phpBB 3.3.15 Release - Please update

[Solus]

Greetings everyone,

We are pleased to announce the release of phpBB 3.3.15 “In Memory of Mark D. Hamill”. This version is a maintenance and security release of the 3.3.x branch which fixes one security issue, introduces a number of improvements aimed at enhancing the user experience and overall stability of the software and resolves some issues noticed in previous releases.

Since the introduction of phpBB 3.1, phpBB has been using JavaScript and jQuery to improve the responsiveness of prosilver. We did receive a report about a potentially dangerous code in this section. After an internal audit of this and related code, we noticed that some of the handling of data added by an admin is potentially insecure and could lead to cross site scripting.

The improvements include better handling of HTTPS connections in the version check since switching to Guzzle in the previous release as well as the introduction of proper support for TLS v1.3 with SMTP servers.

Notable bug fixes in this release include resolving an issue that resulted in PHP fatal errors when converting from phpBB 2 with Attachment MOD and issues with the pagination resulting in incorrect ordering when searching for users posts. Furthermore, an issue with duplicate users being displayed on the memberlist while sorting and a potential overflow of the topic views count have been addressed.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release below and a list of all issues fixed on our tracker at https://tracker.phpbb.com/issues/?filter=16790

The packages can be downloaded from our downloads page.

The development team thanks everyone who contributed code to this release: rxu, Kailey M Snay, Alexey Dolzhenko, Neo-CTC, NeoDev, battye, cabot, phpBB TR

If you have any questions or comments, we'll be happy to address them in the discussion topic.

- The phpBB Team


Release highlights
Security Issues
Use jQuery to generate HTML from page data: SECURITY-283
Notable Improvements
Improved handling of version check with Guzzle: PHPBB-17443
Support TLS v1.3 for SMTP servers: PHPBB-17467
Notable Bugfixes
Fatal error when converting from phpBB 2 with Attachment MOD: PHPBB-17436
Incorrect ordering of pagination in user posts search: PHPBB-17422
Duplicate users on memberlist: /PHPBB-17227
Overflow of topic views column: PHPBB-17381


Event changes

PHP Events
core.acp_account_activation_edit_add
Placement: includes/acp/acp_board.php
Arguments: act_ary, act_options
Added in Release: 3.3.15-RC1
Explanation: Event to add and/or modify account activation configurations
core.acp_main_add_actions
Placement: includes/acp/acp_main.php
Arguments: action, id, mode
Added in Release: 3.3.15-RC1
Explanation: Event to add custom ACP quick actions
core.acp_main_add_actions_confirm
Placement: includes/acp/acp_main.php
Arguments: action, confirm, confirm_lang, id, mode
Added in Release: 3.3.15-RC1
Explanation: Event to add confirm box for custom ACP quick actions
core.group_add_user_before
Placement: includes/functions_user.php
Arguments: add_id_ary, group_id, group_name, pending, user_id_ary, username_ary
Added in Release: 3.3.15-RC1
Explanation: Event before users are added to a group

Template Events
None

ACP Template Events
None