Spam Hurdles.

Public phorum commits mailinglist (2 replies)

Thomas Seifert — Fri, 08 Jul 2011 04:47:42 -0500

Github doesn't seem to provide any options to get notifications about new commits in watched repositories and there is only one "service hook" which can send to exactly one email address.
And from the recent discussion in the forums there would be interest in a mail notification about new commits.

Therefore I've setup a mailinglist where you can subscribe if you are interested in the commits:
[mysnip-solutions.de]

Have fun!

Phorum Development has moved to Github (9 replies)

Thomas Seifert — Tue, 22 Oct 2013 03:40:57 -0500

As proposed before we've moved our revision control from subversion to git and that git repository together with the bug tracking to Github. It seems like github issue tracking doesn't support attachments now but the bugs from trac were imported over there on June 11th.

The new url is
https://github.com/Phorum/Core

Please bear with us while we are working on getting our release scripts, published urls and similar up to speed with that change.
For questions regarding how to use git or github I'll have to point you to the github help pages for now.

Our trac install will be kept online for the time being but we won't put new content into it and it won't be updated to show recent commits from github. The same applies for our subversion repository.

What do you think about moving to GitHub? (4 replies)

Thomas Seifert — Mon, 27 Jun 2011 03:02:52 -0500

We are currently considering to move the custom subversion repository and the trac system to the integrated GitHub solution and are doing some test conversions and imports.
That would mean that we would use git instead of subversion and the github issues tracker instead of trac ticketing.

In our opinion it would be easier for others to participate in phorum development and overall easier to handle.

What is your opinion on this move?

Live Streaming of my Phorum talk TODAY (3 replies)

Brian Moon — Fri, 22 Apr 2011 11:24:07 -0500

I have just become aware that I will be live streamed on the internet talking about Phorum at 11:30AM Central US time. You can catch the feed at [openevent.tv] I hope I get to sleep soon.

[SOLVED] Trac / Ticketing authentication issues (1 reply)

Thomas Seifert — Wed, 26 Jan 2011 11:45:05 -0600

In case you tried to report some bug or issue you might have noticed: we currently have authentication issues with the trac system we are using for that.
These will be solved in the next couple of days - we'll keep you updated.

Phorum 5.2.16 released (6 replies)

Maurice Makaay — Mon, 13 Jun 2011 04:11:00 -0500

We are happy to announce the stable release of Phorum 5.2.16.
If you find any bugs in this release, then please report them to us and we will get them fixed as soon as possible.

Notice for admins who use the Embed Images module with the FancyBox viewer:
The only novelty in comparison to the second release candidate (5.2.16-RC2) is that we upgraded the jQuery library to version 1.4.4. If you are using a recent Embed Images module with the FancyBox image viewer, then you will have to upgrade the module to version 1.1.3 or higher to be compatible with jQuery 1.4.4.

If you are upgrading from an earlier version than 5.2.14, then keep the following in mind:

Quote
5.2.14 Announcement
Unfortunately this release also includes 3 template fixes which you might need to port to your custom template if you got them:
[trac.phorum.org] (a fix for the author's profile url in the unapproved messages panel)
[trac.phorum.org] (some fixes for the classic template, only needed you run a template derived from classic)
[trac.phorum.org] (fixes in the group membership panel so that users can actually join groups again)

You can download this new release from our downloads page.

Highlights

A totally rewritten version of the Spam Hurdles module (2.0.2)

One of the big changes is that cryptographic technology is used to store work data right in the form data on the client instead of storing all of it in the database. Because of this, the module can now function without database storage at all. Only if the replay attack block is enabled ("Block forms that are submitted multiple times"), the database will be used to store the id's of the forms that have already been submitted. This database storage has been made as light as possible. After the id expires, it will be cleaned up from the database. We hope that this change will help those admins with busy forums that currently see the spam_hurdles table fill up rapidly in their databases.

Another change is that this new version of the module does support protecting the PM system as well. Note that you might need to update your pm_post.tpl as per changeset 4610 (addition of the tpl_pm_editor_before_textarea template hook).

If you have troubles with this new Spam Hurdles module, then use this thread to report them.

Improvements to the user management in the admin interface

Joe Curia has done some great work on the user management in the admin interface. The search form has been extended with extra options. Changes were done to improve the overall workflow of the user management (e.g. by keeping track of the page from which you come when clicking through to a user detail screen, making it possible to return to that same page and not simply to the first page). It is now possible to change a user's username.

Inclusion of the excellent jQuery javascript library

The jQuery library (version 1.4.4) has been added as a standard javascript library for Phorum. In Phorum 5.3, we will make extensive use of this library as the underlying layer for the Phorum javascript library (you can already see where this is going in the 5.3 development tree). If you want to make use of jQuery code in your Phorum javascript code, then you can access the bundled jQuery library using the $PJ (Phorum Jquery) variable. We do not use the standard $ variable, to prevent running into collisions with possible other js frameworks that might be using $ already.

A wide range of new hooks

Extra hooks in the phorum_output() code to provide extra and more fine grained control to modules that want to hook into the output phase. New hooks: output_templates, output_templates_, start_output_, after_header_, before_footer_, end_output_

Other new hooks (lots of them contributed as patches by Markus Fisher): tpl_profile, tpl_cc_start, event_logging_writelog, admin_menu, admin_forum_delete, posting_action_cancel_post and posting_action_edit_post.

Full Changelog for this release


2011-01-18 20:58 mmakaay

        * Upgraded the jQuery library from 1.4.2 to 1.4.4. 
          Note: when using the Embed Images module with the FancyBox viewer,
          then this module must be upgraded to version 1.1.3 or higher to be
          compatible with the new jQuery library.

2010-11-29 17:08  ts77
	* show the current controlcenter panel also in the breadcrumbs and
	  the page title

   2010-11-16 18:51  mmakaay
	* Load defaults.php file, so an unconfigured username restrictions
	  module will not trigger PHP warnings because of undefined
	  settings.

   2010-11-16 11:58  mmakaay
	* Added an API function phorum_api_user_get_active_user(), which can
	  be used to retrieve the data for the currently active (i.e. logged
	  in) Phorum user. When no user is logged in, then the function will
	  return NULL.

   2010-11-12 07:43  mmakaay
	* When passing $return_threads = TRUE to phorum_db_search() while
	  searching for messages posted by a given user ($match_type =
	  USER_ID), the function will now only return the thread starter
	  messages that were posted by the user that is being searched on.

   2010-11-06 22:57  ts77
	* added bbcode option to add nofollow only to external urls.

   2010-11-02 10:17  ts77
	* added new hook user_save_groups

   2010-10-28 21:14  mmakaay
	* Added overflow: hidden to the generic div, so floated content
	  inside these divs will be correctly wrapped by the div.

   2010-10-28 21:08  mmakaay
	* The Phorum JavaScript library (jQuery + the Phorum javascript
	  code) is now available from within the admin interface as well.
	  Template specific javascript code and javascript code that is
	  supplied by modules are not included in the package that is loaded
	  by the admin interface (to prevent loading code that might be
	  assuming to be run in the Phorum front end.)

   2010-10-26 13:58  mmakaay
	* Added a hook "after_post_redirect" that can be used to tweak the
	  redirect URL that is used for redirecting the user after posting a
	  forum message.

   2010-10-22 09:43  mmakaay
	* Implemented phorum_api_image_supported() and
	  phorum_api_http_get_supported() which can be used to check if the
	  hosting platform supports the respective Phorum API layers.

   2010-10-22 00:35  mmakaay
	* Changes in the BBcode callback handling, to provide callback
	  handlers with the message that is being parsed. This way, the
	  callback code can perform actions that need to be context-aware.
	  Also, deprecated the use of dl() calls in the http_get and image
	  APIs. This is done because of the following warning on the PHP
	  site: "This function has been removed from some SAPI's in PHP 5.3"

   2010-10-16 22:32  mmakaay
	* Modified placement of the #REPLY anchor in the templates (moved
	  from the start of posting.tpl to the end of read.tpl). This takes
	  care of letting the page jump down when the user click "Reply" and
	  the "Sorry, only registered users may post in this forum" message
	  is showing down there.

   2010-10-15 21:20  mmakaay
	* Feeds were not disabled when disabling them from the admin
	  interface settings. They were only hidden from the templates.
	  Therefore calling the feed script to load feed data still worked.
	  This bug is fixed by this release. When disabling the feed option,
	  the feed.php script will block access to the feeds too now.

   2010-10-15 16:09  mmakaay
	* Fixes to improve the Modified-Since handling for javascript and CSS caching.

   2010-10-14 23:56  mmakaay
	* Fixed a problem with CSS and JavaScript caching not automatically refreshing.
          Because the the cache key was not MD5'ed, the cache key could grow too large
          for the memcached caching layer.

   2010-10-11 23:44  mmakaay
	* Added a work-around for the Spam Hurdles ASCII art CAPTCHA in
	  combination with browsers in which the monospace font was set to a
	  proportional font. The font now is configured as Courier New and
	  Courier, before falling back to the monospace option that is
	  controlled by the browser.

   2010-10-11 23:28  mmakaay
	* Release Spam Hurdles version 2.0.2 as the default version for both
	  Phorum 5.2 and the Phorum development trunk.

   2010-07-16 12:02  ts77
	* added attachments as input to the send_email hook (thanks to
	  Oliver Riesen)

   2010-07-04 20:45  ts77
	* invalidate message cache on approval, thanks to Markus Fischer
	  (#961)

   2010-07-04 20:07  ts77
	* applied patches from Joe Curia for enhanced Edit User Panel

   2010-06-30 14:18  ts77
	* formatting and escaping announcements correctly now (closing a
	  possible security issue), thanks to Patrick Kaiser

   2010-06-30 14:00  ts77
	* checking correctly for jpeg support in php 5.3 too, thanks to
	  phorum user nedanko in #948 for the report.

   2010-06-30 13:52  ts77
	* New hooks: admin_forum_delete, posting_action_cancel_post,
	  posting_action_edit_post, thanks to Markus Fischer (closing #949)

   2010-06-30 13:43  ts77
	* added new admin menu hook, thanks for the thorough implementation
	  to Markus Fischer (#945)

   2010-06-30 13:27  ts77
	* User deletion - clearing recent message data, thanks to Markus
	  Fischer (closing #946)

   2010-06-30 13:24  ts77
	* event_logging: hook to intercept $loginfo, thanks to Markus
	  Fischer (closing #947)

   2010-06-30 13:20  ts77
	* Add "message" and "details" filter capability to mod
	  event_logging, thanks to Markus Fischer (closing #942)

   2010-06-30 13:15  ts77
	* phorum_cache_put() verify fopen() call, thanks to Markus Fischer
	  (closing #943)

   2010-06-10 13:16  mmakaay
	* Added the jQuery library to 5.2 and the $PJ compatbility wrapper
	  to prevent collissions with possible other js frameworks that
	  might be using $ already.

   2010-06-10 12:53  mmakaay
	* Fixing editor tools popups in a page that uses relative and/or
	  absolute CSS positioning for layout.

   2010-05-23 21:00  mmakaay
	* Fix for #952: Malformed javascript in form_objects.js.php

   2010-05-20 09:46  ts77
	* fixed timezone setting in forum settings panel. it got off with
	  dst enabled (closing #950, thanks to Phorum user Skye for the
	  notice)

   2010-04-23 22:45  mmakaay
	* Added extra hooks in the phorum_output() code to provide extra and
	  more fine grained control to modules that want to hook into the
	  output phase. New hooks: output_templates,
	  output_templates_, start_output_, after_header_,
	  before_footer_, end_output_.

   2010-04-19 15:20  ts77
	* added two new template hooks: tpl_profile and tpl_cc_start in the
	  relevant templates

   2010-04-16 14:32  mmakaay
	* Added missing language strings to BBcode mod.

   2010-04-01 21:52  mmakaay
	* Fixed some hook documentation issues.

   2010-03-31 13:13  mmakaay
	* Bug fix: do not update the last_post_time of a forum in case a
	  message is approved that was posted before the active
	  last_post_time of that forum.

   2010-03-26 12:55  ts77
	* fixed pm_send_init hook, thanks to Charlie Brown (in #941)

   2010-03-18 12:20  mmakaay
	* Fix for #938: client.js.php steps on javascript Phorum object The
	  way in which existence of the Phorum object was checked was wrong
	  because of some legacy code in the Ajax js lib. This change should
	  fix the issue.

Phorum 5.2.16-RC2 released (8 replies)

Maurice Makaay — Wed, 01 Dec 2010 14:27:33 -0600

We are happy to be announcing our next stable release of Phorum, version 5.2.16 (release candidate 2)
Because some changes have been made that are not trivial, we release this version as a release candidate, before pushing out a final stable version. If you find any bugs in this release, then please report them to us and we will get them fixed as soon as possible.

If you are upgrading from an earlier version than 5.2.14, then keep the following in mind:

Quote
5.2.14 Announcement
Unfortunately this release also includes 3 template fixes which you might need to port to your custom template if you got them:
[trac.phorum.org] (a fix for the author's profile url in the unapproved messages panel)
[trac.phorum.org] (some fixes for the classic template, only needed you run a template derived from classic)
[trac.phorum.org] (fixes in the group membership panel so that users can actually join groups again)

You can download this new release from our downloads page.

Highlights

A totally rewritten version of the Spam Hurdles module (2.0.2)

One of the big changes is that cryptographic technology is used to store work data right in the form data on the client instead of storing all of it in the database. Because of this, the module can now function without database storage at all. Only if the replay attack block is enabled ("Block forms that are submitted multiple times"), the database will be used to store the id's of the forms that have already been submitted. This database storage has been made as light as possible. After the id expires, it will be cleaned up from the database. We hope that this change will help those admins with busy forums that currently see the spam_hurdles table fill up rapidly in their databases.

Another change is that this new version of the module does support protecting the PM system as well. Note that you might need to update your pm_post.tpl as per changeset 4610 (addition of the tpl_pm_editor_before_textarea template hook).

If you have troubles with this new Spam Hurdles module, then use this thread to report them.

Improvements to the user management in the admin interface

Joe Curia has done some great work on the user management in the admin interface. The search form has been extended with extra options. Changes were done to improve the overall workflow of the user management (e.g. by keeping track of the page from which you come when clicking through to a user detail screen, making it possible to return to that same page and not simply to the first page). It is now possible to change a user's username.

Inclusion of the excellent jQuery javascript library

The jQuery library (version 1.4.2) has been added as a standard javascript library for Phorum. In Phorum 5.3, we will make extensive use of this library as the underlying layer for the Phorum javascript library (you can already see where this is going in the 5.3 development tree). If you want to make use of jQuery code in your Phorum javascript code, then you can access the bundled jQuery library using the $PJ (Phorum Jquery) variable. We do not use the standard $ variable, to prevent running into collisions with possible other js frameworks that might be using $ already.

A wide range of new hooks

Extra hooks in the phorum_output() code to provide extra and more fine grained control to modules that want to hook into the output phase. New hooks: output_templates, output_templates_, start_output_, after_header_, before_footer_, end_output_

Other new hooks (lots of them contributed as patches by Markus Fisher): tpl_profile, tpl_cc_start, event_logging_writelog, admin_menu, admin_forum_delete, posting_action_cancel_post and posting_action_edit_post.

Full Changelog for this release

2010-11-29 17:08  ts77
	* show the current controlcenter panel also in the breadcrumbs and
	  the page title

   2010-11-16 18:51  mmakaay
	* Load defaults.php file, so an unconfigured username restrictions
	  module will not trigger PHP warnings because of undefined
	  settings.

   2010-11-16 11:58  mmakaay
	* Added an API function phorum_api_user_get_active_user(), which can
	  be used to retrieve the data for the currently active (i.e. logged
	  in) Phorum user. When no user is logged in, then the function will
	  return NULL.

   2010-11-12 07:43  mmakaay
	* When passing $return_threads = TRUE to phorum_db_search() while
	  searching for messages posted by a given user ($match_type =
	  USER_ID), the function will now only return the thread starter
	  messages that were posted by the user that is being searched on.

   2010-11-06 22:57  ts77
	* added bbcode option to add nofollow only to external urls.

   2010-11-02 10:17  ts77
	* added new hook user_save_groups

   2010-10-28 21:14  mmakaay
	* Added overflow: hidden to the generic div, so floated content
	  inside these divs will be correctly wrapped by the div.

   2010-10-28 21:08  mmakaay
	* The Phorum JavaScript library (jQuery + the Phorum javascript
	  code) is now available from within the admin interface as well.
	  Template specific javascript code and javascript code that is
	  supplied by modules are not included in the package that is loaded
	  by the admin interface (to prevent loading code that might be
	  assuming to be run in the Phorum front end.)

   2010-10-26 13:58  mmakaay
	* Added a hook "after_post_redirect" that can be used to tweak the
	  redirect URL that is used for redirecting the user after posting a
	  forum message.

   2010-10-22 09:43  mmakaay
	* Implemented phorum_api_image_supported() and
	  phorum_api_http_get_supported() which can be used to check if the
	  hosting platform supports the respective Phorum API layers.

   2010-10-22 00:35  mmakaay
	* Changes in the BBcode callback handling, to provide callback
	  handlers with the message that is being parsed. This way, the
	  callback code can perform actions that need to be context-aware.
	  Also, deprecated the use of dl() calls in the http_get and image
	  APIs. This is done because of the following warning on the PHP
	  site: "This function has been removed from some SAPI's in PHP 5.3"

   2010-10-16 22:32  mmakaay
	* Modified placement of the #REPLY anchor in the templates (moved
	  from the start of posting.tpl to the end of read.tpl). This takes
	  care of letting the page jump down when the user click "Reply" and
	  the "Sorry, only registered users may post in this forum" message
	  is showing down there.

   2010-10-15 21:20  mmakaay
	* Feeds were not disabled when disabling them from the admin
	  interface settings. They were only hidden from the templates.
	  Therefore calling the feed script to load feed data still worked.
	  This bug is fixed by this release. When disabling the feed option,
	  the feed.php script will block access to the feeds too now.

   2010-10-15 16:09  mmakaay
	* Fixes to improve the Modified-Since handling for javascript and CSS caching.

Full Changelog for 5.2.16-RC1

 
   2010-10-14 23:56  mmakaay
	* Fixed a problem with CSS and JavaScript caching not automatically refreshing.
          Because the the cache key was not MD5'ed, the cache key could grow too large
          for the memcached caching layer.

   2010-10-11 23:44  mmakaay
	* Added a work-around for the Spam Hurdles ASCII art CAPTCHA in
	  combination with browsers in which the monospace font was set to a
	  proportional font. The font now is configured as Courier New and
	  Courier, before falling back to the monospace option that is
	  controlled by the browser.

   2010-10-11 23:28  mmakaay
	* Release Spam Hurdles version 2.0.2 as the default version for both
	  Phorum 5.2 and the Phorum development trunk.

   2010-07-16 12:02  ts77
	* added attachments as input to the send_email hook (thanks to
	  Oliver Riesen)

   2010-07-04 20:45  ts77
	* invalidate message cache on approval, thanks to Markus Fischer
	  (#961)

   2010-07-04 20:07  ts77
	* applied patches from Joe Curia for enhanced Edit User Panel

   2010-06-30 14:18  ts77
	* formatting and escaping announcements correctly now (closing a
	  possible security issue), thanks to Patrick Kaiser

   2010-06-30 14:00  ts77
	* checking correctly for jpeg support in php 5.3 too, thanks to
	  phorum user nedanko in #948 for the report.

   2010-06-30 13:52  ts77
	* New hooks: admin_forum_delete, posting_action_cancel_post,
	  posting_action_edit_post, thanks to Markus Fischer (closing #949)

   2010-06-30 13:43  ts77
	* added new admin menu hook, thanks for the thorough implementation
	  to Markus Fischer (#945)

   2010-06-30 13:27  ts77
	* User deletion - clearing recent message data, thanks to Markus
	  Fischer (closing #946)

   2010-06-30 13:24  ts77
	* event_logging: hook to intercept $loginfo, thanks to Markus
	  Fischer (closing #947)

   2010-06-30 13:20  ts77
	* Add "message" and "details" filter capability to mod
	  event_logging, thanks to Markus Fischer (closing #942)

   2010-06-30 13:15  ts77
	* phorum_cache_put() verify fopen() call, thanks to Markus Fischer
	  (closing #943)

   2010-06-10 13:16  mmakaay
	* Added the jQuery library to 5.2 and the $PJ compatbility wrapper
	  to prevent collissions with possible other js frameworks that
	  might be using $ already.

   2010-06-10 12:53  mmakaay
	* Fixing editor tools popups in a page that uses relative and/or
	  absolute CSS positioning for layout.

   2010-05-23 21:00  mmakaay
	* Fix for #952: Malformed javascript in form_objects.js.php

   2010-05-20 09:46  ts77
	* fixed timezone setting in forum settings panel. it got off with
	  dst enabled (closing #950, thanks to Phorum user Skye for the
	  notice)

   2010-04-23 22:45  mmakaay
	* Added extra hooks in the phorum_output() code to provide extra and
	  more fine grained control to modules that want to hook into the
	  output phase. New hooks: output_templates,
	  output_templates_, start_output_, after_header_,
	  before_footer_, end_output_.

   2010-04-19 15:20  ts77
	* added two new template hooks: tpl_profile and tpl_cc_start in the
	  relevant templates

   2010-04-16 14:32  mmakaay
	* Added missing language strings to BBcode mod.

   2010-04-01 21:52  mmakaay
	* Fixed some hook documentation issues.

   2010-03-31 13:13  mmakaay
	* Bug fix: do not update the last_post_time of a forum in case a
	  message is approved that was posted before the active
	  last_post_time of that forum.

   2010-03-26 12:55  ts77
	* fixed pm_send_init hook, thanks to Charlie Brown (in #941)

   2010-03-18 12:20  mmakaay
	* Fix for #938: client.js.php steps on javascript Phorum object The
	  way in which existence of the Phorum object was checked was wrong
	  because of some legacy code in the Ajax js lib. This change should
	  fix the issue.

Phorum-5.2.15a released - SECURITY FIXES (no replies)

Thomas Seifert — Wed, 17 Mar 2010 08:13:33 -0500

We are happy to announce our latest stable release Phorum-5.2.15a.
It is a bug fix release over 5.2.14 fixing some issues reported (including patches, thanks folks!) and adds some hooks.
It also has some security fixes for another less important XSS where a user could "attack himself" with adding an invalid email address (thanks to Carlos Ghan for pointing out this issue), see the changelog below for details.

Therefore we urge all Phorum users to upgrade as soon as possible.

If you are upgrading from an earlier version than 5.2.14, keep these information from the 5.2.14 release announcement in mind:

Quote
5.2.14 Announcement
Unfortunately this release also includes 3 template fixes which you might need to port to your custom template if you got them. These are:
[trac.phorum.org] (a fix for the author's profile url in the unapproved messages panel)
[trac.phorum.org] (some fixes for the classic template, only needed you run a template derived from classic)
[trac.phorum.org] (fixes in the group membership panel so that users can actually join groups again)

You can download this new release from our downloads page.

5.2.15a has the following tiny bugfixes over 5.2.15:

   2010-03-26 12:55  ts77
	* fixed pm_send_init hook, thanks to Charlie Brown (in #941)

   2010-03-18 12:20  mmakaay
	* Fix for #938: client.js.php steps on javascript Phorum object The
	  way in which existence of the Phorum object was checked was wrong
	  because of some legacy code in the Ajax js lib. This change should
	  fix the issue.

This is the excerpt from the changelog:


   2010-03-17 12:50  ts77
	* added original message to after_edit / before_edit hooks (fixing
	  #803, thanks to Alexey Torkhov)

   2010-03-17 12:23  ts77
	* added message_id to the read hook (fixing #934, thanks to Markus
	  Fischer)

   2010-03-16 23:16  mmakaay
	* Fixed bug: when changing the password twice in a row from the
	  control center, the second password change triggered the CSRF
	  protection error ("Possible hack attempt detected. The posted form
	  data was rejected.")

   2010-03-16 22:51  mmakaay
	Various fixes for (minor) security related issues.

        * Fixed the possibility of bypassing the email address validation checks and
	  confirmation code via email for email address changes through the
	  control center.
          Risk: the user could change his own email address
	  to some fake address, because the email validation step was
	  skipped. (thanks to Carlos Ghan for pointing out this issue)

        * XSS issue for the email address change panel in the control center
	  fixed. The previous fix already prevents this, because the user
	  can no longer inject a false email address with HTML code in it.
	  The email settings panel prevents that. Still, we added an extra
	  layer of XSS protection to the control center code.
          Risk: the XSS issue was only triggered for the user himself, within his own
	  control center. The email address in the public user profile was
	  already XSS-protected. (thanks to Carlos Ghan for pointing out
	  this issue)
       * Fixed the possibility of bypassing the original
	  password check when changing the password through the control
	  center.
          Risk: this might be used by a malicious user to change the
	  password for a user that is logged into Phorum on a computer that
	  the malicious user has direct access to (e.g. a computer in a
	  library or internet cafe, where the user forgot to logout).

        * Fixed an XSS issue in the personal file management panel in the
	  control center. By uploading a file with a specially crafted
	  filename, HTML code could be injected in the file management page.
	  Risk: the XSS issue was only triggered for the user himself,
	  within his own control center.

   2010-02-26 18:48  ts77
	* fixed warning on logout in rare cases (fixing #920, thanks to
	  Markus Fischer, Regexp provided by Brian)

   2010-02-26 17:20  ts77
	* added setting define for number of search paging links shown (as
	  requested in #932, thanks to Thomas Subera)

   2010-02-22 15:57  ts77
	* use the correct variable in controlcenter/summary.php to allow
	  overriding for module developers. fixing #928, thanks to
	  Azumandias

   2010-02-22 15:52  ts77
	* avoid trying to retrieve users with user_id 0 in read.php with
	  some conditionals, saving on db calls, fixing #929, thanks to
	  Markus Fischer

   2010-02-16 19:22  brian
	* Fix for issue where fast running searches could report a database
	  error

   2010-02-16 16:01  ts77
	* added force_{okmsg|error} to hook_info in control.php to allow
	  overriding the messages without fully overriding the panel. Thanks
	  to Phorum user Phil Connolly for the idea.

   2010-02-12 15:36  ts77
	* added json2.js json parser for decoding json (could be used for
	  encoding too) as requested in #923 for added security and
	  performance (Firefox 3.5 and IE8 should have a native JSON parser
	  which is API compatible with this script and therefore
	  automatically used), added phorum_textarea and phorum_subject
	  manipulation javascript into core (see #914 for the reasoning,
	  thanks to "mrboson")

   2010-02-12 14:16  ts77
	* backported phorum_api_url_no_uri_auth to allow easier generation
	  of URLs without uri-authentication. (patch from Markus Fischer in
	  #921)

   2010-02-12 14:04  ts77
	* added left/right bbcode tags and editor tools

   2010-02-06 12:38  ts77
	* fixing css caching which could lead to mixed up css-caches like
	  including the css_print instead of the full one. (fixing #913)

   2010-02-06 12:32  ts77
	* adding new hook "admin_editforum_form_save_after_defaults" as
	  proposed in #916, thanks to Markus Fischer. ATTENTION: not added
	  in trunk (aka 5.3) as the whole handling has changed there.

   2010-02-06 12:25  ts77
	* added new hook "feed_sent" (fixing #917, thanks to Markus Fischer)

   2010-02-06 12:17  ts77
	* selecting only active users for subscription notifications (fixing
	  #919, thanks to Markus Fischer for the patch)

   2010-01-12 09:34  ts77
	* update the forum status on editing if the sort order of the thread
	  has been changed (fixing #911)

   2009-12-27 11:25  ts77
	* killing some warnings when calling moderation.php without
	  arguments (fixing #905, thanks to Markus Fischer)

   2009-12-09 14:05  ts77
	* added additional "raw_data" flag to phorum_api_user_get for usage
	  in saving to avoid storing html escaped versions of custom profile
	  fields. Thanks to Joe Curia for the report.

   2009-12-09 08:04  mmakaay
	* Fix for correctly blocking posts to closed topics, in case the
	  reply message was started before the topic was closed. Thanks to
	  Phorum user cactux for the problem report.

   2009-12-04 21:10  mmakaay
	* Added a new hook "pm_before_editor" to the PM script, as requested
	  by Phil Connolly.

   2009-11-30 09:13  mmakaay
	* Required changes in templates for Spam Hurdles v2.

   2009-11-30 01:41  mmakaay
	* Some new hooks and a template hook to make protecting the PM
	  interface with Spam Hurdles (version 2) possible.

Phorum-5.2.14 released (no replies)

Thomas Seifert — Sun, 22 Nov 2009 11:36:18 -0600

We are happy to announce our latest stable release Phorum-5.2.14.
It is a bug fix release over 5.2.13 fixing some issues reported (including patches, thanks folks!) and adds some hooks.

As there were again some users having problems while running phorum on PHP4 we made PHP5 a requirement with this version. Effectively that means that users running PHP4 won't be able to install Phorum anymore and the install screen will tell them so.

Unfortunately this release also includes 3 template fixes which you might need to port to your custom template if you got them. These are:
[trac.phorum.org] (a fix for the author's profile url in the unapproved messages panel)
[trac.phorum.org] (some fixes for the classic template, only needed you run a template derived from classic)
[trac.phorum.org] (fixes in the group membership panel so that users can actually join groups again)

You can download this new release from our downloads page.

This is the excerpt from the changelog:

   2009-11-20 08:52  mmakaay
	* Another try at fixing the vroot issue for root level RSS feeds.

   2009-11-18 14:57  ts77
	* fixed vroot feeds

   2009-10-18 10:26  ts77
	* fix profile url of the author in the unapproved message panel
	  (template change, fixing #897)

   2009-10-18 10:13  ts77
	* suppress notices from connect calls, as it would break redirection
	  to a down page and errors itself are handled later in the code
	  (thanks to CBill for noticing that issue)

   2009-10-17 11:02  ts77
	* fixing unsubscribe handling while replying (fixed #884, thanks to
	  Thomas Subera)

   2009-10-17 10:52  ts77
	* added two new admin hooks as provided by Markus Fischer in #895.
	  ATTENTION: no support in 5.3 for these as the handling in
	  newforum.php is totally different there!

   2009-10-17 10:38  ts77
	* rebuild search data only when "empty_search_table" is not set
	  (fixing #883, thanks to Markus Fischer)

   2009-10-17 10:30  ts77
	* using the default template when creating new folders (patch from
	  Markus Fischer in #886, thanks)

   2009-10-16 22:22  ts77
	* added ability to log user deletion to Event Logging through patch
	  from Markus Fischer (fixing #893)

   2009-10-16 22:11  ts77
	* only accepting css templates as arguments for css.php and check
	  for empty param (fixing #887)

   2009-10-14 13:52  ts77
	* turning TYPE=MyISAM into ENGINE=MyISAM to make Phorum compatible
	  with more recent MySQL versions. This effectively makes Phorum
	  incompatible with MySQL4 which is therefore stated in the install
	  docs.

   2009-10-03 12:32  ts77
	* #  fixing group membership panel (adding POST_VARS and fixing html)

   2009-09-29 22:39  mmakaay
	* MFT: # Fix for #891: version parsing problem in the modules API.

   2009-09-29 20:00  mmakaay
	* Added a sanity check to see if the version of PHP is 5.0.0 or
	  higher. When the version is lower, then a critical error is
	  returned. Effectively, people that are running PHP4 won't be able
	  to install Phorum anymore, unless they upgrade to PHP5.

   2009-09-29 06:41  mmakaay
	* Moved the hard-coded max message length to a definition in
	  constants.php.

   2009-09-13 10:20  mmakaay
	* Fixed bug: the recently added anti-XSS code for the font size
	  BBcode did not accept x-large and x-small as valid sizes. Thanks
	  to Robert Angle for the heads up!

Phorum-5.2.13 released (no replies)

Thomas Seifert — Tue, 25 Aug 2009 18:15:00 -0500

We are happy to announce our latest stable release Phorum-5.2.13.
It is a bug fix release over 5.2.12 fixing some issues found, adds some hooks and events to the event logging module.

Some deep change involves the html module:
The bundled HTML module has been deprecated and removed from the distribution. We have done this, because that module was, by nature, very susceptible to cross site scripting (XSS) attack issues. We have been patching that module over time to get rid of reported XSS issues, but recently one was discovered for which we did not see a reliable way to patch it in the existing code base.

Because we do understand that there are admins that already are running the HTML module on their site, we wrote a new HTML module, based on the HTML Purifier library. This library does a great job at "washing" message bodies to make displaying of HTML code safe. Because of the size of this library (and frankly: because we hate HTML enabled messaging ;-) we distribute this new version of the HTML module separately and do no longer bundle it in the Phorum distribution.

To upgrade the HTML module, delete your existing "mods/html" folder from the Phorum tree. After that, install the new HTML module from this thread. Please report any bugs that you might find in the new module to the mentioned thread.

You can download this new release from our downloads page.

This is the excerpt from the changelog:

   2009-08-25 23:03  ts77
	* fixed last-modified header for css.php/javascript.php (closing
	  #881, thanks to Markus Fischer)

   2009-08-25 19:38  mmakaay
	* Make sure that the doomed "magic_quotes_runtime" setting is
	  disabled in PHP. Otherwise, data that is retrieved from the
	  database could be crippled by the magic quote handling.

   2009-08-16 23:33  mmakaay
	* Added a "no longer bundled" list to the Modules API. Modules that
	  are no longer included in the Phorum distro can be registered in
	  this list. If Phorum finds an enabled module that is no longer
	  bundled with Phorum and that has a version that is lower than the
	  version as configured in the list, it will suggest the admin to
	  upgrade the module to the separately distributed version. This
	  feature was added for informing admins about the HTML module that
	  recently was removed from the distro.

   2009-08-16 23:31  mmakaay
	* Removed the HTML module from the core distribution. Administrators
	  that want to enable HTML code in the forum messages will have to
	  download the HTML module from now on. URL:
	  [www.phorum.org]

   2009-08-16 22:27  ts77
	* moved css.php and javascript.php to use the phorum_cache instead
	  of their own file-based approach (closing #878, thanks to Markus
	  Fischer for the notice)

   2009-08-16 15:38  ts77
	* added okmsg for the general settings page, still with reload to
	  reinit the settings (fixing #861, thanks to Markus Fischer)

   2009-08-15 22:22  mmakaay
	* Fixed a bug in the bbcode tokenizer code that could lead to
	  unexpected parsing results.

   2009-08-15 16:50  ts77
	* adding hooks for pm_delete, pm_delete_folder (fixing #871, thanks
	  to Markus Fischer)

   2009-08-15 16:33  ts77
	* fixing some warnings in stress_test script (fixing #872,#873,
	  thanks to Markus Fischer)

   2009-08-15 16:27  ts77
	* added name attribute to module settings links for better
	  testability (fixing #875, thanks to Markus Fischer)

   2009-08-01 11:03  mmakaay
	* Added a new event to the Event Logging module: User sends a
	  private message.

   2009-07-28 10:48  mmakaay
	* Fixed bug #865: Don't log errors if the silence operator @ is
	  used. Thanks to Markus for both the bug report and the patch that
	  fixes the issue.

   2009-07-27 15:42  mmakaay
	* - Added a new logged event: User requests a new password. Thanks
	  to CBiLL for the idea. This feature requires a new hook that is
	  only available in Phorum 5.2.13 and up. - Modified the failed
	  login event: if the username that was used is known to Phorum,
	  then the user_id is set for the event. This way, failed login
	  events can be filtered by the username as long as an existing
	  username was used. Thanks to CBiLL for the idea. - Fixed a bug:
	  with event logging programmatically suspended, not all hooks
	  returned the correct data. This feature is not widely used (if at
	  all), so there is no real user impact.

   2009-07-27 14:24  mmakaay
	* Added a new hook (for logging purposes): password_reset.

   2009-07-27 10:39  mmakaay
	* Fixed #864: the HTML feed always showed "(-1 replies)" at the end
	  of the feed page.

Phorum-5.2.12a released - SECURITY FIX (11 replies)

Thomas Seifert — Sat, 25 Jul 2009 05:27:24 -0500

This release has the regular fixes and improvements and also has a security fix for another obscure XSS with CSS expressions in size and color BBCode tags (thanks to Paolo Pinto for reporting these).

Therefore we urge all Phorum users to upgrade as soon as possible.

As usual you can download this version from our downloads page.

Edit: We did a quick bugfix round after the release, prompting 5.2.12a ...
This is the excerpt from the changelog for 5.2.12a:

   2009-07-22 17:54  ts77
	* fixed event logging download issue (fixing #862, thanks to Markus
	  Fischer)

   2009-07-22 17:44  mmakaay
	* Fixed #858: we now use a more forgiving match algorithm for
	  determining the running MySQL server version.

   2009-07-22 17:21  mmakaay
	* Fixed #863: Prevent a PHP NOTICE in when running a CLI script.
	  Thanks to Markus for the problem report.

This is the excerpt from the changelog for 5.2.12:

   2009-07-22 11:58  ts77
	* added code to have the admin stylesheet external with a hook to
	  override the url (closing #860, though I don't see it as a final
	  solution yet with its relative image urls).

   2009-07-22 11:49  ts77
	* add E_USER_ERROR to error reporting in admin (fixing #859, thanks
	  to Markus Fischer)

   2009-07-20 11:46  ts77
	* Preliminary fix for XSS in size and color bbcode tags. Thanks to
	  Paolo Pinto from SYSDREAM

   2009-07-04 00:38  mmakaay
	* Work-around when there is no "&" in the php.ini
	  arg_separator.input option. It that happens, then PHP won't
	  correctly fill the $_GET array. E.g. "arg1=val1&arg2=val2" will
	  end up as array('arg1' => 'val1&arg2=val2').

   2009-07-03 11:45  mmakaay
	* A fix for hosting providers that manage to provide a SCRIPT_URI
	  that does not contain the actually requested HTTP_HOST, probably
	  due to some mass virtual hosting rewrite rules.

   2009-07-01 10:35  mmakaay
	* Fixed #853: A bbcode tag like [url=http://www.phorum.org \] (note
	  the space in front of the "]" character) caused the bbcode
	  formatting to trip. Thanks to Serdar for the bug report!

   2009-07-01 09:05  mmakaay
	* The event logging module is now used for logging blocked form
	  posts. Also, a bugfix was done on the iscramble code. In some
	  cases, there were duplicate id's in use for the blocks that hold
	  the scrambled js code, causing the js md5 signing feature to fail.

   2009-06-30 14:49  mmakaay
	* Fixed the forum picker list for the advanced search page in a
	  vroot environment. Before this change, the list of searchable
	  forums was empty.

   2009-06-09 06:22  brian
	* Added hook to allow overriding of the maximum upload file size.

   2009-05-29 17:29  mmakaay
	* Fixed a permission checking issue for the file.php script. Read
	  access for the forum in which the file is stored was not correctly
	  checked. Thanks to Phorum user "FF" for finding the bug.

Phorum-5.2.11 Released - SECURITY FIX (no replies)

Thomas Seifert — Fri, 22 May 2009 09:24:25 -0500

This release has the regular improvements for modules with added hooks and parameters, fixes quite a couple of bugs reported and also has protection for the more recent web threats like CSRF and Mime-Sniffing issues.

Therefore we urge all Phorum users to upgrade as soon as possible.

If you see problems with redirection after login to some other page outside of phorum please note this entry:

       * Made allowed redirection URLs for the login a setting in general
	  settings (defaults to localhost and the phorum-url) and fixing
	  with it an "Arbitrary Redirection Vulnerability" reported by
	  Andrew Paterson

You will have to configure the URLs you are redirecting to in the general settings in the admin area.

As usual you can download this version from our downloads page.

This is the excerpt from the changelog:

 
   2009-05-18 23:54  mmakaay
	* Logs can now be downloaded from the even viewer settings page
	  (thanks toe Joe Curia for providing the page). Logs are now
	  automatically cleaned up when the total number of logs exceeds the
	  configured maximum. This is done by mean of a garbage collector
	  that is run in 5% of the page requests.

   2009-05-15 12:21  mmakaay
	* Implemented a check to see if an unsafe attachment is downloaded
	  in MSIE6-. If this is the case, then anti-caching headers are
	  sent. This is done, because a quirck in MSIE6 (and maybe lower)
	  could interpret a file from cache, even if we send headers to
	  specifically force a download.

   2009-05-15 10:02  mmakaay
	* Updated the MIME sniffing code (for checking if a browser might
	  see a certain file as HTML code) to be more specific. This is done
	  to minimize the number of false positives that we see. For example
	  "]" to make it match either "" or
	  "webblaze.cs.berkeley.edu] Thanks to
	  Jacques Copeau for noticing us about this issue.

   2009-04-22 09:12  ts77
	* additional CSRF protection in the admin. Now a new token is
	  generated when accessing the admin without a valid token in the
	  url. This token is timed out after 15 minutes and requires manual
	  click to continue.

   2009-04-21 09:19  mmakaay
	* Fix for #844: avoid the use of addslashes() for SQL escaping in
	  the Spam Hurdles module in favor of phorum_db_interact(), so other
	  database layers can be developed. Thanks to Radium Kolar for
	  noticing.

   2009-04-17 08:53  ts77
	* corrected message after posting in a moderatored forum, removing a
	  warning (fixing #845, thanks to Dready)

   2009-04-14 13:35  mmakaay
	* Fixed #843: No need to have images/* in the distro sanity check as
	  critical files, so I removed them from the file list. Thanks to
	  Mathias for the idea. While I was at it, I updated the distro
	  sanity check script to include new core distribution files in the
	  distro list.

   2009-04-13 23:03  mmakaay
	* Fix for #840: make database "charset" config parameter database
	  layer independant, by putting the check in the db layer sanity
	  check function instead of directly in the database sanity check
	  script. This makes it possible to ignore the charset configuration
	  parameter for database layers that do not require this parameter.

   2009-04-13 10:50  mmakaay
	* Fixed XSS issues from #841. Thanks to cicatriz for reporting them.

   2009-04-13 10:13  mmakaay
	* Fixed #842: make Spam Hurdles module database table name db layer
	  independent.

   2009-03-22 09:58  ts77
	* added support for custom headers to the mail functions and the
	  smtp-mail module, fixed message-id usage in smtp-mail module

   2009-03-20 11:51  mmakaay
	* Some fixes for doc generation.

   2009-03-15 11:13  ts77
	* fixed APC cache-layer (#782, thanks to hcgtv for the report)

   2009-03-14 05:01  brian
	* Added post form confirmation into message deletion process to
	  protect against CSRF attacks

   2009-03-14 01:44  ts77
	* Made allowed redirection URLs for the login a setting in general
	  settings (defaults to localhost and the phorum-url) and fixing
	  with it an "Arbitrary Redirection Vulnerability" reported by
	  Andrew Paterson

   2009-03-13 16:39  mmakaay
	* Implemented a new hook "css_filter" that can be used for
	  post-processing Phorum's CSS code (e.g. compression of the code).

   2009-03-11 01:14  mmakaay
	* Added a layer of protection against CSRF (Cross Site Request
	  Forgery) attacks. Thanks to WHK for notifying us about the
	  possible issues.

   2009-03-11 00:42  mmakaay
	* Fixed a possible XSS issue in the Spam Hurdles module. Thanks to
	  Andrew Paterson for notifying us about the issue.

   2009-03-10 00:03  mmakaay
	* Implemented a new hook "get_template_file", which can be used to
	  influence the phorum_get_template_file() function. The name of the
	  template to load can be updated (e.g. to change "index_new" to
	  "yourmod::index_new") and the template source file to use can be
	  returned (e.g. to tell Phorum that the "pm" template has to be
	  handled by a custom script named
	  "./mods/yourmod/pm_page_handler.php").

   2009-03-06 17:40  brian
	* Fixing XSS issue in control.php

   2009-02-18 17:08  ts77
	* added after_merge / after_split hooks for acting on thread
	  split/merge actions (fixing #828, thanks to so at
	  deluxe-design.at)

   2009-02-18 16:41  ts77
	* moved pm_message array out of the condition to have the data
	  available to the pm_sent hook in any case (fixing #827, thanks to
	  so at deluxe-design.at)

   2009-02-18 16:16  ts77
	* (re-)added storing the user_id for message attachments, fixing
	  #822

Phorum 5.2.11 Release Candidate 1 released! SECURITY FIXES (1 reply)

Thomas Seifert — Fri, 24 Apr 2009 17:12:58 -0500

The first release candidate of Phorum-5.2.11 has been released today.
Its a bugfix release fixing a couple of issues unfortunately also a couple of security related issues, most of them being CSRF (also noted on Secunia).

Even though its a security release there have been A LOT of changes in the core to fix those and therefore we want to have a release candidate first.

As usual this release can be downloaded from our downloads page (development releases).

Please let us know any issues you might encounter with this version so the final release of 5.2.11 can be as bug-free as possible.

This is the excerpt from the changelog:

2009-04-22 09:12  ts77
	* additional CSRF protection in the admin. Now a new token is
	  generated when accessing the admin without a valid token in the
	  url. This token is timed out after 15 minutes and requires manual
	  click to continue.

   2009-04-21 09:19  mmakaay
	* Fix for #844: avoid the use of addslashes() for SQL escaping in
	  the Spam Hurdles module in favor of phorum_db_interact(), so other
	  database layers can be developed. Thanks to Radium Kolar for
	  noticing.

   2009-04-17 08:53  ts77
	* corrected message after posting in a moderatored forum, removing a
	  warning (fixing #845, thanks to Dready)

   2009-04-14 13:35  mmakaay
	* Fixed #843: No need to have images/* in the distro sanity check as
	  critical files, so I removed them from the file list. Thanks to
	  Mathias for the idea. While I was at it, I updated the distro
	  sanity check script to include new core distribution files in the
	  distro list.

   2009-04-13 23:03  mmakaay
	* Fix for #840: make database "charset" config parameter database
	  layer independant, by putting the check in the db layer sanity
	  check function instead of directly in the database sanity check
	  script. This makes it possible to ignore the charset configuration
	  parameter for database layers that do not require this parameter.

   2009-04-13 10:50  mmakaay
	* Fixed XSS issues from #841. Thanks to cicatriz for reporting them.

   2009-04-13 10:13  mmakaay
	* Fixed #842: make Spam Hurdles module database table name db layer
	  independent.

   2009-03-22 09:58  ts77
	* added support for custom headers to the mail functions and the
	  smtp-mail module, fixed message-id usage in smtp-mail module

   2009-03-20 11:51  mmakaay
	* Some fixes for doc generation.

   2009-03-15 11:13  ts77
	* fixed APC cache-layer (#782, thanks to hcgtv for the report)

   2009-03-14 05:01  brian
	* Added post form confirmation into message deletion process to
	  protect against CSRF attacks

   2009-03-14 01:44  ts77
	* Made allowed redirection URLs for the login a setting in general
	  settings (defaults to localhost and the phorum-url) and fixing
	  with it an "Arbitrary Redirection Vulnerability" reported by
	  Andrew Paterson

   2009-03-13 16:39  mmakaay
	* Implemented a new hook "css_filter" that can be used for
	  post-processing Phorum's CSS code (e.g. compression of the code).

   2009-03-11 01:14  mmakaay
	* Added a layer of protection against CSRF (Cross Site Request
	  Forgery) attacks. Thanks to WHK for notifying us about the
	  possible issues.

   2009-03-11 00:42  mmakaay
	* Fixed a possible XSS issue in the Spam Hurdles module. Thanks to
	  Andrew Paterson for notifying us about the issue.

   2009-03-10 00:03  mmakaay
	* Implemented a new hook "get_template_file", which can be used to
	  influence the phorum_get_template_file() function. The name of the
	  template to load can be updated (e.g. to change "index_new" to
	  "yourmod::index_new") and the template source file to use can be
	  returned (e.g. to tell Phorum that the "pm" template has to be
	  handled by a custom script named
	  "./mods/yourmod/pm_page_handler.php").

   2009-03-06 17:40  brian
	* Fixing XSS issue in control.php

   2009-02-18 17:08  ts77
	* added after_merge / after_split hooks for acting on thread
	  split/merge actions (fixing #828, thanks to so at
	  deluxe-design.at)

   2009-02-18 16:41  ts77
	* moved pm_message array out of the condition to have the data
	  available to the pm_sent hook in any case (fixing #827, thanks to
	  so at deluxe-design.at)

   2009-02-18 16:16  ts77
	* (re-)added storing the user_id for message attachments, fixing
	  #822

   2009-02-01 19:30  mmakaay
	* Fix for #892: mb_substr() replacement function contained a typo.
	  No big impact. The replacement function was not yet in use in core
	  code. Only the smtp_mail module calls mb_substr(). Thanks to
	  r.wetzlmayr for reporting the error!

   2009-01-28 19:41  mmakaay
	* Fixed the BBcode parser for some old PHP systems. A problem in PHP
	  caused the parser to not parse any BBcode tags. # The PHP problem
	  was that the "\0" in a string was seen as a filled # character
	  position. E.g. with $a="b", isset($a[1]) would yield TRUE. # This
	  threw of the bbcode parse tree generator.

Phorum 5.2.10 Released - SECURITY FIX (5 replies)

Brian Moon — Tue, 10 Feb 2009 07:25:31 -0600

We are pleased to announce the release of 5.2.10. There was only one issue reported while 5.2.10-RC1. Mark Gordon reported an XSS vulnerability. This has been fixed in 5.2.10. Thank you Mark.

Also, some SQL was retrofitted to work nicer with older MySQL versions.

Other than the above, all other changes were minor bug fixes or inline documentation for hooks.