MyBB 1.8.8 & Merge System 1.8.8 Release

MyBB 1.8.8 is now available from the MyBB website, and is a security and maintenance release.

What’s added/changed in this version?

This release fixes 7 security vulnerabilities and 58 reported issues causing incorrect functionality of MyBB. Please be aware that not all issues have been fixed in this version in order to provide easy to manage updates.

  • Vulnerabilities:
    • Medium risk: Style import CSS overwrite on Windows servers – reported by patryk
    • Medium risk: SQL Injection in the users data handler – reported by afinepl
    • Medium risk: SSRF attack in fetch_remote_file() – reported by dawid_golunski
    • Medium risk: Possible short name access to ACP backups on Windows servers – reported by kevinoclam
    • Low risk: Stored XSS in the ACP – reported by patryk
    • Low risk: Loose comparison false positives – reported by Devilshakerz
    • Low risk: Possible XSS injection in ACP users module – reported by afinepl

Please view the 1.8.8 changes on the Docs site for more information about the changes in this version.

Please note, that you do need to run the upgrade script for this version.

Upgrading from 1.8.7 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is required. There are changes to 23 language files and 64 templates were changed or added.

If you’re using MyBB 1.8.7:

  • Download and use the Changed Files Package
    • MD5: 43028accb46eecf8016ef5fdc4fe522a
    • SHA1: 2c9985353e87c8710bdcdcf1856b0a6c63961317
    • SHA256: bb479145b44f169c301c21425f78742d8cacd9fd9ef4543c2a5e39ab540f769e
    • SHA512: 47ddbd601d008e9cb7309b328d36df95f901d1935593ded61e70cef22dc1312257266e056e5ea9d214babfd47a0aeb9560e9d11a5abb8d68a244f442467c41854a73f915ee3f4e6bd2f654334ca0f75
  • Follow the Docs Upgrading Instructions

If you’re using MyBB 1.8.6 or lower:

  • Download and use the full 1.8.8 Release Package
    • MD5: 2e09c9fd3b2416ac3fea9bada18d61e5
    • SHA1: 2b8469cb42c3a66ec7e3253aa0cced464585d3dd
    • SHA256: e63bd3ce5b8a7c4166102baa75f0aab1d12fc64379658a027d8bf49a437a469a
    • SHA512: 8dec5923737b11deae578ed02f259acda01ca5bcc9032bc01df1e2d77ce36c54f87e66e42850460c8ea07515d99d4b5da4a73f915ee3f4e6bd2f654334ca0f75
  • Follow the Docs Upgrading Instructions

This update includes security fixes that may need your attention:

  • Additional rules disallowing access to the database backups directory (admin/backups/) were added to htaccess.txt and htaccess-nginx.txt, addressing a security issue affecting Windows installations – remember to update your configuration files.
  • $config['disallowed_remote_hosts'] and $config['disallowed_remote_addresses'] variables, containing default loopback hosts and IPv4 addresses, were added to the inc/config.php file, addressing a SSRF vulnerability – remember to update your configuration files and, if applicable, add further hosts and/or addresses that MyBB shouldn’t attempt to access.

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page or in our Private Inquiries forum – where you can start a new thread that only you and the MyBB Team can see.

MyBB Merge System 1.8.8

MyBB Merge System 1.8.8 is now available on the MyBB website and is a maintenance update to the MyBB Merge 1.8 series.

This release is to ensure that all users of MyBB Merge 1.8 have the latest fixes.

This release fixes several reported issues since the release of 1.8.7, which caused some incorrect functionality of the Merge System. These bugs have been fixed to provide a more stable version of the Merge System for public use.

What’s new in this version?

  • 5 bug fixes (View all)
  • Preliminary support for merges from vBulletin 5 installations. This module hasn’t had a lot of testing, so please report back with how vBulletin 5 merges go and always test your merge on a local machine first.

Important note

This will be the last release of the Merge System 1.8. We’re instead concentrating development efforts on MyBB 2.0 and a brand new Merge System to accompany it – please stay tuned for more news on the new merge system!

Thanks,

MyBB Team

MyBB 1.8.7 & Merge System 1.8.7 Release

MyBB 1.8.7 – Security & Maintenance Release

MyBB 1.8.7 is now available from the MyBB website, and is a security and maintenance release.

What’s added/changed in this version?

This release fixes 13 security vulnerabilities and 83 reported issues causing incorrect functionality of MyBB. Please be aware that not all issues have been fixed in this version in order to provide easy to manage updates.

  • Vulnerabilities:
    • Medium risk: Possible SQL Injection in moderation tool – reported by jamslater
    • Low risk: Missing permission check in newreply.php – reported by StefanT
    • Low risk: Possible XSS Injection on login – reported by Devilshakerz
    • Low risk: Possible XSS Injection in member validation – reported by Tim Coen
    • Low risk: Possible XSS Injection in User CP – reported by Tim Coen
    • Low risk: Possible XSS Injection in Mod CP logs – reported by Starpaul20
    • Low risk: Possible XSS Injection when editing users in Mod CP – reported by Tim Coen
    • Low risk: Possible XSS Injection when pruning logs in ACP – reported by Devilshakerz
    • Low risk: Possibility of retrieving database details through templates – reported by Tim Coen
    • Low risk: Disclosure of ACP path when sending mails from ACP – reported by sarisisop
    • Low risk: Low adminsid & sid entropy – reported by Devilshakerz
    • Low risk: Clickjacking in ACP – reported by DingjieYang
    • Low risk: Missing directory listing protection in upload directories – reported by Tim Coen

Please view the 1.8.7 changes on the Docs site for more information about the changes in this version.

Please note, that you do need to run the upgrade script for this version.

Upgrading from 1.8.6 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is required. There are changes to 15 language files and 41 templates were changed or added.

If you’re using MyBB 1.8.6:

If you’re using MyBB 1.8.5 or lower:

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page or in our Private Inquiries forum – where you can start a new thread that only you and the MyBB Team can see.

MyBB Merge System 1.8.7

MyBB Merge System 1.8.7 is now available on the MyBB website and is a maintenance update to the MyBB Merge 1.8 series.

This release is to ensure that all users of MyBB Merge 1.8 have the latest fixes.

This release fixes several reported issues since the release of 1.8.6, which caused some incorrect functionality of the Merge System. These bugs have been fixed to provide a more stable version of the Merge System for public use.

What’s new in this version?

Thanks,

MyBB Team

Note about updated packages

The original packages have been replaced by updated packages to fix minor compatibility issues with PHP 5.2 and PostgreSQL and to fix issues with font MyCode and search functionality.

If you installed or updated your forums using either the full or changed files packages prior to 19:00 p.m. on March 25, 2016 GMT please download a fresh package from the links above and replace the following files:

  • inc/cachehandlers/apc.php
  • inc/cachehandlers/eaccelerator.php
  • inc/cachehandlers/interface.php
  • inc/cachehandlers/memcache.php
  • inc/cachehandlers/memcached.php
  • inc/cachehandlers/xcache.php
  • inc/class_parser.php
  • install/resources/upgrade35.php
  • search.php

You do not need to run the installer or make any further changes. You can use the file verification tool to determine whether you have the latest package, the file above will appear to be modified if you need to download an updated copy.

We apologise of any inconvenience.

MyBB 1.8.6, 1.6.18 & Merge System 1.8.6 Release

MyBB 1.8.6 – Security & Maintenance Release

MyBB 1.8.6 is now available from the MyBB website, and is a security and maintenance release.

What’s added/changed in this version?

This release fixes 5 security vulnerabilities and 51 reported issues causing incorrect functionality of MyBB. Please be aware that not all issues have been fixed in this version in order to provide easy to manage updates.

  • Vulnerabilities:
    • Medium Risk: Forum password bypass in xmlhttp.php – reported by Devilshakerz
    • Low Risk: SQL Injection in Grouppromotions module (ACP) – reported by Devilshakerz
    • Low Risk: Possible XSS Injection in the error handler – reported by FooBar123
    • Low Risk: Possible XSS issues in old upgrade files – reported by FooBar123
    • Low Risk: Possible Full Path Disclosure in publicly accessible error log files – reported by Devilshakerz

Please view the 1.8.6 changes on the Docs site for more information about the changes in this version.

Please note, that you do need to run the upgrade script for this version.

Upgrading from 1.8.5 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is required. There are changes to 7 language files and 19 templates were changed or added.

If you’re using MyBB 1.8.5:

If you’re using MyBB 1.8.4 or lower:

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page or in our Private Inquiries forum – where you can start a new thread that only you and the MyBB Team can see.

MyBB 1.6.18 – Security Release

MyBB 1.6.18 is now available from the MyBB website. It fixes 1 medium risk and 3 low risk vulnerabilities.

Please note that we’ve extended support period for MyBB 1.6 to give you additional time for upgrading your forum until 1st of October 2015. After that time no support will be provided for MyBB 1.6.

What’s added/changed in this version?

The vulnerabilities are:

Please view the 1.6.18 changes on the Docs site for more information about the changes in this version.

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.

Upgrading from 1.6.17 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is not required. There are no changes to language files. No templates have been changed or added.

If you’re using MyBB 1.6.17:

If you’re using MyBB 1.6.16 or lower

  • Download and use the full 1.6.18 Release Package (MD5: ad17b498116831a1d1d75bf07351ea0c)
  • Follow the Docs Upgrading Instructions

MyBB Merge System 1.8.6

MyBB Merge System 1.8.6 is now available on the MyBB website and is a maintenance update to the MyBB Merge 1.8 series.

This release is to ensure that all users of MyBB Merge 1.8 have the latest fixes.

This release fixes several reported issues since the release of 1.8.5, which caused some incorrect functionality of the Merge System. These bugs have been fixed to provide a more stable version of the Merge System for public use.

What’s new in this version?

  • 11 bug fixes (View all)
    • New module: Avatars are now finally merged!
    • Counters are finally updated automatically – no need to run them manually after the merge
    • Multiple changes to make the merge system more intuitive

Thanks,

MyBB Team

MyBB 1.8.5, 1.6.17 & Merge System 1.8.5 Release

MyBB 1.8.5 – Security & Maintenance Release

MyBB 1.8.5 is now available from the MyBB website, and is a security and maintenance release.

What’s added/changed in this version?

This release fixes 6 security vulnerabilities and 58 reported issues causing incorrect functionality of MyBB. Please be aware that not all issues have been fixed in this version in order to provide easy to manage updates.

  • Vulnerabilities:
    • Medium Risk: Reset password code check could be circumvented in member.php – reported by solati.sadegh
    • Medium Risk: Sender email could be spoofed when sending an email to a user in member.php – reported by onlinedevelopers
    • Medium Risk: Permissions not checked for post search with old sid in search.php – reported by pedder55655
    • Medium Risk: XSS in quick edit function of xmlhttp.php – reported by TiberiusG
    • Low Risk: CSRF in ACP mass mail cancellation – reported by Destroy666
    • Low Risk: Use of the U+200E Unicode character to create “duplicate” username – reported by mahdy2021

Please view the 1.8.5 changes on the Docs site for more information about the changes in this version.

Please note, that you do need to run the upgrade script for this version.

Upgrading from 1.8.4 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is required. There are changes to 12 language files and 9 templates were changed or added.

If you’re using MyBB 1.8.4:

If you’re using MyBB 1.8.3 or lower:

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page or in our Private Inquiries forum – where you can start a new thread that only you and the MyBB Team can see.

MyBB 1.6.17 – Security Release

MyBB 1.6.17 is now available from the MyBB website. It fixes 2 medium risk and 5 low risk vulnerabilities.

Please note that MyBB 1.6 is approaching its end of life and no support will be provided after 1st of September 2015 (see the EOL announcement).

What’s added/changed in this version?

The vulnerabilities are:

  • Medium Risk: Reset password code check could be circumvented in member.php – reported by solati.sadegh
  • Medium Risk: Permissions not checked for post search with old sid in search.php – reported by pedder55655
  • Low Risk: CSRF in ACP mass mail cancellation – reported by Destroy666
  • Low Risk: Use of the U+200E Unicode character to create “duplicate” username – reported by mahdy2021
  • Low Risk: Multiple XSS vulnerability requiring admin permissions – reported by adamziaja, Devilshakerz, DingjieYang and sroesemann
  • Low Risk: A CSRF vulnerability within ACP login – reported by Devilshakerz
  • Low Risk: Cache handler using var_export without encoding checks – reported by chtg

Please view the 1.6.17 changes on the Docs site for more information about the changes in this version.

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.

Upgrading from 1.6.16 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is not required. There are no changes to language files. No templates have been changed or added.

If you’re using MyBB 1.6.16:

If you’re using MyBB 1.6.15 or lower

  • Download and use the full 1.6.17 Release Package (MD5: b9dd9e8cd9c6390626f850bb83cb03cb)
  • Follow the Docs Upgrading Instructions

MyBB Merge System 1.8.5

MyBB Merge System 1.8.5 is now available on the MyBB website and is a maintenance update to the MyBB Merge 1.8 series.

This release is to ensure that all users of MyBB Merge 1.8 have the latest fixes.

This release fixes several reported issues since the release of 1.8.4, which caused some incorrect functionality of the Merge System. These bugs have been fixed to provide a more stable version of the Merge System for public use.

What’s new in this version?

  • 26 bug fixes (View all)
    • Including several changes to the private message modules, forum permissions, the usergroup module and attachments
    • Support for phpBB 3.1
    • Support for IPB 4

Note about the loginconvert Plugin

The official loginconvert plugin was also updated to version 1.4.1, including fixes for password resets and special passwords. If you’ve run a merge in the past please update your plugin. Also the plugin was added to our mods site.

Thanks,

MyBB Team

MyBB 1.8.4 Released – Feature Update, Security & Maintenance Release

MyBB 1.8.4 – Feature Update, Security & Maintenance Release

MyBB 1.8.4 is now available from the MyBB website and is a feature update, security and maintenance release.

What’s added/changed in this version?

This release fixes 7 vulnerabilities and 118 reported issues causing incorrect functionality of MyBB. Please be aware that to be able to provide easy to manage updates not all issues have been fixed in this version.

Please view the 1.8.4 changes on the Docs site for more information about the changes in this version.

Please note, that you do need to run the upgrade script for this version.

Upgrading from 1.8.3 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is required. There are changes to 18 language files. 54 templates have been changed or added.

If you’re using MyBB 1.8.2 or lower

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page or in our Private Inquiries forum – where you can start a new thread that only you and the MyBB Team can see.

Thanks,

MyBB Team

Note about updated package for 1.8.4

Due to a minor issue with the original packages an updated package set has been released.

If you installed or updated your forums using either the full or changed files packages prior to 10:00 a.m. on February 16, 2015 GMT please download a fresh package from the links above and replace the following file:

moderation.php

You do not need to run the installer or make any further changes. You can use the file verification tool to determine whether you have the latest package, the file above will appear to be modified if you need to download an updated copy.

We apologise of any inconvenience.

Merge System 1.8.4

MyBB Merge System 1.8.4 is now available on the MyBB website and is a maintenance update to the MyBB Merge 1.8 series.

This release fixes a compatibility issue with MyBB 1.8.4.

MyBB 1.8.3 & 1.6.16 Released – Security Releases

MyBB 1.8.3

MyBB 1.8.3 is now available from the MyBB website. It fixes 1 high risk vulnerability, 2 medium risk vulnerabilities and 3 low risk vulnerabilities. We recommend everyone upgrades to this release immediately.

What’s added/changed in this version?

The vulnerabilities are:

  • High Risk: A SQL injection vulnerability in theme selection (reported by StefanT)
  • Medium Risk: A XSS vulnerability in calender.php (reported by -Acid)
  • Medium Risk: A XSS vulnerability in MyCode editor (reported by My-BB.Ir)
  • Low Risk: A XSS vulnerability related to post icons (reported by Destroy666)
  • Low Risk: unserialize may call PHP magic methods (reported by chtg)
  • Low Risk: PHP setting request_order can break register globals handling (reported by chtg)

Additionally we’ve fixed an issue with the video MyCode introduced with MyBB 1.8.2 (#1625) and revised the handling of data fetched from our website as a direct consequence of the compromised GitHub account (#1617). In addition to that, we’ve set the adminsid cookie as httpOnly (#1622). We also plan to add enhanced options to protect the Admin CP like two factor authentication with one of the next maintenance releases.

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.

Upgrading from 1.8.2 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is not required. There are no changes to language files. No templates have been changed or added.

If you’re using MyBB 1.8.1 or lower

  • Download and use the full 1.8.3 Release Package (MD5: 1f5d1246da4174f3b29799eca435d86c)
  • Follow the Docs Upgrading Instructions

MyBB 1.6.16

MyBB 1.6.16 is now available from the MyBB website. It fixes 5 low risk vulnerabilities.

What’s added/changed in this version?

The vulnerabilities are:

  • Low Risk: A XSS vulnerability related to post icons (reported by Destroy666)
  • Low Risk: A XSS vulnerability in admin/modules/style/templates.php
  • Low Risk: A XSS vulnerability in admin/modules/config/languages.php
  • Low Risk: unserialize may call magic methods (reported by chtg)
  • Low Risk: request_order can break register globals handling (reported by chtg)

Additionally we’ve revised the handling of data fetched from our website as a direct consequence of the compromised GitHub account (#1617). In addition to that, we’ve set the adminsid cookie as httpOnly (#1622).

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.

Upgrading from 1.6.15 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is not required. There are no changes to language files. No templates have been changed or added.

If you’re using MyBB 1.6.14 or lower

  • Download and use the full 1.6.16 Release Package (MD5: 98e84e5de337843f407a4b58d70253c9)
  • Follow the Docs Upgrading Instructions

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page or in our Private Inquiries forum – where you can start a new thread that only you and the MyBB Team can see.

Thanks,

MyBB Team

Note about updated package for 1.6.16

Due to a minor issue with the original packages an updated package set has been released.

If you installed or updated your forums using either the full or changed files packages prior to 18:00 p.m. on November 20, 2014 GMT please download a fresh package from the links above and replace the following file:

admin/modules/home/version_check.php
calendar.php (reverted to previous version)

You do not need to run the installer or make any further changes. You can use the file verification tool to determine whether you have the latest package, the file above will appear to be modified if you need to download an updated copy.

We apologise of any inconvenience.

MyBB 1.8.2 Released – Security Release

MyBB 1.8.2 is now available from the MyBB website. It fixes 1 high risk vulnerability, 2 medium risk vulnerabilities and 2 low risk vulnerabilities. We recommend everyone upgrades to this release immediately.
MyBB 1.6.15 is not affected by these vulnerabilities.

What’s added/changed in this version?

The vulnerabilities are:

  • High Risk: A SQL injection vulnerability in member.php
  • Medium Risk: A XSS vulnerability in report.php
  • Medium Risk: A XSS vulnerability in inc/class_parser.php
  • Low Risk: A XSS vulnerability in admin/modules/style/templates.php
  • Low Risk: A XSS vulnerability in admin/modules/config/languages.php

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.

Upgrading from 1.8.1 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is not required. There are no changes to language files. No templates have been changed or added.

If you’re using MyBB 1.8.0 or lower

  • Download and use the full 1.8.2 Release Package (MD5: 4f6e49b7a457b72dbe8fb47ae5ded430)
  • Follow the Docs Upgrading Instructions

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page or in our Private Inquiries forum – where you can start a new thread that only you and the MyBB Team can see.

Thanks,

MyBB Team

MyBB 1.8.1 & Merge System 1.8.1 Release

MyBB 1.8.1 – Maintenance Release

MyBB 1.8.1 is now available from the MyBB website and is a maintenance release.

What’s added/changed in this version?

This release fixes 74 reported issues causing incorrect functionality of MyBB. Please be aware that to be able to provide easy to manage updates not all issues have been fixed in this version.

Please view the 1.8.1 changes on the Docs site for more information about the changes in this version.

Please note, that you do need to run the upgrade script for this version.

Upgrading from 1.8.0 and Other Versions

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

To upgrade, follow the Upgrading process. The upgrade script is required. There are changes to 13 language files. 15 templates have been changed or added.

If you’re using MyBB 1.6.15 or lower

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page or in our Private Inquiries forum – where you can start a new thread that only you and the MyBB Team can see.

MyBB Merge System 1.8.1

MyBB Merge System 1.8.1 is now available on the MyBB website and is a maintenance update to the MyBB Merge 1.8 series.

This release is to ensure that all users of MyBB Merge 1.8 have the latest fixes.

This release fixes several reported issues since the release of 1.8.0, which caused some incorrect functionality of the Merge System. These bugs have been fixed to provide a more stable version of the Merge System for public use.

What’s new in this version?

  • 7 bug fixes (View all)
    • Including a big update to the BBCode Parser
  • We decided to readd the vBulletin 3 module after some requests. It’s now fully supported again

Thanks,

MyBB Team

MyBB Merge System 1.8

The MyBB Merge System for 1.8 is now available from the MyBB website.

What’s new in this version?

First we decided to drop some old modules which aren’t supported by their developers:

  • BBPress 1
  • IP.Board 2
  • Mingle
  • phpBB 2
  • vBulletin 3

And of course we’ve added more new modules (including some which you requested fairly often in the past)

  • BBPress 2
  • WoltLab Burning Board Lite 2
  • WoltLab Burning Board 3
  • WoltLab Burning Board 4
  • IP.Board 3
  • IP.Board 4 (Based on the latest Preview Release)
  • vBulletin 4
  • FluxBB
  • XenForo

And yes, we fixed finally a lot of known issues with the merge system: Fixed Bugs
But (as always) there’re still some Known Bugs.

Translations and the Merge System

Till now the Merge System was only available in english, however we decided to make the Merge System translatable too. The language file is located at “merge/language/”.

Help us!

You can report bugs and help us with the development at GitHub but even if you can’t code you can help us with sending us some sample databases (more infos on the forums).

MyBB 1.8 Released

It is with the highest honor that we release MyBB 1.8 Gold to the general public.

Our team, and you the community, have been on a fantastic journey since that April Fools day in 2012 when MyBB 1.8 development was first announced to the public. Now here we are, 2 years and 5 months on, proudly showing you our completed product. It may have taken longer than first anticipated but we are sure you’re going to love what has been produced at the end of the line.

As said in the initial announcement of 1.8, it is the bridge to MyBB 2.0; this has not changed. Because now, hidden away in our lair, we’ve been drawing up plans and discussing the development of 2.0. These discussions and plans are to be put into action now so the development of 2.0 is really getting going.

As you may have noticed the new MyBB website and documentation have been launched. This new design is courtesy of Justin S, our lead designer, which we’re very proud of. Unfortunately the new documentation for 1.8 is a bit threadbare, however most of the 1.6 Docs still apply to 1.8; so while we’re working on the new documentation you can continue to use the 1.6 Docs.

Download

You can find the download link here (MD5: a36ab62236a24caeb827b769bf493f26). If you’re upgrading, make sure to backup your database and files first.

Updating from previous versions

Be warned that with the following release:

  • Despite our attempts to keep theme changes to a minimum there are still several changes to templates which will need to be addressed by you upon upgrading to 1.8. You’ll need to run the “Find Updated Templates” tool in the Templates & Style section of your Admin CP to update templates to be 1.8 compatible. This can be found Admin CP -> Templates & Style -> Templates -> Find Updated Templates.
  • Most plugins and code modifications will need to be updated to work with MyBB 1.8. Make sure you disable your plugins before upgrading and make sure updated copies compatible with MyBB 1.8 are available.
  • Custom language packs from earlier versions will also need to be updated.

Before you attempt to upgrade, ensure you have a database backup and a copy of the files currently in use on your board. This is so you can revert back to your earlier version if you need to or something goes horribly wrong with the upgrade process.

This is a moderately long upgrade process. Please make sure you don’t refresh pages whilst they’re loading, and don’t click the “Next” button more than once (if you don’t have JavaScript enabled). You should plan your upgrade before attempting to perform it.

Follow the general Upgrading guide outlined on the MyBB Documentation to complete the upgrade process.

Changes

Color legend:

  • Dark Blue – Small (new) feature/change
  • Light Blue – Enhancement
  • Orange – New Feature

Admin CP & Front-End

  • Remove PHP Closing tags #979
  • Performance improvement: intval to (int) conversion #491
  • Update 3rd part libraries #957
  • Warnings class/datahandler #922
  • Hide signtature of users to certain groups #949
  • Hide website links/buttons from certain groups #922
  • Add more hooks – #555 #882
  • Allow custom flash messages #881
  • Allow website field for certain groups only #808

Admin CP

  • New theme#561
  • AdminCP PIN#38
  • Improved Newsfeed#562
  • Replace CodePress with CodeMirror#37
  • Stylesheet Display order#562
  • Inactive/active Plugin list#573
  • Ability to create own template groups#588
  • Added Enabled/Disabled indicators to Promotions and MyCodes#457
  • Template groups updates#452
  • Disable Attachments Globally#495
  • ACP Banning Improvements – #628 #554
  • Selectable areas for group/forum settings.#428
  • Warning for marked vulnerable plugins.#0147b08
  • ACP shouldn’t reset $mybb->input#754
  • Admin CP language#690
  • Disable Default MyCodes#686
  • More recount tools#494
  • Option to disable contact details #900
  • Log all ‘locked out’ failures in ACP #859
  • Add reported posts stats to ACP #858
  • Delayed moderation improvements #440
  • New Promotion rules #429

Front-end

  • New Theme – #571
    • CSS buttons, PNG images, Sprite images, Fugue icons#571
    • Attachable base colors for themes#580
    • Relative Time#558
    • Prototype to jQuery Conversion (yay!)#251
    • Attachment Types Name#442
    • CSS Minification#564
  • Add ltrim() to search users input#590
  • Change trim() in templates to rtrim()#584
  • A tool to rebuild reputation#591
  • Contact Page#592 #715
  • Ability to delete default help topics#589
  • If user is invisible & permissions disallow, hide all public data#593
  • Post reputation should include thread subject#594
  • Remove Gallery; Integrate Gravatar#582 #586
  • Delete post on full edit should not show if no permission to delete#595
  • Add option to stick/unstick to custom tools#435
  • PM thread author in custom tools for threads#581
  • Users cannot rate their own posts#570
  • format_avatar() function#569
  • Whitelist of avatar upload extensions#568
  • Preview announcements#567
  • Minimum post length to exclude MyCode#566
  • IPv6 features#565
  • APC cache handler#574
  • $cache->delete method#575
  • is_member() function#576
  • delete_user() function#408
  • IP addresses in PMs#563
  • Don’t ask for validation if validation is disabled#577
  • Slow reply posting in long threads#578
  • Soft Delete#560
  • Login Datahandler#572
  • Add theme selector to footer#496
  • Forum redirect icon#453
  • Permission to reply to own threads#409
  • ModCP banned users list descending by default#138
  • Quick Reply PM#437
  • Poll Updates (Add poll link to thread page; limit of time before a thraed author can no longer add a poll)#456
  • Update contact fields#455
  • Are You a Human CAPTCHA#443
  • Report Center #556
  • Ability to sort Private Messages in inbox and other folders#70
  • Recount Warning Points#85
  • Warning points as a Group Promotion criteria#88
  • Registration date and last active time as mass mail criteria#100
  • Display profile fields on posts #133
  • Add “Display posts in classic mode” option when editing user in Admin CP#107
  • Move Edit Time Limit and Max Post Per Day to group settings#114
  • Recount Private Messages#132
  • Hide members from the Member List#142
  • Force redirect page#550
  • Searching plugins will highlight vulnerable ones (requires new Mods site)Commit Link
  • Update $groupzerogreater array#809
  • CDN Compatbility #776
  • Goodbye Spammer #775
  • Add Time Zones#764
  • Thread Count#761
  • Buddy System Enhancements#757
  • Remove Hardcoded HTML#756
  • Database optimization#738
  • Overqualified Selectors#976 #700
  • Subscription PM notification option#689
  • Expand Forum Moderator permissions#688
  • Add profile fields on registration#687
  • Admin and Email activation option#685
  • Publicly shown poll end date#587
  • CAPTCHA Improvements#557
  • Search Help Files#497
  • Invite-only joinable groups#493
  • Maximum Nested Quote Tags for PMs#492
  • Hide stuff users don’t have permission to use#454
  • Edit Reason#451
  • Add to mycode#450
  • User option to disable images/videos#449
  • Moderation Tools Improvements#435
  • Forum Statistics Improvements#434 #824
  • Profile Fields Enhancements#433
  • Using update_query with BIT(1) fields#360
  • inline_moderation.js friendly to table-less themes #915
  • Memberlist sorting #914
  • Force Login #906
  • Add class to smilies #905
  • AJAX for security questions #894
  • Add get_user_by_username() helper function #893
  • find_replace_templates() accepts SID #889
  • $this->options in class_parser.php #880
  • Add class to announcements #879
  • Make forum friendly to outside pages #878
  • Change showthread.php icons to sprite #877
  • Add rebuild settings to cache tools #875
  • Add email description editing to editor #869
  • Add video sites to editor #862
  • Check new members against StopForumSpam #860
  • Jump to Page in pagination #857
  • send_pm() should consider users’ language #834
  • Image re-scaling and long words/text wrapping CSS/HTML changes #816
  • Moderate Groups #439
  • Portal Improvements #436
  • Moderation Notifications #430
  • Thread Prefix system improvements #427
  • Ability to Stop tracking all messages #364
  • Settings description on installation #197
  • Add Template::render method #1344

 

The New Mods site

Along with the new website, the much awaited new Mods Site has also hit action on the MyBB Community Forums. This may come as a surprise but we have come to the decision that the new Mods Site will only contain 1.8 compatible plugins and themes. Worry not for the old Mods Site will still be accessible at mods.mybb.com, as it is being archived for a short while allowing for the continued use of 1.6 resources. Developers will, therefore, have to manually port their resources from 1.6 to 1.8 in order for them to be approved on the new Mods Site.

To find out more about the Mods site, please check the documentation.

 

What’s Next

With the release of 1.8.0, our focus will now turn into two different directions: 1.8.1 and 2.0. Some people will prefer to stick to 1.8.1 development while some will prefer to work on 2.0 (or even both).

Merge System

The Merge System will be released soon but we concentrated on releasing MyBB 1.8 during the last months so there may be a slight delay before we have the Merge System working to merge your forum to 1.8. In the meantime, you can use the 1.6 Merge System to merge to 1.6 and then upgrade to 1.8.

 

Contributors

We’d like to thank all who have helped us make 1.8 a reality, but following contributors, have been exceptional during the 1.8 development:

 

If you want to help us out and become a Contributor, be sure to read this blog post. If you’d rather join the team, feel free to contact us through Private Inquires. The project would be nothing without the team and contributors. If you want to help improve MyBB, now is the time.

 

Celebrating

Everyone is welcome in the #mybb IRC channel at Freenode to celebrate the release of 1.8! We also encourage you to spread the word of social media to help everyone running a MyBB forum to share this fantastic new release!