Geschätzte User!
Ãœber die letzten Jahre gab es immer wieder ein paar kleinere Updates bei unserer Board-Software. Ich habe diese Bugfix- und Security-Releases mal wieder ein einem Rutsch installiert... auch wenn das Forum wohl eher nicht mehr aktiv in Gebrauch ist
.
Das Changelog zum Update:
SMF 2.0.18 February 01, 2021
===============================================================================
January 2021
-------------------------------------------------------------------------------
! Set default serialize handler to php_serialize
! Handle false responses from getimagesize better
! Fix tar package type isn't always numeric
! Fix SSI poll errors where vars weren't set before usage
! Fix custom profile field placement options when vars weren't set before usage
! Fix poll errors when variables where explicitly used
! Required parameter follows optional parameter
! Eliminate currying function and simplify code
! Double quotes needed to evaluate for HTML tags
September 2020
-------------------------------------------------------------------------------
- Set utf8 as default going forward
! $base_files should include proxy.php and subscriptions.php
! Fixes bugs with multi-version jumps (via CLI) where settings weren't refreshed
! Honor error suppression in custom error handler
! Documentation updates. Link fixes, https, rel="noopener"
! Data fix for missing id_member on policy acceptance
August 2020
-------------------------------------------------------------------------------
! Fix missing info affecting logging for new registrations
! Manually lock cache files before reading them
April 2020
-------------------------------------------------------------------------------
! Only flag menu entry as active if it exists
March 2020
-------------------------------------------------------------------------------
! Fix Cannot use string offset as an array
February 2020
-------------------------------------------------------------------------------
! Always include email address when downloading user's own profile data
- Remove link to afrinic
! Allows user to download own profile data even if RSS is disabled
January 2020
-------------------------------------------------------------------------------
+ PHP 7.4 compatibility
! Don't call functions that have been deprecated in PHP 7.4
! Sends the correct unsubscribe token in announcements
! Checks if dl() exists before calling it
! Brought the UTF16-to-UTF8 logic over from 2.1
! Fix errors from proxy cache cleanup
December 2019
-------------------------------------------------------------------------------
! Fixes a typo in the installer (`$_port` -> `$db_port`)
! Uses correct variable for the requirePolicyAgreement checkbox's value
! Simplifies logic for $cookie_no_auth_secret handling
November 2019
-------------------------------------------------------------------------------
! Fix theme detection for packages on windows
September 2019
-------------------------------------------------------------------------------
! Avoids truncating Settings.php until after we have a lock on the file
! Tighten up security checks, bring in sync with 2.1
SMF 2.0.17 December 29, 2019
===============================================================================
December 2019
-------------------------------------------------------------------------------
! Fixes a bug that could cause an infinite loop in News.php
! Suppresses deprecated function warnings in SSI.php
! Removes deprecated each() function
! Allows package manager to retrieve packages via HTTPS
SMF 2.0.16 December 24, 2019
===============================================================================
December 2019
-------------------------------------------------------------------------------
& Changes "Terms and Rules" to "Terms and Policies" to indicate that this will show the privacy policy.
+ Installer now randomizes its initial suggestions for database name and table prefix.
+ Replaces GDPR image with one that we definitely know is in the public domain.
November 2019
-------------------------------------------------------------------------------
! Revert the fix to search highlighting [topic 550840]
! Fixes missing index error when accepting the registration agreement and/or privacy policy.
October 2019
-------------------------------------------------------------------------------
! Updated credits.
September 2019
-------------------------------------------------------------------------------
! Generates $auth_secret during install, so that the admin can log in immediately.
&& Improves UI for viewing/accepting changes to registration agreement & privacy policy.
&& Improves UI for editing registration agreement & privacy policy.
August 2019
-------------------------------------------------------------------------------
! Correctly decides whether to search using a regex when using full text search.
! Prevents errors converting HTML entities to 4-byte characters during database maintenance.
* Removes old 1.1 themes during upgrade.
! Implements a number of fixes for the installer and upgrader.
July 2019
-------------------------------------------------------------------------------
! Removes deprecated ALTER IGNORE statements from upgrade SQL.
! Ensures check_mime_type() is defined before calling it in profileSaveAvatarData().
! Fixes a bug with regex searching in SQLite.
! Removes redundant count() in Poll.php and changes explode for implode.
June 2019
-------------------------------------------------------------------------------
! Uses hash_hmac to generate much more secure hashes for the image proxy.
& Adds `rel="noopener noreferrer"` to links for user supplied URLs. (Reported by Travis Knapp-Prasek)
! Increases cookie security by hashing with a secret authentication key. (Reported by Logan Whitmire)
+ Requires admin password to add/remove admins via group moderation. (Reported by Logan Whitmire)
! Checks MIME type of user-supplied avatar images more thoroughly. (Reported by Logan Whitmire)
+ Adds $force parameter to validateSession()
May 2019
-------------------------------------------------------------------------------
+ Improves functionality and security of token-based unsubscribe system.
+ Adds token-based unsubscribe links to newsletters.
&& Simplifies language strings and templates for unsubscribe links.
! Shows an error message if trying to unsubscribe an invalid member id.
+ Prevents sending newletters to arbitrary email addresses in GDPR mode.
March 2019
-------------------------------------------------------------------------------
! Fixed create_function for the installer, warn for SQLite deprecation.
Feburary 2019
-------------------------------------------------------------------------------
! Limit PM rules and how many times they can be applied in a time period.
December 2018
-------------------------------------------------------------------------------
! Don't proxy images for bots
! Cleanup old proxied images as part of daily maintenance
! Only set the old url whenever stats are being logged [topic 459730]
! Fix search highlighting to not mangle/expose some HTML [topic 550840]
! The code to check for too many PM labels was wrong [topic 559166]
! $db_persist needed to be defined as a global in the MySQLi driver [topic 552581]
! $smcFunc['db_error'] shouldn't require a database object as a parameter
+ Add X-Frame-Options to both the installer and the upgrader
November 2018
-------------------------------------------------------------------------------
+ Add registration agreement section where users can view and agree to the document, complete with logging
! Ensure that count() is called on valid objects when using PM labels in PHP 7.2
+ Try to inject session tokens into any login form that doesn't already have one (may not work in SSI!)
+ Implement privacy policy stuff for GDPR
+ Add link in footer to agreement and privacy policy
! In XML profile export, explicitly state the language even when the member uses the forum default
! In installer and upgrader, get resource files from simplemachines.org via HTTPS
! Avoid generating errors for non-numeric start values when getting recent posts
October 2018
-------------------------------------------------------------------------------
! Add ability to force the browser to download XML feed data as a file (good for GDPR support)
+ Add a link in profile actions menu to export profile info.
+ Make cdata_parse() smarter and less aggressive
+ Add "Allow the administrators to send me important news by email" checkbox to registration form
! Invalidate opcode after writing Settings.php (other/install.php)
June 2018
-------------------------------------------------------------------------------
! Use openssl_random_pseudo_bytes (if available) to generate the token_secret for unsubscribe links
& Fix a minor grammatical error and adds documentation comment to the email template
! Underline the link to the GDPR official info page
! Don't offer the Override Notification Settings option when composing a newsletter if force_gdpr is turned on
+ Implement GDPR compliance regarding unsubscribe links and options for email notifications
+ Add a GDPR compliance toggle to Core Features.
February 2018
-------------------------------------------------------------------------------
! Core theme missing login hash [topic 558445]
! template_kick_guest() missing login hash
! Wireless missing login hash [topic 557843]
! Fix code selection in modern browsers (Firefox, Chrome) [topic 553445]
! Message previews ate emoji on UTF forums [topic 558414]
@ Improve logging of exceptions
January 2018
-------------------------------------------------------------------------------
! Don't load the MySQLi driver if on PHP 5.3
! Fix bitmask for error reporting
! Type mismatch [topics 554723, 556672, 558542]
! Undefined index errors if checking permissions too early [topic 558349]
! matchPackageVersion() did not extract the beta number correctly [topic 557810]
! Must clear the opcode cache on Settings.php when modifying it from within the admin area [topic 560180]
! Board theme should not be overridden by user theme [topic 558121]
! sendmail() should send the current server's name [topic 552893]
! smf_categories lost ordering on InnoDB tables in MySQL [topic 552922]
@ Silence deprecation notices because we use deprecated functions everywhere
! Remove leftover code while porting from 2.1 [topic 555723]
! Several fixes for the proxy
SMF 2.0.15 November 19, 2017
===============================================================================
September 2017
-------------------------------------------------------------------------------
! Fixed a minor $smcFunc bug in Search-Fulltext.php
! Fixed a saving Settings.php bools being reset bug
! Fixed a security issue (Reported by Daniel Le Gall from SCRT SA)
June 2017
-------------------------------------------------------------------------------
! Cache the admin search results in the session and avoid IE's 2083 character limit
! Fixed a Mark Board Read bug
May 2017
-------------------------------------------------------------------------------
! Fixed Proxy URLs not handling redirects properly due to case sensitivity
! Fixed SendTopic using incorrect Post data
! Fixed SSI.php having a bad login panel
! Fixed Maintenance Page having a double login button
! Fixed a minor unsigned int typo in MySQL DB
! Fixed Deprecated installer message for ftp_connection.
! Fixed a loop bug in custom search
! Fixed SM Stat collection
! Added SM Stat collection registration to the Admin Control Panel
SMF 2.0.14 May 14, 2017
===============================================================================
! Updating session handlers
! Adding HTTPS
! fetch_web_data now uses cURL, falling back to sockets
! Ported image proxy support from SMF 2.1
! Also added HTTPS for avatars
! Added a simple exception handler
! Check session while logging in
! Sanitize some fields to help guard against XSS
! Validate email addresses with PHP’s filter method
! Fix password acceptance when special characters were used in UTF-8;
! Correct some random logic errors in the profile area
! Use ampersands instead of semi-colons for PayPal’s return link
! Fix sending multiple MIME-Version headers in notification mail
! Fix sending multiple Content-Type headers in all requests
SMF 2.0.13 January 4, 2017
===============================================================================
! Some file versions didn't get modified in the 2.0.12 patch
! Added check and sanitization for $_REQUEST['u'] in LogInOut.php and Reminder.php
! Added check and sanitization for $_REQUEST['uid'] in Reminder.php
! Properly sanitize author's website for packages
! Added session check when uploading packages
! Added session check when copying template files from one theme to another
! The code to remove empty BBCode was sometimes breaking things (reported by @rjen; fix provided by Sesquipedalian)
! Remove hardcoded limits for safe_unserialize as it was causing cache problems
! Update the cal_max_year setting to 2030
SMF 2.0.12 July 7, 2016
===============================================================================
! Fixed word censor injection by disallowing an empty 'proper word'
! Fixed vulnerable unserialize() code by converting all instances to safe_unserialize()
! Added a more thorough safe_unserialize() function to prevent object injection
! Fixed a bug where leaving a custom profile field blank on registration that has an email mask would throw an error
! Fixed PayPal integration to comply with the new forced SSL
! Fixed a bug where notifications were sent for messages in inaccessible boards
! Fixed editor to make the editor work with Microsoft Edge
! Fixed issue where smiley popup is blank on iOS 9 devices
! Fixed WYSIWYG editor in mobile devices
! Fixed an undefined $_POST['icon'] in Sources/Post.php
! Fixed a minor bug in Login2()
! Fixed an issue where SMF doesn't recognize new domain names and considers these as invalid
! Fixed an issue where SMF would allow empty BBC
! Fixed an issue where theme variants could not be selected
! Fixed an issue where the file version of Subs-Post.php could have been 2.0.8 or 2.0.11. It will be updated to 2.0.12 in either case.
! Updated copyright year to 2016
Thema: Update Board-Software von SMF 2.0.11 auf SMF 2.0.18 (Gelesen 1980 mal)