As we stabilize the 1.8 branch for future support with development eventually switching focus to 1.9, we’d like to draw your attention to the following advisories.
CAPTCHA Bug
Version 1.8.27 has introduced a bug affecting two of MyBB’s supported CAPTCHA mechanisms: reCAPTCHA v3 and hCaptcha invisible. For those, the CAPTCHA may appear broken, and the verification can reject or accept attempts incorrectly.
If your forum uses those systems, we advise to either:
- temporarily switch to another mechanism using the CAPTCHA Images for Registration & Posting setting (ACP: Configuration → Settings → General Configuration), or
- applying the upcoming changes to source code files manually.
This problem will be resolved in the next maintenance release.
Parser Output Validation
The upcoming maintenance release enforces validation of XHTML code generated by the MyCode parser in order to improve security.
MyBB 1.8.27 included this feature in report-only mode, meaning that any problems are already being saved to the configured error log. After upgrading, validation errors will continue to be logged, but messages with problematic MyCode will not be displayed to prevent potential XSS attacks against your forums.
Forum administrators should verify that their error logging is configured properly, and monitor the log for errors that may indicate necessary changes to their customizations like custom MyCodes, theme templates, username styles, and plugins. These errors can be triggered when forum content that uses MyCode is viewed.
We created a relevant Docs section that details pinpointing the origin, debugging using a dedicated tool, and disabling the validation requirement for boards that are not yet ready for this change.
Examples of Fixed Validation Errors
To help demonstrate what actions may need to be taken, let’s take a look at some validation failures that turned up so far:
-
Case 1: Attributes Without Value in Default Templates
MyBB’s default theme included HTML attributes without values. These caused validation errors such as:
Specification mandates value for attributeattributes construct error
To fix this, we simply added ="true" fragments where needed.
-
Case 2: Redundant Tags in Username Style
In a support thread, unnecessary HTML in a customized username style, present in a forum post, resulted in a logged failure that mentioned:
This could be resolved by cleaning up the HTML code in the Username Style field for the problematic user group by removing stray closing tags.
-
Case 3: Self-Closing Tags in Custom MyCode
In another support thread, a custom MyCode included an unclosed <hr> HTML tag, which resulted in a validation failure that mentioned:
Opening and ending tag mismatch
-
EndTag: '</' not found
For correct XHTML validation, tags that don't have an equivalent closing tag should include a forward slash: <hr />.
-
Case 4: Invalid Placeholder Format
A plugin that inserted invisible markers in the <example#0> format resulted in errors referring to attribute parsing and missing end tags. This format was changed to <example id="0" /> to pass the validation.
If you have trouble resolving validation failures, visit our support platforms and include the full logged error.
PHP Compatibility
MyBB aims to support most recent versions of web browsers, servers, database systems, and PHP interpreters. Due to significant changes in PHP 8.0, however, we recommended using PHP up to 7.4 while the code was being adjusted.
The upcoming MyBB release includes another batch of such adjustments, and removes some unnecessary side-effects of version-related PHP Warnings. We also pay attention to PHP 8.1, which is not expected to cause major problems after these updates.
Even though more issues may still be discovered when running MyBB on latest versions of PHP, we encourage administrators and extension developers to verify the stability of their forums and extensions on PHP 8, and to watch out for any errors that may appear in the error log, starting with the next maintenance release. Numerous web hosts already support switching to PHP 8.0, and MyBB can easily be tested locally using Docker.
Any suspected issues related to compatibility, as usual, can be reported on our support platforms.
MyBB Blog 