Downloads: get PunBB 1.3.4 on Downloads page or via Subversion repository.

Today, my feelings on this have changed. I don't feel comfortable taking all the credit for PunBB when I know that the work is much more of a team effort. I also realize that PunBB would benefit greatly from having more than myself, Paul and Bert at the helm. Over the last year, I've noticed how the amount of time and energy I have over to work on PunBB has decreased. I have a regular 9 to 5 day job, I freelance as a web developer and I'm working on a commercial web application (soon to be announced :D). Trying to squeeze in an hour here and there for PunBB just doesn't cut it. Don't get me wrong, I still love working on PunBB and I have every intention of keeping PunBB alive and kicking.

So, where am I going with this. Well, obviously what I'm talking about is inviting more people to work on PunBB in an official manner. We've been keeping this under wraps for a few weeks, but today I am thrilled to present to you the PunBB Development Team (in alphabetical order):

Bert Garcia (hcgtv)
Connor Dunn (Connorhd)
Frank Hagström (Frank H)
Kristoffer Jansson (Jansson)
Neal Poole (Smartys)
Paul Sullivan (Paul)
Rickard Andersson (Rickard)
Shawn Brown (ShawnBrown)

As you can see, the team now consists of 8 people. The reason I wanted ConnorHd, Frank H, Jansson and Smartys on the team should be obvious. These guys know the ins and outs of PunBB better than anyone and they've been active contributors since PunBB's infancy. Some of you might also recognize Shawn Brown. Shawn knows JavaScript and regular expressions better than the rest of us combined. It is possible that in the future, even more people will be invited to join the development team, but I think this will suffice for now :) Please note the word "invited". We will not be accepting requests to join the team. We spot you, not the other way around.

There's more stuff in the pipeline related to this change, but I'll have to get back to you on that in a day or two.

Now, how about a big welcome to the new warriors in the fight against bloat :)

Cheers,
Rickard

Edit: I forgot. If you want to get in contact with any of us, you can either send an e-mail via our profiles or you can send them directly to <firstname>@punbb.org.

This bug is fixed and PunBB 1.2.21 is released. It is recommended that you update your PunBB 1.2.* installation.

Thanks to Smartys for report.

Visit Downloads page for the PunBB 1.2.21 packages and patches. Or get the latest revision from SVN.

• XSS vulnerability via topic subjects in moderate.php is fixed (reported by PHPLizardo).

• Markup issues are fixed, language files are reviewed (thanks to PunBB translators).

• Both outdated and obscure notifications are modified.

Though all known critical bugs of PunBB 1.3 are solved with hotfixes, you can update your forum to 1.3.1.

Downloads: visit Downloads page for the 1.3.1 packages. Or get PunBB 1.3.1 from Subversion repository.

• a lot of bugs fixed (CSS & markup, defects in language files, correct response header placement upon errors, hook rearrangements, parsing posts in feeds, correct language pack detection during the final stage of the install process);

• contains fixes of security flaws (which were fixed by hotfixes in previous versions);

• it is now possible to limit searches to topic subjects or message bodies;

• users are not allowed to change their e-mails without entering their passwords first.

The already existing styles and language packs should be checked for compatibility with the version 1.3.3 before the latter is installed. After checking, the version 1.3.3 may be installed.

How to upgrade:

• make a backup of the database and files;

• turn the Maintenance mode on (via admin panel);

• overwrite old files with new ones;

• after owerwriting, verify that cache, img/avatars and extensions (for pun_repository) directories have enough write permissions (usually 777);

• clear cache directory;

• go to the forum index and run db_update.php script;

• turn the Maintenance mode off.

To developers' notice. Please, check your extensions, styles and language packs for compatibility with the version 1.3.3. The following may be of use to you:

• CSS changes;

• language files changes.

Downloads: get the latest PunBB on Downloads page or via Subversion repository.

• an XSS vulnerability in login.php;

• a possible SQL-injection in the the admin settings page with permission config values;

• a possible SQL-injection in the the admin users page.

As usual, security hotfixes for versions 1.3 and 1.3.1 have been released.

Downloads: get the latest PunBB on Downloads page or via Subversion repository.

PunBB forum automatically checks for extensions updates periodically (optional). Special notifications are displayed in the administrator’s extensions list. In two weeks we are going to release one-click extension installation feature (directly from PunBB repository, without manual extension downloading) via forum administrator dashboard.

Here are short descriptions of the released extensions:

    * pun_hook_navigator — Provides live information about hooks and actually evaluated extension codes (for extension developers).
    * pun_attachment — Enables you to attach files to the posts.
    * pun_bbcode — Pretty buttons for easy BBCode formatting.
    * pun_e_mail_auth — Users can authorize themself by e-mail
    * pun_quote — Select the text you want to quote right in viewtopic (via JS).
    * pun_extension_reinstaller — Do both uninstall and install pointed extension with one click (useful for extension developers).
    * pun_karma — Enables users to rate posts: "+" or "-".
    * pun_topic_online_users — Displays who is reading or replying the topic right now.
    * pun_admin_add_user — Admin can add new user via the form at the bottom of User list.
    * pun_log — Logs PunBB events.
    * pun_poll — Adds polls feature for topics (alpha stage yet).

You are welcome to visit the repository to explore the collection of official PunBB extensions and download the ones you need.

Most of extensions are still in beta stage. Feel free to report bugs or extension request in 1.3 extensions talk.

Current list of extensions in development is published in sticky topic.

EDIT: SVN repository is available to get latest versions of extensions: http://punbb.informer.com/svn/extensions/ . Please remember, that they are not to be used in production environment (same as PunBB 1.3 RC).

The move does however mean that you will have to re-login since the old cookie isn't valid for this domain. Hopefully, this won't cause too much trouble.

PS. Personally, I have been feeling a little under the weather lately. I guess the stress of taking on too much work is finally taking its toll. Hopefully, I will be able to get back in the game soon. Meanwhile, I am told that the work on 1.3 is in its final stages (as in weeks to go). Coinciding with the release will be a bunch of new extensions.

Most significant (for users and moderators) 1.2.20 to 1.3 changes:

    * Extension system based on hooking technique. One click extension installation, no need to modify forum's code anymore.
    * Full UTF-8 support.
    * More customazable styles, templating system.
    * New layout: markup, CSS, language files updated, markup helper functions added.
    * URL rewriting schemes, nice URL's built-in.
    * Split/merge topics functionality.
    * Multiple groups for moderators allowed.
    * Searches are now case-insensitive, extern.php improved, more global, per-group and per-user options added.
    * Certain "bad" characters are silently stripped out from the text input.
    * Got rid of extras folder, README added.
    * Hotifx system based on extension system for quick bugfixes.

Note: language packs and modifications for PunBB 1.2 are useless in 1.3. You are welcome to make a 1.3 translation to your language. Visit language packs page in wiki to take a part.

Downloads: visit Downloads page for the 1.3 packages. Or get PunBB from Subversion repository.

Migration: updating script (from 1.2.*) is included into the package. See wiki article for instructions.

Documentation: use PunBB wiki. There is some lack of information at the moment, but we hope to improve it with your help.

Extensions: you are welcome to download extensions from official PunBB extensions repository.

PS: Please, correct me if I forgot to add something important here.

The XSS via the "p" GET parameter is fixed. Reported by Henry Sudhof.

The proof of concept:

userlist.php?p=2<script>alert('meh');</script>

Clicking the link like this results in the script execution: http://punbb.informer.com/forums/userli … /script%3E
This XSS doesn't work at PunBB Forums anymore as the hotfix has just been released and installed. As usual, PunBB 1.3RC administrators will see an alert (as soon as they log in to the forum) and will be able to install the hotfix with several clicks.

This bug cannot be used directly in PunBB 1.2, but can appear in mods using the page number set by PunBB: check your mods for the correct page number screening.

Visit Downloads page for the PunBB 1.2.20 packages and patches. Or get the latest revision from SVN trunk.

• New layout: markup, CSS, language files updated, markup helper functions added.

• Added split/merge topics functionality.

• Added a "database revision number" to the code. This feature provides a way to track whether the database needs to be updated or not.

• Added constants to various included files to be used to indicate whether a certain file has been loaded or not, removing the need to use include_once/require_once.

• Added global DST option and the default email setting for new users.

• Search (searches are now case-insensitive), extern.php, URL rewriting improved.

• More helpers added to the DB layer and used everywhere in the forum.

• Got rid of extras folder: install and db_update moved to admin; README, COPYING and .htaccess.dist added to the forum root.

• Added phpDoc comments to the start of every PHP file, replacing the existing GPL notice.

• Lot of hooks added.

Download packages:

• PunBB 1.3 RC2 (zip)

• PunBB 1.3 RC2 (7z)

• PunBB 1.3 RC2 (tar/gzip)

You may also check it out from Subversion repository.

UPDATE: PunBB 1.3 RC2 demo is available at http://punbb.informer.com/demo/punbb13rc2/ (DB is automatically restored every 2 hours from the SQL dump).

Please, report bugs in 1.3 core talk forum.

PS: Official extensions may not work correctly now and need to be updated for the new 1.3 RC2 markup.
This will be done in a week or two.

Here are a few notes of interest to all potential beta testers:

1. This is a beta (and not in the Google sense of the word), so don't expect everything to work perfectly. There are bugs. Don't replace your production server install with this just yet.

2. The documentation is a bit lacking at the moment (which in turn is a bit of an understatement :D). An overhauled version of the 1.2 documentation is in the pipeline. Included in this, among other things, is a short manual aimed at extension developers.

3. Speaking of extensions, please dig into and tinker with the extension system. We appreciate any comments, thoughts or ideas you have on the subject. In particular, we are interested in requests for new hooks. We are aware that, even though the code currently contains a great number of hooks, there is need for more.

4. Another area of interest is the greatly improved update script. In PunBB 1.3, we are aiming for full UTF-8 compatibility. In order to accommodate this, the update script now does character set conversion to make sure as much as possible of existing content can be transferred over into valid UTF-8. This process is quite complex and the number of variations of characters sets out there is more or less infinite. Please put the update script through its paces. In order to realize proper UTF-8 support, we had to bump the MySQL requirement to 4.1.2. Hopefully, this shouldn't affect too many of you.

5. As you might have realized, virtually every line of code and markup has been affected by the move to 1.3. What this means is that existing language packs are useless in 1.3. When the time comes for 1.3 final, it would be great to have a few additional languages available for download on the website. We would however appreciate if you could give us a few more days to tidy up some of the language files before you start. The new admin language file in particular, is a mess at the moment.

I think that about covers it for now. Please try to keep all discussions relating to the beta in the new 1.3 Beta talk.

Enjoy!

Edit: I've uploaded a zip file containing some simple example extensions for you to play with. Nothing fancy, but at least, you'll have something to base your own extensions on.

I'm sorry for the rather high frequency of security updates these last few weeks. Hopefully there won't be a need for any more updates to the 1.2 tree for some time now. PunBB is currently undergoing a security audit and this is the reason for the high number of security updates lately.

I would like to thank John Gumbel and Smartys for both reporting the critical vulnerability (just a few hours apart), John Gumbel for reporting the e-mail header injection vuln. and Smartys for reporting the SQL injections in the admin scripts. Thank you both for giving me due time to fix and release 1.2.3.

Admins will see hotfix-alerts on PunBB 1.3 RC installations.
You may install hotfixes visiting Administration / Extensions / Install extensions. If hotfixes do not appear, this may mean that the cache is still not updated: remove /cache/cache_updates.php and refresh the page.
Choose "Install hotfix" for each one. Done!

Please, report issues related to these hotfixes here.