MyBB Blog

MyBB 1.4.8 is now available on the MyBB website and is a general maintenance and security release.

This release fixes several reported issues with version released since 1.4.6 causing some incorrect functionality of MyBB. These bugs have been fixed to provide a more stable version of MyBB for public use.

What’s added/changed in this version?

• One Low XSS Vulnerability fixed in the Archive - This is tagged as low because it requires moderator permissions. This vulnerability was discovered and reported by frostschutz.
• One Medium XSS vulnerabilities fixed in Attachments - This vulnerability was reported by frostschutz.
  Please note that this patch will remove the ability to open some types of attachments directly in your browser (e.g. QuickTime Movies), and will instead ask you to download them.
• … Several other bug fixes

This release has been tested by our Software Quality Assurance group.

MyBB 1.4.7 to MyBB 1.4.8 Patch

This patch is only for users running MyBB 1.4.7. If you are running any other version of the MyBB 1.4 series then please download MyBB 1.4.8 from the MyBB site and update to it.

If you wish to manually patch your board please download “mybb_1407_patches.txt” and follow the instructions in that file.

mybb_1407_patches.txt

The manual patch set instructions only fixes the security vulnerabilities and is only made available to temporarily secure your forum until you have time to run the complete upgrade.

Information on upgrading, template changes and language changes can be found in the posts below.

Please note, that you need to run the upgrade script for this version.
This is so the templates may be updated.
There are no database schema changes in this version.

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

MyBB 1.2.14 Patch

Users running MyBB 1.2.14 or any previous release of the MyBB 1.2 series may use the same manual instructions provided in the “mybb_1407_patches.txt” attachment (excluding the version change).

Upgrading from the 1.4 series

When upgrading from 1.4.7, you will not lose any custom themes, plugins or language packs which you may have installed.

Follow the general [Wiki: Upgrading] guide outlined on the MyBB Wiki to complete the upgrade process. You may download a ZIP archive of changed files here:

changed_files_1408.zip

You must then check for modified templates using the instructions below.

Upgrading from other versions

If you are upgrading from a version earlier than 1.2 then you will lose your custom themes, templates and language packs due to the number of changes between your version and the 1.2 series.

Before you attempt to upgrade, ensure you have a database backup and a copy of the files currently in use on your board. This is so you can revert back to your earlier version if you need to or something goes horribly wrong with the upgrade process.

Follow the general [Wiki: Upgrading] guide outlined on the MyBB Wiki to complete the upgrade process.

Changed files since MyBB 1.4.6

• announcements.php
• attachment.php
• forumdisplay.php
• global.php
• member.php
• report.php
• search.php
• sendthread.php
• showthread.php
• syndication.php
• xmlhttp.php
• install/
  • resources/
    • mybb_theme.xml
• archive/
  • index.php
• admin/
  • inc/
    • functions_view_manager.php
  • modules/
    • forum/
      • management.php
    • style/
      • templates.php
    • tools/
      • adminlog.php
    • config/
      • plugins.php
      • spiders.php
    • user/
      • admin_permissions.php
      • users.php
• inc/
  • class_core.php
  • class_language.php
  • class_moderation.php
  • functions.php
  • functions_search.php
  • plugins/
    • akismet.php
  • cachehandlers/
    • memcache.php
  • languages/
    • english.php
    • english/
      • global.lang.php
      • admin/
        • config_spiders.lang.php
  • datahandlers/
    • pm.php
    • post.php
    • user.php

* Red represents files that contain security updates
* Green represents new files added in this release

Bugs fixed since MyBB 1.4.6

• #51407 - change permission for admin user
• #51377 - Plugins with Admin CP Hooks run on Plugin Updates page
• #51257 - Syndication.php MySQL Error (Limit Option) [R] [C-StefanT]
• #51177 - [Archive] sticky lack htmlspecialchars_uni() escaping [C-StefanT]
• #51054 - Archive - SQL bug fetching attachments/posts with abandoned thread [C-StefanT]
• #50833 - Birthday without day [C-StefanT]
• #50441 - Search Bug w/ “and” [R] [C-StefanT]
• #50324 - Missing space character [R] [C-Michael S.]
• #50323 - Missing </tr> in Template modcp_ipsearch_result [R] [C-Michael S.]
• #50291 - Validation Issue [C-Chris W B.]
• #50287 - Akismet plugin username link problem [C-StefanT]
• #50240 - Ability to delete templates [C-Chris W B.]
• #49888 - [typo] memcache.php [C-StefanT]
• #49838 - [pgsql] Reporting posts in unmoderated forums [C-StefanT]
• #49461 - [typo] inc/cachehandlers/memcache.php [C-StefanT]
• #49898 - Template problem with announcements and no threads [C-StefanT]
• #49276 - canviewthreads error problem [C-StefanT]
• #49258 - Notification about new reported posts via PM [C-StefanT]
• #49256 - Notification about new PM from MyBB Engine [R] [C-StefanT]
• #49255 - [pgsql] Report posts [C-StefanT]
• #49251 - [Typo] class_moderation.php (1.4.?) [R] [C-StefanT]
• #49111 - Percent of total posts [R] [C-StefanT]
• #48814 - config_spiders.lang.php overrides $lang->language [C-sayakb]
• #48773 - Usergroup email limit off by one error [C-sayakb]
• #48771 - Merged Account Reputation Issue
• #48692 - announcement in password protected forum [C-sayakb]
• #48670 - Find user posts - not displaying new posts (when hitting limit) [R]
• #48668 - Displaying search results as posts for moderators [R] [C-StefanT]
• #48603 - Bug? Admins cannot see user list
• #48601 - [pgsql] SQL error if threads are moderated [C-StefanT]
• #47745 - editpost.php issue with closed forums [R]

Theme and template changes

Using the “Find Updated” link under the “Templates” page in the Admin CP you can find a list of the templates that have changed in this release that you’ve got one or more custom copies of.

After identifying changed templates using the tool you can either revert your custom template to the default (delete it) or use the “diff” tool to perform a difference analysis on your custom template and the default.

“Revert required” indicates that for this template to work correctly with MyBB 1.4.8 you’ll either need to revert it to the default or modify your custom template to include the changes in the default. If a revert is not required your custom version of the template should work perfectly fine.

Template changes

Since MyBB 1.4.6 the following templates have had changes to them:

• modcp_ipsearch_result
• forumdisplay_announcements_announcement

* Red represents the template must be updated or reverted to fix security problems

Language file changes

Since MyBB 1.4.6 the following language files have had changes to them:

• global.lang.php
• admin/
  • config_spiders.lang.php

Either update your language packs to include the changes in these files or revert to the standard English language pack.

Plugins

Most of your MyBB 1.4.x plugins will work correctly with 1.4 without any updates.

MyBB 1.4.7 is a security update to the MyBB 1.4 series. It fixes 1 high risk security vulnerability. We recommend everybody upgrades to this release immediately or patch their boards with the manual patching instructions below.

This vulnerability affects MyBB 1.4.6. MyBB 1.2 is not affected.

Thank you to Jesse Labrocca for alerting us of this vulnerability.

MyBB 1.4.6 to MyBB 1.4.7 Patch

This patch is only for users running MyBB 1.4.6. If you are running an older version of MyBB then please download MyBB 1.4.7 from the MyBB site and update to it.

Please download the attached ZIP archive and replace the files in your forum directory with those from the ZIP archive.

changed_files_1407.zip

If you wish to manually patch your board please download “mybb_1406_patches.txt” and follow the instructions in that file.

mybb_1406_patches.txt

Please Note: You do not have to run the upgrade script for this release.

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

MyBB 1.2.14 Patch

MyBB 1.2 is not affected.

Please note all users of the 1.2.x series are urged to upgrade to the latest release of MyBB. (1.4.7) MyBB 1.2 is no longer being supported, though security updates for the MyBB 1.2 series will last through December 2009.

Greetings all. Today we’ve got a little update on the MyBB staff.

Returning and new staff members

Firstly, we welcome back nickman. nickman was with us previously on the development team and has now offered to rejoin us on the SQA team. When he was on the developers’ team he worked mainly on bug fixes, and SQA is all about bug fixes and offering possible fixes. Please make him feel welcome again.

Please also welcome Joshua Mayer. Joshua is very active and has been a great help to members who request various forms of support.

Staff member leaves

Today we say goodbye to Sergio Montoya who has been a developer with us for the past year. He leaves us to focus more on his personal and real life. We hope you join us in wishing him the best of luck in his future.  Sayakb has been moved to the development team to fill Sergio’s place.

MyBB 1.4.6 is a security update to the MyBB 1.4 series. It fixes 1 medium risk and 1 low risk security vulnerability. We recommend everybody upgrades to this release immediately or patch their boards with the manual patching instructions below.

These vulnerabilities affect MyBB 1.4.5. Older versions of MyBB may also be affected. Please see below for upgrade instructions for 1.2.14.

Thank you to Jacques Copeau for finding and reporting these vulnerabilities.

MyBB 1.4.5 to MyBB 1.4.6 Patch

This patch is only for users running MyBB 1.4.5. If you are running an older version of MyBB then please download MyBB 1.4.6 from the MyBB site and update to it.

Please download the attached ZIP archive and replace the files in your forum directory with those from the ZIP archive.

changed_files_1406.zip

If you wish to manually patch your board please download “mybb_1405_patches.txt” and follow the instructions in that file.

mybb_1405_patches.txt

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

MyBB 1.2.14 Patch

This patch is only for users running MyBB 1.2.14 or any previous release of the MyBB 1.2 series.

Please download “mybb_1214_patches.txt” attached to this post and follow the manual patching instructions.

Please note all users of the 1.2.x series are urged to upgrade to the latest release of MyBB. (1.4.6)

mybb_1214_patches.txt

We’ve been reasonably quiet between the release of MyBB 1.4.4 and 1.4.5, but that doesn’t mean that nothing has been going on behind the scenes. This blog post aims to outline some of what has been going on at MyBB during the last couple of months.

Over the past few weeks you may have noticed a few changes with our current staff, whether it was removal of staff or a change of position. Some changes may not even be noticeable by you but I’ll outline them all anyway.

• Chris Boulton
  Due to time restraints placed on Chris by work, Chris was finding it difficult to find a balance between work and play whilst including MyBB and therefore has shifted some of the lower priority, day-to-date responsibilities of product management to Dennis Tsang. To be clear, Chris will still be involved in the MyBB project and will be overseeing the project from an executive aspect.
• Dennis Tsang
  Dennis will be taking on more of the the day-to-day operations and administrative tasks that Chris Boulton used to do.
• destroyer (Kevin Camps)
  Kevin will take on some content management duties, this includes the MyBB website, MyBB Wiki, etc. Kevin will also be partly responsible for approving themes, plugins and resources to the Mods section of the MyBB site and help out coordinating the translations with Tochjo.
• Ryan Loos
  Ryan has made the move from a Support Team member to a Public Relations Liaison. With this new title, Ryan will be responsible for resolving community issues, updating the blog, making Twitter updates from the MyBB Twitter account, seeking new talent to take up positions on the team, in future betas and in the Mentor group and educating other communities on MyBB if their views are a little off.
• Justin S.
  Justin is now in the developers’ group although he will still maintain the Wiki and continue his design work. He was always a design developer on the team, so the title change just reflects his correct role, although he will be performing all of the same duties as he did before.
• Tomm M
  Tom’s moved into a developer’s position from his old role as a Support Team member. He’s shown a good understanding of how MyBB’s insides work during his time on the team and has already taken on a good portion of development for MyBB 1.6.
• Max Marze
  Max too has become a developer and will be working towards getting the new version of the MyBB Merge System out. Specifically, he will help by writing unit testing scripts to ensure that the Merge System, when released in the future, will not have as many problems as in previous releases.
• MattRogowski
  Matt, though still a part of the Support Team, will also be partly responsible for approving themes, plugins and resources to the Mods section of the MyBB site.
• sayakb
  Sayak has offered to come on board as an SQA Team member. He’s shown a strong knowledge of MyBB by developing plugins, which can be found at the KDE forums, and testing new MyBB releases for compatibility with the KDE forums.
• LegosJedi
  We’re saying goodbye to LegosJedi who has left us due to time constraints. We wish LegosJedi best of luck on his future endeavors.
• Tom Loveric
  Tom has also decided to head his own direction with a custom CMS he is building. We wish him the best of luck in his future and with his CMS.

Recruiting New Support Staff

We’re always looking out for new potential. If you want to be on the MyBB Team, you just have to show:

• You are dedicated and active to the project
• You speak English very well and have good communication skills
• You have good knowledge of how MyBB works and in the position you want to take up

If you don’t feel like we’re noticing you it’s probably just because we’re too busy making the next version of MyBB! So just send us an email via our contact form with “Available Team Member Position” as the subject. Include your forum username. Remember though, your chances are considerably increased if you stand out with the three suggestions listed above.

SQA Team Updates

You might have also noticed the creation of the SQA Team (Software Quality Assurance) right after the release of 1.4.4 due to the amount of problems that were reported after its release. SQA has been able to confirm 95% of fixes are working and don’t cause any regressions that are written by our developers and put into our code base. Among those that they confirmed, SQA was able to find and report dozens of regressions over the course of the entire MyBB 1.4.5 development in over 100 bugs, optimizations, and tweaks. As such, SQA has been a huge success for the MyBB Group and in turn creates much more stable releases for you. We are continuing to perfect the new SQA Team and implement processes that will eliminate preventable issues from the get-go.

Team Interviews

If you’ve ever wanted to know more about the MyBB Group or a particular staff member, now is the chance!  We’ve started a thread where you can post questions for staff members to answer at a later date in a blog post. If you have any questions for specific staff members or groups of staff then head over to the thread and post your questions!

Discontinuation of support for 1.2 series

MyBB 1.4 has been out for over 8 months. During this time we have had a security audit done and we believe that the 1.4 series is the safest yet. So upgrading should not worry you one bit.
When we first released 1.4 we only planned to continue support for 6 months but continued support due to the sizeable amount of people that still used the 1.2 series.

Support for the 1.2 series will end on June 1st, 2009 - making it 9 months of support after the release of the 1.4 series.
For those of you who are still operating boards with 1.2 we urge you to upgrade to the latest 1.4 release and seek help if needed before June 1st.

Some links that may be of use to you:
http://www.mybboard.net/downloads - To obtain the latest MyBB release
[Wiki: Database_Backup] - Always important if something goes wrong. Also be sure to backup all your files.
[Wiki: Upgrading] - Standard upgrading procedure details.

After June 1st, 2009, the 1.2 support forums will be moved to the read-only archive.

It is important to note that we will still provide vulnerability patches for the 1.2 series until December 31st, 2009.

For those who use Twitter, the “social networking site without a business model”, you can follow @mybbgroup for quick access to all of the latest on MyBB.

For those who don’t use Twitter, the concept is you have 140 characters to post status updates/messages. You can follow other users for easy access to their updates, and have people follow you.

We’ll be using Twitter to:

• Post updates to MyBB and what we’re working on
• Notify you of updates to the MyBB Blog and new threads posted in the MyBB Announcements forum
• Point out interesting plugins, themes, tips and tricks that help you benefit more from MyBB
• Exclusively grab feedback on new things, especially regarding the development of MyBB 2.0
• Reach out to potential users who have questions regarding MyBB, and help out those who are having diffuclties

If you don’t already have a Twitter account, why not sign up for one today? It takes less than 5 minutes and is a fabulous social networking tool.

(Shameless plug - you can also find me on Twitter: @surfichris)

Greetings to all,

As we continue to try and reach out to the community with more information on our progress, development, et cetera, this blog post is here to inform you on our current plans for MyBB 1.4, MyBB 1.6, and MyBB 2.0. We are not going to be giving in-depth information away on MyBB 1.6 or 2.0 until they near completion but I would like to draw a general outline and sum up some information that has been spread across the internet.

MyBB 1.4.5

Work is currently going to completing MyBB 1.4.5. It will contain over 100 various fixes, and include performance and stability improvements among other things. We want to put MyBB 1.4.5 through a 2-week beta testing phase before we release it to the general public. This is done in order to ensure we minimize any regressions from changes that have been made to the code since MyBB 1.4.4 and so you can have a smooth transition upgrading from MyBB 1.4.4 to MyBB 1.4.5.

MyBB 1.6

We are steadily and diligently working on development for MyBB 1.6. There have been 17 features/improvements officially “completed” and are in the process of Quality Analysis. We have several more near completion. You won’t be seeing any huge changes in MyBB 1.6 and we have taken steps to ensure that when MyBB 1.6 is officially released it will be a stable release. This is done so we can keep the impact on theme creators and plugin and mod authors down to a minimal level. This will lead to a smooth transition between MyBB 1.4 and MyBB 1.6 and I’m looking towards at least 60% of all plugins should still work with MyBB 1.6 with minimal changes (essentially just the “compatibility” indicator updated for most).

MyBB 2.0

We have been brainstorming, sharing ideas, sharing mockups, etc for the past few months. We will probably be brainstorming and trying new ideas for MyBB 2.0 for the most part all the way up to the general testing of MyBB 1.6 and then we will shift gears to MyBB 2.0.

We hope everyone enjoys this small update on our development and future plans. We will continue to space out these updates during our normal development cycles to keep you informed on the going-ons of MyBB.

Hi,

My name is Ryan Gordon and I am the lead developer of MyBB and the MyBB Merge System. This blog post is here to inform the community members on some of the caveats and successes of the MyBB Merge System.

Let me first introduce a bit of history on the MyBB Merge System. It has been in development for quite a while - before MyBB 1.2’s release - and it hasn’t officially reached a “stable” tag in its development. The MyBB Merge System is quite a revolutionary product in terms of the abilities it provides to those who use it. Many people don’t realize the full potential or mistakenly think that the MyBB Merge System is used to virtually “link” two forums together, when in fact the Merge System actually takes data from any supported forum software and combines it with your current forum. This is where things start to get interesting.

So let’s get straight to the point- Because of the unique nature of the Merge System, design and development is a grueling process. We have been able to work through most of the problems but several issues have plagued us over the course of its development:

• Testing - It is a long enduring process to replicate a bug report, that may not have been caused by the Merge System in the first place. This is compounded by the fact we are also testing with different forum systems with which we are not familiar.
• Complexity - The actual process of converting data from one forum to another is very easy, which is why most forum software choose to go down that path. However, the process of being able to merge two existing forums into one is a much more complex process. In terms of manpower, this has greatly impacted our development abilities for the Merge System.
• Mainstream Availability - Many people shy away from testing the Merge System because of the “RC” or “Beta” tags attached to it. Unfortunately, we haven’t gotten many people to come forth and test it for that reason and in turn it just creates a catch-22. If we can’t get people to test it, then it is difficult for us to move forward. On the flip side, people don’t want to test it unless we’ve completed development to a “stable” point.

Testing has been a problem since the beginning and the Merge System has gone through 3-4 rewrites because of it. The process of testing and reproducing in its current state is cruel to us developers for a few reasons:

• Information - We need very specific information to reproduce problems, which can be sometimes hard to procure from users. And when we get that information we have to determine whether it was caused by the Merge System, the other forum system, or by a modification or plugin that may have skewed with the database data.
• Time - The MyBB Merge System is a staircase in a high rise. You have to work your way up from Level A all the way through Level Z to complete the merge. At any point in time, a problem could have happened. If we are able to reproduce the problem, then we have to look at the code to see if there is a way to fix it. If the developers were able to come up with a fix, then we have to test the Merge System again. If the fix didn’t work then we’re back to square 2 and we have to repeat the process. This means that we are at minimum required to run the Merge System twice on our test data, and usually it’s more than that.
• Reproduction - In the case that we weren’t able to reproduce the problem then we have to go back to square 1 and figure out what more information we need or in some cases, direct access to the test data in the live environment where the problem originally happened. This leads us to our last reason.
• Communication - Some of the time users report their problems and never come back because the merge is already completed into their forum and most problems are usually already fixable with a bit of manual work. This makes it really frustrating when we’re trying to reproduce and diagnose problems reported by users.

Complexity has also been a large problem for our developers and one of the reasons progress has been so slow. Not only do we have to perform balancing acts between MyBB and the Merge System, we also have to deal with the complexity of the Merge System when testing and reproducing issues and general updates overall.

Lastly, mainstream availability has been a big issue with the Merge System. The market for a Merge System is a lot smaller then the market of MyBB and it’s a one-time-use program, so people tend to use it, report their problems, and never need to come back to it. 

For the reasons above, we have started looking into automated methods of testing code.  One solution we are currently trying is Unit Testing, a type of testing used in SQA departments.  In fact, I am current about half way through reworking the Merge System to support Unit Testing. 

Unit testing is a form of quality assurance where small blocks of a software module such as a single function are tested to ensure that by themselves their outputs correspond correctly to given test inputs. At a click of a button, a developer or tester can run a set of tests and see the results quite simply as a “pass” or “fail” for each of the test cases. This will help us quickly identify any “broken” components which may have been caused by the latest changes, and from which component the problem is in.

Once we have unit testing in place, a large majority of problems we would be able to identify and resolve before it is ever released to the public and in turn we won’t need to rely as much on the public to test the Merge System.

Thanks for reading and I hope you enjoyed this article.

Well… it’s been a long journey folks; With MyBB 1.4 released, we thought it might be a good idea to tell you how 1.4 got to where it is today. So without further ado, we present to you the Road to MyBB 1.4.

April 2006:

The first pre-alpha mockups of the ACP are shown internally to the staff. Ideas are collected for 1.4 and discussed and our general feature list is planned.

September 2006:

MyBB 1.4’s development pace starts picking up once MyBB 1.2 Final is released.

October 2006:

MyBB 1.4’s new ACP is being planned and drafted.

February 2nd, 2007:

After 8 rewrites, MyBB 1.4’s ACP’s core is finally written. The first page, the settings page, is started.

March 2007:

MyBB 1.4’s new ACP base/core continues to be improved. Some beginning pages (Dashboard/Credits) are done and others are in progress. A chunk of front-end features are in the works or completed.

October 21st, 2007:

A good portion of the MyBB 1.4 ACP is done. 99% of MyBB’s front-end features are done. This day MyBB 1.4 is open to a select few for beta testing.

March 19th, 2008:

The first download of MyBB is available to testers. All of the ACP is completed except the Themes page. 100+ bugs were reported and fixed within this timeframe. More testers are invited.

May 2nd, 2008:

The second refresh of MyBB is available to testers. All of the ACP is completed. 100+ bugs were reported and fixed in this timeframe. All of the translators, and many mod creators and theme creators were invited at this time.

June 23rd, 2008:

The sixth refresh of MyBB is available to testers. Bug reports have slowed. Since refresh two over 300+ bugs were fixed.

June 26th, 2008:

A publicly joinable private beta of MyBB is open to users.

July 6th, 2008:

The second beta of MyBB 1.4 is posted, including 40+ bug fixes from Beta 1.

August 3rd, 2008:

MyBB 1.4 is released.

All in all, in the development timeframe of 1.4 over a quarter of a million lines of code have changes in over 1,700 commits, over 500 bugs were fixed and many additional suggestions were implemented during our 6+ month beta process.

Also, throughout this process the MyBB Merge System was being worked on and the MyBB 1.2 series was being maintained.

We hope everyone enjoys the new functionality and changes we’ve provided in MyBB 1.4