Category Archives: Releases

MyBB Merge System 1.6.2

Posted on by

MyBB Merge System 1.6.2 is now available on the MyBB website and is a maintenance update to the MyBB Merge 1.6 series.

This release is to ensure that all users of MyBB Merge 1.6 have the latest fixes.

This release fixes several reported issues since the release of 1.6.1, which caused some incorrect functionality of the Merge System. These bugs have been fixed to provide a more stable version of for public use.

What’s fixed in this version?

As always, you can send through security related messages on the MyBB website from the Contact Us page.

Thank you,
MyBB Team

MyBB 1.6.4 Released – Feature Update, Security & Maintenance Release

Posted on by

MyBB 1.6.4 is now available from the MyBB website and is a feature update, security and maintenance release for the 1.6 series.

What’s added/changed in this version?

In 1.6.4, there are 2 new updates and over 100 reported issues fixed.

Please be aware that not all of the existing problems have been fixed in this version. Because of the size of the updates, these will be fixed in a later release.

The 2 new updates included in 1.6.4 are only small – one globally switches on/off plugins and the other detects whether an Administrator has renamed the Portal to check for file verifications.

Security Updates

There are also 3 security updates for 1.6.4. Overall, they are low risk vulnerabilities as they all require administrator permissions – however, one of these is classed as high risk if a user manages to get into the Admin Control Panel (ACP).

As a result of this, it is recommended that only certain types of variables are used in templates that follow the MyBB Development Standards – although other types may be used it the templates are installed to the database through your plugin, Administrators will not be able to save templates with these variables in.

Theme Artists and Plugin Developers should take a close look at the new changes to see if their work will be affected by the new changes and update them accordingly.

Performance

In 1.6.4, there are a number of performance-related updates. These range from small code changes to caching thread prefixes. More information about these are available on 1.6.4’s page in the Wiki.

Almost everyone should be able to see at least some benefits from these changes.

Upgrading from 1.6.3 and Other Versions

Due to the size of this release and due to release errors earlier in the 1.6 series, all files need to be changed. This is to ensure that you have the latest versions of the software’s files which can be hard to trace from earlier releases.

This upgrade process is the same for any version of MyBB. Before performing any upgrade, please remember to backup your forum’s files and database and store them safely. If you have edited core files, please make sure you make a changelog for these changes so you can make them again once the upgrade is complete.

If you have installed plugins that require changes to core files, you will need to make those changes again.

To upgrade, follow the Upgrading process. The upgrade script is required. There are also language and theme changes.

If you require support for upgrading to 1.6.4, please see the 1.6 General Support Forum.

Changes in 1.6.4

We’ve made a handy reference guide to what’s changed in 1.6.4 in the Wiki. We’ll be doing this for each version in the future too so you can see what we’re working on.

View 1.6.4 Changes in the Wiki.

MyBB Merge System 1.6.1 Update

For those users who have been using Merge System 1.6.1 and earlier, there is an important security update ready for you.

You can read more about it in the 1.6.1 Update Blog Post.

Thank you,
MyBB Team

MyBB 1.6.3 and 1.4.16 Security Update

Posted on by

MyBB 1.6.3 and 1.4.16 are now available to download. They fix 1 high risk vulnerability and 1 low risk vulnerability. We recommend everyone upgrades to this release immediately or patch their boards with the manual patching instructions below.

Thanks to Charlie Somerville and thebod for discovering them. These vulnerabilities are:

In addition to the vulnerabilities, the updates also fix the following issues:

All other outstanding issues will be resolved in the next maintainence release.

For MyBB 1.6

The update to MyBB 1.6.3 also upgrades the Prototype and Scriptaculous javascript libraries to their latest versions. This is to help your MyBB forum work properly with Internet Explorer 9.

MyBB 1.6.2 to 1.6.3 Patch
This patch is only for those users running MyBB 1.6.2. If you’re running an older version of MyBB then please download the full version and update to it.

For help upgrading, see the MyBB Wiki: Upgrading.

Please download the attached ZIP archive below and replace the files in your forum directory with those from the ZIP archive.

1.6.3 changed files

You are required to run the upgrader for 1.6.3. After replacing the files above, remove the ‘lock’ file located in forum_root/install/, then visit forum_root/install/upgrade.php and follow the instructions (where forum_root is the web address for your forum). Remember to backup your forum’s files and database before performing this upgrade.

Once the upgrade has completed, visit the Templates & Style area of your ACP – click on Templates on the left and go to the “Find Updated Templates”. Revise and amend all affected templates here, paying attention to headerinclude, index_boardstats and forumdisplay_threadlist.

If you wish to manually patch your board please download “1.6.3 patches” and follow the instructions in that file. You are also required to amend templates to ensure functionality for your board. For this, please download “1.6.3 template patches” and follow the instructions – you must do these for all custom themes you have installed.

1.6.3 patches
1.6.3 template patches

Please remember that applying patches should only be a temporary measure until you can fully upgrade your board. The upgrader is required to run to allow the default templates to be updated with the new security fixes.

Changed Files since 1.6.2

  • inc
    • class_core.php
    • functions_search.php
  • install
    • resources
      • mysql_db_tables.php
      • mybb_theme.xml
      • upgrade12.php
      • upgrade17.php
      • upgrade19.php
      • upgrade3.php
      • upgrade5.php
    • upgrade.php
  • jscripts
    • controls.js
    • dragdrop.js
    • effects.js
    • general.js
    • prototype.js
    • scriptaculous.js
    • slider.js
    • thread.js
  • forumdisplay.php
  • index.php
  • misc.php
  • showthread.php

* Red represents files that contain security updates
* Green represents new files added in this release

For MyBB 1.4

For MySQL 5.5 compatibility and IE9 javascript fixes, please upgrade to MyBB 1.6.3. Support for MyBB 1.4 will be ending on 1st July 2011, after which there will be no more security updates for the 1.4 series.

1.4.15 to 1.4.16 Patches
This patch is only for those users running MyBB 1.4.15. If you’re running an older version of MyBB 1.4, and don’t want to upgrade to 1.6 just yet, then please the latest version of MyBB 1.4 from the MyBB Wiki: Versions.

For help upgrading, see the MyBB Wiki: Upgrading.

Please download the attached ZIP archive below and replace the files in your forum directory with those from the ZIP archive.

1.4.15 changed files

You are required to run the upgrader for 1.4.16. After replacing the files above, remove the ‘lock’ file located in forum_root/install/, then visit forum_root/install/upgrade.php and follow the instructions (where forum_root is the web address for your forum). Remember to backup your forum’s files and database before performing this upgrade.

Once the upgrade has completed, visit the Templates & Style area of your ACP – click on Templates on the left and go to the “Find Updated Templates”. Revise and amend all affected templates here, paying attention to headerinclude, index_boardstats and forumdisplay_threadlist.

If you wish to manually patch your board please download “1.4.16 patches” and follow the instructions in that file. You are also required to amend templates to ensure functionality for your board. For this, please download “1.4.16 template patches” and follow the instructions – you must do these for all custom themes you have installed.

1.4.15 patches
1.4.15 template patches

Please remember that applying patches should only be a temporary measure until you can fully upgrade your board. The upgrader is required to run to allow the default templates to be updated with the new security fixes.

Changed Files since 1.4.15

  • inc
    • class_core.php
    • functions_search.php
  • install
    • resources
      • mybb_theme.xml
    • upgrade.php
  • jscripts
    • general.js
  • forumdisplay.php
  • index.php
  • misc.php
  • showthread.php

* Red represents files that contain security updates
* Green represents new files added in this release

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

Thank you,
MyBB Team

MyBB 1.6.2 and 1.4.15 – Security Update

Posted on by

MyBB 1.6.2 is a security update to the 1.6 series. It fixes 2 medium risk security vulnerabilities and one low risk issue. We recommend everybody upgrades to this release as soon as possible – or patch their boards with the manual instructions below.

MyBB 1.4.15 is also a security update to the 1.4 series which is affected by the same vulnerabilities.

Thank you to MustLive (Websecurity), MattRogowski and Max Roth for alerting us of these issues.

What’s fixed in this version?

The medium-risk issue reported by Max Roth requires HTML in posts to be enabled in a forum. This issue was fixed as part of Issue #1422. Even if you don’t have HTML enabled in posts, it is still recommended to update to resolve this issue.

MyBB 1.6.1 to MyBB 1.6.2 Patch

This patch is only for users running MyBB 1.6.1. If you are running an older version of MyBB then please download MyBB 1.6.2 from the MyBB site and update to it.

Please download the attached ZIP archive and replace the files in your forum directory with those from the ZIP archive.
This update does not require running the upgrader.

The following files have changed since the initial 1.6.1 release:

  • admin
    • modules
      • tools
        • modlog.php
  • inc
    • class_core.php
    • class_parser.php
  • jscripts
    • validator.js
  • member.php
  • modcp.php
  • xmlhttp.php

* Red represents files that contain security updates
* Green represents new files added in this release

changed_files_1602.zip

If you wish to manually patch your board please download “mybb_1601_patches.txt” and follow the instructions in that file.

mybb_1601_patches.txt

MyBB 1.4.14 to MyBB 1.4.15 Patch

This patch is only for users running MyBB 1.4.14 who have updated their forum when 1.6.1 and 1.4.14 Update was released. If you have not made these updates or are unsure whether you have – and you don’t want to upgrade to 1.6 – then please download 1.4.15 from the MyBB site and update to it.

mybb_1414_patches.txt

To ensure users of the 1.4 series have all the recent security updates the following changed files package contains updates since 1.4.13. The changes to files are mentioned below. If you are still using the 1.4 series, then please make sure that all these files have been updated to keep your forum secure (either by updating to 1.4.15, uploading the changed files package, finding differences using a file difference tool or patches from blog posts).

It is heavily recommended that you upgrade to 1.6.

  • admin
    • modules
      • tools
        • modlog.php
  • inc
    • datahandlers
      • post.php
    • class_core.php
    • class_parser.php
    • functions.php
    • functions_search.php
  • jscripts
    • validator.js
  • attachment.php
  • editpost.php
  • forumdisplay.php
  • member.php
  • modcp.php
  • newreply.php
  • syndication.php
  • xmlhttp.php

* Red represents files that contain security updates
* Green represents new files added in this release

changed_files_1415.zip

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

Thank you,
MyBB Team

MyBB 1.6 Released

Posted on by

Today marks the 2 year anniversary since MyBB 1.4 was released. It is an honor to announce that today, we are releasing MyBB 1.6 Gold to the general public and that it is now available directly on the MyBB website.

MyBB 1.6 may be one small step for forum software, but it is one giant leap for MyBB. There are over 40 new features that have been built in to MyBB and countless tweaks, fixes, and performance optimizations since MyBB 1.4.

We’ve also updated the MyBB website to contain a feature tour of what is available in MyBB 1.6: http://www.mybb.com/features.

We recommend that all users upgrade to 1.6 so they can take advantage of the great new features in MyBB 1.6, but we recommend you plan your upgrade first. More information on upgrading and changes to templates, themes, plugins and languages can be found below.

Personally I’d also like to thank this community, for your everlasting support and for all of you who have been with us every step of the way. You’ve made this happen; MyBB is your forum software. Above all, I would like to thank every single team member who has made this journey with us. My debt to you is beyond measure. Thank you so much for the time, sweat, and effort you’ve given to this project and community. We are all grateful to you.

Ryan Gordon
MyBB Lead Developer

Upgrading from previous versions

You can update your copy of MyBB to 1.6 if you’re running MyBB 1.0 RC2 or onwards (which you should already be).

Be warned that with the following release:

  • Custom templates will need to be updated for this release via the “Find Updated Templates” tool in the MyBB 1.6 Administration Control Panel.
  • Most plugins and code modifications will need to be updated to work with MyBB 1.6. Make sure you disable your plugins before upgrading and make sure updated copies compatible with MyBB 1.6 are available.
  • Custom language packs from earlier versions will need to be updated as well.

Before you attempt to upgrade, ensure you have a database backup and a copy of the files currently in use on your board. This is so you can revert back to your earlier version if you need to or something goes horribly wrong with the upgrade process.

This is a moderately long upgrade process. Please make sure you don’t refresh pages whilst they’re loading, and don’t click the “Next” button more than once (if you don’t have JavaScript enabled). You should plan your upgrade before attempting to perform it.

Follow the general [Wiki: Upgrading] guide outlined on the MyBB Wiki to complete the upgrade process.

License

MyBB 1.6 is now distributed under the GNU LGPLv3 license. The only major difference between this license and the GNU GPLv3 license that MyBB has been licensed under since MyBB 1.4.2, is the ability for plugin and theme authors to have more freedom in the license they choose to distribute their work under.

To the average user, this change does not affect the way you use MyBB or run your forums. You do not need to change anything, you just need to make sure you comply with the terms and conditions set out via the GNU LGPL – which if you meet our current license agreement, you already do.

Theme and template changes

Several updates have been added to the theme which give you more control over the stylesheet and appearance of your forum and the new features. For this reason, your theme is updated to work with MyBB 1.6 during the upgrade process.

The same applies with templates; you’ll need to use the “Find Updated Templates” on any custom templates to update them due to the fact that many of them have been updated.

Language packs

Language packs also need to be updated as there are many changes in the language files. This includes addition of language strings and improving or updating of some current language strings.

Before you attempt to use any language pack with MyBB 1.6 you’ll need to ensure it has been updated accordingly to the changes made in the release.

Plugins

Most plugins can be updated with minimal changes. In most cases the version compatibility indicator can be updated safely within the plugin and it will work with MyBB 1.6 without further change. However, some plugins may require more extensive changes.

If you require assistance making your modification or theme compatible with MyBB 1.6 then please post in the appropriate code modifications or Template & Theme forum on http://community.mybb.com/

As of the release of 1.6, there are several plugins and themes immediately available for download from the MyBB Mods site and many more to come soon.

MyBB Merge System

As of this MyBB 1.6 release, a version of the MyBB Merge System compatible with MyBB 1.6 has been released on the MyBB website to the general public.

MyBB 1.4.14 Released – Maintenance Release

Posted on by

MyBB 1.4.14 is now available on the MyBB website and is a general maintenance release.

This release fixes a few reported issues with version released since 1.4.13 causing some incorrect functionality of MyBB. These bugs have been fixed to provide a more stable version of MyBB for public use. This will be the last maintenance release to the MyBB 1.4 series.

What’s added/changed in this version?

  • MyBB 1.4.14 is now fully compatible with PHP 5.3.
  • Attachment management now properly checks for the post key.

This release has been tested by our Software Quality Assurance group.

Information on upgrading, template changes and language changes can be found in the posts below.

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.

Upgrading from the 1.4 series

When upgrading from 1.4.13, you will not lose any custom themes, plugins or language packs which you may have installed.

Follow the general [Wiki: Upgrading] guide outlined on the MyBB Wiki to complete the upgrade process. You may download a ZIP archive of changed files here:

changed_files_1414.zip

You must then check for modified templates using the instructions below.

Upgrading from other versions

If you are upgrading from a version earlier than 1.2 then you will lose your custom themes, templates and language packs due to the number of changes between your version and the 1.2 series.

Before you attempt to upgrade, ensure you have a database backup and a copy of the files currently in use on your board. This is so you can revert back to your earlier version if you need to or something goes horribly wrong with the upgrade process.

Follow the general [Wiki: Upgrading] guide outlined on the MyBB Wiki to complete the upgrade process.

Changed files since MyBB 1.4.13

  • editpost.php
  • newreply.php
  • newthread.php
  • admin
    • modules
      • home
        • version_check.php
      • config
        • plugins.php
  • install
    • index.php
    • upgrade.php
    • resources
      • upgrade16.php
  • inc
    • class_core.php
    • init.php
    • function_serverstats.php
    • languages
      • english.php

* Red represents files that contain security updates
* Green represents new files added in this release

Bugs fixed since MyBB 1.4.13

  • #180 – PHP 5.3/6.0 Changes & Support
  • #630 – PHP 5.1+ generates “date_default_timezone_set” warning on every page
  • #959 – Magic Quotes Check
  • #1077 – Post key not checked for attachment management

Theme and template changes

There have been no template changes in this release.

Language file changes

There have been no language file changes in this release.

Plugins

All of your MyBB 1.4.x plugins will work correctly with 1.4.14 without any updates.

MyBB 1.6 Beta Released

Posted on by

The MyBB Group is proud to release the first public beta of MyBB 1.6.  There are over 48 new features some of which we have featured in two of our previous blog postings (sneak previews: part 1, part 2).  In addition, there are a number of improvements and bug fixes.

MyBB 1.6 aims to provide a number of fresh new features to the 1.4.x code base.  We had backward compatibility in mind, and so most themes and modifications designed for 1.4.x should work with 1.6 with minimal changes.

Beta software

As this is still beta software, we expect there are going to be bugs, anomalies and other related issues.  Please report any bugs in our development tracker, with all the information you may find relevant (error verbatim, reproduction procedure, server software, browser, etc), and please search before posting.  At this time we do not recommend running this on a production forum.  It is highly recommended that you create backups of your files and database before attempting to use MyBB 1.6.

Support

The support team will be providing limited official support for the beta software. Our concentration for support will still be on our stable series, 1.4.x, so please be patient.  As usual, we can only provide support for assistance in using MyBB’s features.  We cannot provide support for customizations including plugins, modifications, and themes.

Download and further information

The MyBB 1.6 Beta can be downloaded here.  Please read our 1.6 FAQ as well.

MyBB 1.4.13 Released – Security Patches to MyBB 1.4.12

Posted on by

MyBB 1.4.13 is now available on the MyBB website and is a patch to MyBB 1.4.12 which introduced two regressions related to the security updates in MyBB 1.4.12.

This release is to ensure that all users on 1.4.12 have the proper security patches applied to their forum.

Thank you to Pirata Nervo and Labrocca for alerting us of these issues and to Stefan Esser for assisting us in a patch for Issue #843.

What’s fixed in this version?

This update does not require running the upgrader.
There are no database schema, language string, or template changes in this version.

MyBB 1.4.12 to MyBB 1.4.13 Patch

This patch is only for users running MyBB 1.4.12. If you are running an older version of MyBB then please download MyBB 1.4.13 from the MyBB site and update to it using the general [Wiki: Upgrading] guide.

Please download the attached ZIP archive and replace the files in your forum directory with those from the ZIP archive.
changed_files_1413.zip

Alternatively, if you are running MyBB 1.4.11, you may follow the “MyBB 1.4.11 to MyBB 1.4.12 Patch” instructions in the MyBB 1.4.12 announcement and then apply the MyBB 1.4.12 to MyBB 1.4.13 patch above.

The following files were changed since the initial MyBB 1.4.12 release:

  • inc
    • datahandlers
      • post.php
    • functions.php
    • class_core.php

* Red represents files that contain security updates
* Green represents new files added in this release

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

MyBB 1.2.14 Patch

All users of the 1.2.x series are urged to upgrade to the latest release of MyBB. (1.4.13) MyBB 1.2 is no longer being supported and security updates for the MyBB 1.2 series ceased as of January 1, 2010.

Thank you,
MyBB Team

MyBB 1.4.12 Released – Security & Maintenance Update

Posted on by

MyBB 1.4.12 is now available on the MyBB website and is a security and maintenance update to MyBB 1.4.11. This will be the last maintenance release of the MyBB 1.4 series. We will still continue to provide security updates for the MyBB 1.4 series.

This release is to ensure that all users on 1.4.11 have the latest fixes, and to patch two medium-risk security issues and a low risk security issue within MyBB.

Thank you to Stefan Esser and Labrocca for alerting us of these issues.

What’s fixed in this version?

  • #309 – Direct access of some files generates PHP errors
  • #374 – editpost editpost_start hook run twice
  • #466 – Last post date after custom merge
  • #556 – Wrong additional groups in ACP
  • #565 – Custom view in browse users error
  • #575 – Redundant Code in inc/class_parser.php
  • #583 – UTF8-conversion fails with PostgreSQL
  • #586 – Posts after updating the attachments of drafts
  • #592 – Forum subrscription displaying always the wrong image
  • #593 – Image upload
  • #594 – portal_pms template not getting cached
  • #597 – $yearsel not defined
  • #598 – Split thread – post icon
  • #604 – Make private event public
  • #606 – Server Statistics – Hostname and hosturl not working
  • #609 – Wrong first day of week in week view
  • #613 – Error is invalid smilie path is used
  • #618 – Alternating trows on profile page
  • #621 – global_pm_alert template typo dismis_notice
  • #622 – Reputation by a deleted user
  • #623 – Upgrade 1.1.18 -> 1.4.11
  • #627 – private_nomessages template not getting cached
  • #632 – Settings not selected if error appears
  • #634 – firstpost of copied thread set to 0
  • #643 – Missing field when fetching latest announcements into portal page
  • #647 – function generate_thumbnail generates warning
  • #650 – Status Icon of Forum not shown on Forum Subscription List
  • #660 – forumdisplay_rules not cached
  • #662 – member.php and $referrals
  • #672 – threadviews task won’t disable from settings change
  • #673 – Typo in member.lang.php $l[‘hide_dob’]
  • #678 – Hard-coded language string in /admin/modules/style/templates.php
  • #684 – Typo in postbit when ignoring users
  • #685 – Akismet “unmark” does not reduce number of “akismetstopped” field.
  • #688 – Old avatars are not deleted
  • #689 – Usercp.php + Modcp.php – XHTML 1.0 Problem ($bdaymonthsel)
  • #703 – Mass Mail Auto Generated Text Version
  • #716 – Error reads “[WRITE] Unable to slave database”, should be select
  • #720 – UTF8 conversion causes mysql error on blob/text fields
  • #722 – Group Join Requests From Guests
  • #727 – Converting a forum with threads to a category should be disallowed
  • #728 – Post Edit bypasses max. [img] MyCodes per Post
  • #749 – Portal “Since then, there have been:” counts unapproved threads and drafts
  • #750 – Theme importing ignored error
  • #759 – Stars are shown on user profile even if they are set to 0 for the group
  • #764 – attachment MyCode isn’t parsed in feeds
  • #774 – mysqli_pconnect function not exists
  • #778 – db reconstruction in inc/functions.php $config check fails
  • #791 – Ratings column of forum display ignores group settings
  • #794 – Badwords preg_quote fix
  • #802 – Stars are shown in Postbit even if they are set to zero and no image is linked
  • #809 – Unviewable threads showing on portal
  • #810 – Portal post shows smilies even when set not to in post
  • #812 – allow [img] in posts depends on MyCode being allowed
  • #816 – Duplicate htmlspecialchar in inc/functions_online.php
  • #821 – syndication.php errors
  • #822 – Use of $_POST in ./xmlhttp.php
  • #835 – MyBB, dl(), and PHP 5.3.x – no dl() in many 5.3.x releases
  • #836 – Debug code left in inc/class_mailhandler.php
  • #843 – Improvements to PHP’s mt_rand RNG seeding
  • #849 – We can set date of birth as future date
  • #852 – CSRF issue in usercp2.php
  • #862 – Rebuilding Attachment Thumbnails Plugin Hook Name
  • #870 – Missing warning messages
  • #871 – Datahandler merge ignores updating post message variable

This release has been tested by our Software Quality Assurance group.

This update does require running the upgrader.
There are database schema, language string, or template changes in this version.

MyBB 1.4.11 to MyBB 1.4.12 Patch

This patch is only for users running MyBB 1.4.11. If you are running an older version of MyBB then please download MyBB 1.4.12 from the MyBB site and update to it using the general [Wiki: Upgrading] guide.

Please download the attached ZIP archive and replace the files in your forum directory with those from the ZIP archive.
changed_files_1412.zip

A manual patch file is not being offered for this release due to the multitude of changes required to implement the security fix. We apologize for any inconvenience this causes.

The following files were changed since the initial MyBB 1.4.11 release:

  • announcements.php
  • calendar.php
  • captcha.php
  • editpost.php
  • forumdisplay.php
  • managegroup.php
  • member.php
  • modcp.php
  • newreply.php
  • newthread.php
  • portal.php
  • private.php
  • reputation.php
  • showthread.php
  • syndication.php
  • usercp.php
  • usercp2.php
  • xmlhttp.php
  • jscripts
    • inline_moderation.js
  • install
    • resources
      • mybb_theme.xml
      • upgrade16.php
  • admin
    • index.php
    • modules
      • forum
        • management.php
      • user
        • mass_mail.php
        • users.php
      • config
        • mod_tools.php
        • settings.php
        • smilies.php
      • tools
        • recount_rebuild.php
        • system_health.php
      • style
        • templates.php
        • themes.php
  • inc
    • class_core.php
    • class_custommoderation.php
    • class_mailhandler.php
    • class_moderation.php
    • class_parser.php
    • db_mysqli.php
    • functions.php
    • functions_image.php
    • functions_online.php
    • functions_serverstats.php
    • functions_upload.php
    • functions_user.php
    • init.php
    • plugins
      • akismet.php
    • languages
      • english
        • global.lang.php
        • member.lang.php
        • messages.lang.php
        • warnings.lang.php
        • admin
          • forum_management.lang.php
          • user_groups.lang.php
    • datahandlers
      • post.php
      • user.php
    • cachehandlers
      • eaccelerator.php
      • memcache.php
      • xcache.php

* Red represents files that contain security updates
* Green represents new files added in this release

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

MyBB 1.2.14 Patch

All users of the 1.2.x series are urged to upgrade to the latest release of MyBB. (1.4.12) MyBB 1.2 is no longer being supported and security updates for the MyBB 1.2 series ceased as of January 1, 2010.

Thank you,
MyBB Team

Important Update: April 16, 2010

If you applied the MyBB 1.4.12 update before April 16, 2010 7:00 UTC we recommend you redownload the changed file package and reupdate the inc/functions.php file to your forum. The change fixes an issue identified in the previous hot patch relating to the random number generator. We are sincerely sorry for the inconvenience caused by this.

Thank you for your cooperation.

MyBB 1.4.11 Released – Minor Patch & Security Update

Posted on by

MyBB 1.4.11 is now available on the MyBB website and is a minor patch update to 1.4.10.

This release is to ensure that all users on 1.4.10 have the latest patches, to fix a small and rare bug that with malicious intent can be used to assist a Denial-of-Service attack, and to patch a low security issue that can allow a user to check for file existence outside of the web root.

Thank you to Labrocca and Secunia (through a third party) for alerting us of these issues.

What’s fixed in this version?

This release has been tested by our Software Quality Assurance group.

This update does not require running the upgrader.
There are no database schema, language string, or template changes in this version.

MyBB 1.4.10 to MyBB 1.4.11 Patch

This patch is only for users running MyBB 1.4.10. If you are running an older version of MyBB then please download MyBB 1.4.11 from the MyBB site and update to it using the general [Wiki: Upgrading] guide.

Please download the attached ZIP archive and replace the files in your forum directory with those from the ZIP archive.
changed_files_1411.zip

If you wish to manually patch your board please download “mybb_1410_patches.txt” and follow the instructions in that file.
mybb_1410_patches.txt

The manual patch set instructions only fixes the security vulnerabilities and is only made available to temporarily secure your forum until you have time to run the complete upgrade.

The following files were changed since the initial MyBB 1.4.10 release:

  • admin
    • modules
      • style
        • templates.php
      • tools
        • backupdb.php
      • user
        • users.php
  • inc
    • datahandlers
      • event.php
      • user.php
    • class_core.php
    • class_error.php
    • class_moderation.php
    • functions_upload.php
    • functions_time.php
    • tasks
      • backupdb.php
  • calendar.php
  • usercp.php

* Red represents files that contain security updates
* Green represents new files added in this release

Reporting MyBB security vulnerabilities

If you think you’ve found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we’ve had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

MyBB 1.2.14 Patch

Please follow step #1 in the mybb_1410_patches.txt file as listed above.

Please note all users of the 1.2.x series are urged to upgrade to the latest release of MyBB. (1.4.11) MyBB 1.2 is no longer being supported and security updates for the MyBB 1.2 series will only last through December 2009.

Thank you,
MyBB Team