• • • • • • • is strictly synchronous and static, making users alternate between waiting and filling out forms,
            • asks for information that’s either nonessential (e.g. a website URL for the optionally displayed link), or derived (e.g. cookie settings that can be deduced from the forum URL),
            • contains technical details of little to no relevance, which also makes it more difficult to navigate,
            • loads pages only for the user to press Next, instead of proceeding automatically,
            • offers no shortcuts for quick setup for testing or development, and
            • can’t be scripted or automated.

The special part of the application accessed through install/ was largely self-contained and separate from the rest, offering a good target for improvements parallel to other work on the 1.9 series.

In this post, we share how the system was disassembled, redesigned, and rebuilt.

Key Changes

The new implementation was expected not only to address the web GUI problems, but also to introduce a mirror interface for the command line, as well as a PHP API for direct execution.

Rather than tailoring the interfaces to any specific business logic, the GUI and CLI were generally prepared for miscellaneous future usage (i.a. by the Merge System, which currently has to carry its own UI).

Correspondingly, the existing activities — installation and upgrade — were rewritten as universal processes with controlled input, output, and better-isolated logic, while the miscellaneous, reusable code was refactored into functions.

 

Del

The best kind of code improvement is its deletion. With MyBB 1.9 switching to file-based themes, the most time-consuming operation of inserting the templates into the database was safely removed. In the same spirit, the GNU GPL license agreement was left out, given that it relates to distribution, rather than usage of software. The installation’s final page was scrapped, and the summary information was moved to a Welcome to MyBB thread, which additionally serves as dummy content for new users to play with after being redirected there from the installer.

Process operations are executed automatically until user input is needed, without unnecessary confirmation or technical output. For example, the installer skips the full list of requirements — available on Download and Docs pages — and only produces relevant details when problems are found.

Input for settings related to HTTP cookies (responsible for the Domain and Path attributes) — effectively derivative of the Board URL — was removed, and the values are determined automatically instead. Similarly, the setting for the Secure flag will now be immediately enabled for HTTPS-based URLs.

The reorganization reduced the number of steps (and displayed screens) to four, grouping all related operations according to the types of data they depend upon (gathered using forms in the browser, or series of prompts in the CLI).

Ctrl V

Both processes were supplemented with a mechanism previously exclusive to the Admin Control Panel: checksum verification. Given the potential for various problems to occur during upload, MyBB will run an integrity check of its files during installation and upgrade.

Another feature brought in line with the core was language support: although a .lang.php phrases file was utilized, applying non-English languages required overwriting it, which was a pain point when distributing translations. In 1.9, the file was moved to the inc/languages/ structure, meaning that it can be supplied within ordinary language packs. When non-English packs are detected, a selection is displayed, and if just one extra language is present, it becomes the default option. This choice also changes the board’s Default Language, and that of the new administrator account.

Finally, the version check functionality was replicated in the GUI, allowing webmasters to easily confirm they are about to install, or update to, the application’s latest available version.

Insert

To help prevent accidental overwriting of data, signs of an existing instance will result in alternative headings and descriptions, indicating a reinstallation. As forgotten forums may appear broken for numerous reasons (e.g. failed database connection, or missing content), a more precise status is attached to the first step.

Lowering the bar for new forum owners, we made two improvements to the database credentials form — likely to be the most difficult one. First, the process now provides instant feedback for parameters at multiple stages (server connection, authentication, database access, and existence of old tables). Second, while the default database engine selection was already filtered according to enabled PHP extensions, the new process will also perform a number of educated guesses to pre-fill the rest of the form. This behavior may be especially beneficial to testers and developers who use standardized credential sets.

User Interfaces

Web UI

The new web-based interface uses a single index.php entry point, which contains fallback code to provide friendly error messages when PHP cannot be executed, or its version is not supported.

In MyBB 1.8 and before, when accessing the directory with a functional forum, administrators would be presented with an upgrade/install choice screen — this was simplified by opening the upgrade screen by default, with a link to force reinstallation for local network requests that indicate a non-production board.

The flow in the browser-based GUI is managed by a client-side controller, capable of handling input and output asynchronously, letting users fill out and submit subsequent forms as the attached operations execute in the background. A server-side controller provides fallback support for no-JavaScript clients.

More form fields take advantage of input verification and autocomplete features supported by browsers and password managers. Password fields were enriched with reveal toggles (in browsers other than Microsoft Edge, which provides the feature natively) — balancing the UX with the removal of redundant retype password input — and then placed at the end of forms to detect usage of other entered data (like site details, username, or email) for score calculation, powered by the zxcvbn library.

The auto-login feature was extended to likewise initialize a session for the Admin CP, enabling administrators to instantly explore it and finish configuring their forums.

 

When installing in development mode, an additional post is created in the welcome thread with convenient links to launch the process again and reset MyBB to its default state.

Over six years ago, we pointed out the tip-over in observed web traffic into the majority using HTTPS — today’s data shows that secure transmission for publicly-available sites is a universal standard. Although administrators of new forums should be well-aware of this, and have HTTPS already set up, some may delay this step until after the installation. This, of course, is dangerous, given that passwords and login keys already start being transmitted. Therefore, the installer warns about an unsafe connection for public network requests (limiting warning fatigue during non-production usage).

Consistent with our long-term development plans, the new setup system has no inline styles nor scripts, which allowed us to add a restrictive Content Security Policy by default.

The web implementation tracks the time of each operation using the Performance API, and the custom measurements can be observed using developer tools built into some web browsers.

Safety

The installer has been equipped with additional checks to prevent misuse. Previously, authentication was only required to access the upgrade script, but not installation, which may have allowed third parties to access it when the complete directory was uploaded and the lock file was deleted for upgrading.

The new system will check for additional, process-specific lock files, with lock_install created automatically. To reinstall the board, administrators will be also required to delete or empty the configuration file, which will provide another cue that existing data will be overwritten. These constraints don’t apply in a development environment, in which case a detailed installation status is simply shown on the first screen.

Authentication-related logic tied to the upgrade script was reworked by removing assumptions about the stability of initialization and credential handling, which may become temporarily broken during the upgrade process (e.g. after uploading new files, but before applying database changes). Instead, the upgrade process validates administrators’ sessions carried over from the forum front-end opportunistically, and otherwise relies on an ad-hoc proof by prompting them to create a temporary file with the name cryptographically tied to a cookie value.

CLI

---