phpBB 2.0.2 :: Changelog

| phpBB 2.0.3 CHANGELOG

1. Changelog

1. Changes since 2.0.2
2. Changes since 2.0.1
3. Changes since 2.0.0
4. Changes since RC-4
5. Changes since RC-3
6. Changes since RC-2
7. Changes since RC-1
8. Changes since RC-1 (pre)

2. Disclaimer

## 1. Changelog

This is a non-exhaustive (but still near complete) changelog for phpBB 2.0.x including beta and release candidate versions.

### 1.i. Changes since 2.0.2

- Fixed potential cross-site scripting vulnerability with avatars - Showscout
- Fixed potential SQL rewrite issue in page header - missing contrib
- Fixed potential CSS/HTML rewrite on viewing in login - Marc Rees
- Fixed (hopefully) issue with MS Access and multiple pages

### 1.ii. Changes since 2.0.1

- Fixed missing "username" lang variable in user admin template
- Session work around for users behind rotating IPs - vHiker
- Fixed potential session user_id re-write - Ashe
- Fixed potential cross-browser scripting issue with BBCode URLs
- Fixed potential gallery avatar exploit - Ashe
- Fix sorting of smileys on each function call - Ashe/psoTFX
- Clear topic_mod text output in viewtopic - Lars
- Fix regex for avatar remote urls
- Fix non-updating of user post counts when deleting whole topics
- Increase time limit when sending topic reply notifications
- Set default forum when splitting topics
- Fix non-deletion of uploaded avatars when switching to gallery
- Removed various closing newlines from included files
- Add MAX_ROWS to HEAP table alter in install/upgrade - Ashe
- Update username maxlength for subSilver templates
- Allow ( and ) in BBCode [url] tags
- Fix non-quoting of # in username validation regexs
- Fix overlooked global var in private messaging
- Possible fix for \r\n email templates issues
- Fix missing str_replace for category title forum admin SQL
- Fix trailing , when sending emails via smtp
- Fix avatar issues in user admin
- Fix improper checking of email address ban in sessions
- Fix use of hard coded language strings in forum admin
- Fix missing closing ) in smilies admin
- Fix missing Username label in user admin
- Fix upgrade.php bug where conversion would not complete (and updated other scripts to match the changes)
- Fix problem with redirect and login.php
- Fix typo that could cause problems with sorting in the memberlist
- Fix emailer to allow sending emails with language-specific character sets

### 1.iii. Changes since 2.0.0

- Fixed delete image bug for normal users
- Fixed group control panel image links
- Fixed missing L_POST variable in group control panel
- Fixed missing user id when redirecting to email form after login
- Fixed (a)ppend_sid function name error in group control panel
- Fixed reset of post type when previewing a post
- Fixed mass emailer include path error
- Fixed potential SQL exploit
- Fixed several minor subSilver issues
- Fixed [quote] breaking HTML problem
- Fixed problem with unclosed nested quotes
- Fixed bad handling of automagic links at end of quotes
- Fixed potential BBCode and avatar remote exploit
- Altered email validation check to allow + in username as per RFC
- Fixed incorrect behaviour with wildcards in disallowed usernames
- Added missing append_sid for search view results as posts
- Fixed incorrect clearing of current sessions for logged in users
- Fixed user_timezone (cannot update user profile) problem
- Added correct setting of moderator status for users during upgrade
- Fixed handling of uploaded avatars if gallery avatar currently used
- Fixed use of existing username for uploaded avatars
- Fixed updating of topic reply stats when post is deleted
- Fixed irrelevant error message when activating already active account
- Fixed gzip compression problems with Netscape and some PHP versions
- Fixed MS Access layer errors when using latest PHP versions
- Fixed styles admin editing problems with MSSQL Server
- Fixed logout issue when cancelling certain actions
- Fixed missing text in certain admin links
- Fixed opening of frame within frame when logging into admin
- Fixed incorrect ordering of search results by time
- Fixed fulltext searching failure with MS Access
- Hopefully fixed fulltext search with non-latin single byte charsets
- Enabled work-around support for some multi-byte charsets - OOHOO
- Re-enabled search indexing of all-numeric character sequences
- Updated email banning to properly implement wildcards
- Fixed missing extension in links from groupcp
- Fixed lack of re-validation when changing email address
- Added additional IP check when using HTTP_X_FORWARDED_FOR
- Fixed non-display of delete icon when on second or greater topic page
- Fixed problems with users/groups assigned multiple permissions
- Fixed problem with - and + in search words - Matthijs
- Fixed improper handling for deletion of words from search table
- Fixed support for , in automagic URLs as per RFC
- Fixed circular reference SQL errors when deleting posts under MS Access
- Fixed nested [code] problems
- Added charset encoding headers for emails - romutis
- Fixed "Copy to self" emails to use correct language
- Fixed pagination error when limiting previous days for viewforum
- Decreased minimum search word size to 3 chars
- Fixed deletion of one or more options from all polls when editing just one
- Fixed checking of group memberships when promoting/demoting group moderators
- Added database closure to admin frameset page

### 1.iv. Changes since RC-4

- Fixed improper report of general error when posting messages containing errors
- Fixed post text being doubled up if it contained one or more < without closing >
- Fixed pruning errors due to search function name change
- Hopefully fixed various issues which led to incorrect reply and excess page counts
- Fixed groupcp not displaying all email buttons to group moderator or admin
- Fixed failure to display error notice when uploading oversized avatars
- Hopefully corrected problem with viewonline displaying too few/many users online
- Partially addressed issue with activation URLs >76 chars
- Fixed additional search facilities failing to work or working incorrectly
- Fixed search syntax highlighting
- Addressed various webservers handling of page redirects
- Fixed word censor not replacing first or last words
- Fixed avatar height and width check for locally uploaded images
- Hopefully fixed cache control header
- Added check for PM box size limit of 0 to prevent div0 error
- Fixed failure to fully delete PMs in outbox
- Fixed display problem with polls
- Fixed problem with guest username not being displayed for topic results in search
- Fixed problem with quotes in various profile fields
- Fixed schema problem with user_timezone
- Fixed page display issue with MS Access
- Fixed user level issue when altering user from user to admin and vice versa
- Fixed incorrect parseing of some email templates
- Reduced size of MS Access primer
- Fixed various remaining usergroup display issues

### 1.v. Changes since RC-3

- Addressed serious security issue with included files
- Fixed non-use of database table prefix name during upgrade
- Split functions and profile into separate modules
- Fixed (hopefully) remaining issues with colourisation of moderator usernames
- Updated install to include entry of additional, required, information
- Fixed (hopefully) AOL incompatibilities
- Fixed non-display of moderators in index/viewforum
- Fixed group control panel 'no groups exist' problems
- Fix HTTP_X_FORWARDED_FOR spoofing possibility
- Fix ignoring of private range IP's in HTTP_X_FORWARDED_FOR
- Enable multiple wildcard email banning, eg. *name*@somewhere.tld
- Fix problems with posts being truncated if containing < and > characters
- Prevent URL, BBCode and most smiley parseing in [code][/code]
- Fix problems with use of certain reserved chars in word censor list
- Fix default search useage to be as described (was doing AND by default)
- Fix various avatar issues with profile, gallery and viewtopic
- Enable safe mode support for uploading avatars
- Fix broken modcp IP view issue
- Fix potential session_id re-write vulnerability
- Finish localisation of days and months (AM/PM are not and will not be localised in 2.0)
- Remove link to external subSilver stylesheet from default subSilver templates
- Handle TRANSACTIONS correctly in MySQL 3.x (by returning correct responses)
- Fix checkbox resetting problem while previewing posts
- Fix a login redirect issue
- Remove some additional unused fields during upgrade
- Fix (hopefully) remaining ICQ overlay issue with view profile in subSilver

### 1.vi. Changes since RC-2

- Fixed infamous install parse error
- Major update of posting and related search functions (fixing various issues and increasing speed)
- Fixed display of author and last poster names when both are different guest users
- Fixed upgrade stall issues (hopefully!) and improved output
- Fixed highlighting code for viewtopic and search
- Reduced size of several files and functions
- Moved localised images to sub-directories
- Improved user feedback of disallowed usernames
- Fixed various MSSQL bugs
- Fixed installation of MSSQL/MSSQL-ODBC
- Fixed security issue with upgrade.php
- Finished implemention of various additional features
- Fixed various user, group and forum permissions problems
- Fixed issues with BBCode [ and ] (hopefully!)
- Fixed autologin problems with MS IIS
- Hopefully fixed problems with URIs in emails on some server configs
- Fixed 'blank' profile and DB utilities problems on submit
- Fixed incorrect language being used in email subjects
- Fixed issues with incorrect private message new/unread counts
- Fixed various PostgreSQL related errors
- Automatically forward users to login screen in more situations
- AEnabled (coloured) online indication of moderators and admins
- Enabled maximum online user count
- Altered online user count to ignore duplicate IPs (will now underestimate rather than overestimate)
- Enabled viewing of users browsing each forum
- Fixed (hopefully) display of overlayed ICQ icon in Netscape using subSilver
- Fixed display of guest usernames for last post and author
- Hidden usergroups are now completely hidden from view

### 1.vii. Changes since RC-1

- Fixed numerous PostgreSQL related issues
- Significant updates and additions to the upgrade script
- Various (missed) hard coded language strings fixed
- Fixed viewforum error when no forum id specified
- Fixed old constant name useage in search system
- Fixed display of moved posts when viewing unanswered posts
- Fixed failure of search for user and keyword when displaying as posts
- Fixed PM popup notification
- Fixed view more emoticon session page problem
- Fixed view profile email links
- Fixed display of websites in profile
- Fixed backup database failure
- Fixed MS Access schema error when posting topics
- Fixed problem with hypenated/dotted DB names in MySQL 3.23.6+
- Various other fixes and updates

### 1.viii. Changes since RC-1 (pre)

- Upgrade script completed for initial fully functional release
- Sessions code updated
- Mark read code updated and hopefully fixed
- Significant changes to properly deal with \' for non-MySQL boards
- mssql, msaccess and mssql-odbc DB classes re-written
- Avatar issues addressed and fixed
- Search (INSERT) bug using MySQL fixed
- Search highlighting issues addressed
- Search own/other users posts fixed
- BBCode fixes for magic URIs and other issues
- Template updates for subSilver
- User and group permissions problems fixed
- Forum management problems (deletion of forum causing category not to display) fixed
- Pagination problem with groupcp fixed
- Backslash issues with posting and profile fixed
- Backslash issues with emails fixed
- preg_quote problems fixed
- User management updated with full avatar control and missing fields
- Private messaging box limits fixed
- Private messaging ?folder= strangeness fixed
- Forum pruning code updated to cope with search system
- Emoticon system in posting updated
- BBCode FAQ link added to posting form
- Language file updates to address concerns of translators
- Various other bug fixes and updates

Note that a full list of fixed bugs can be found at the bug tracker (see section on bug reporting here)

## 2. Copyright and disclaimer

This application is opensource software released under the GPL. Please see source code and the Docs directory for more details. This package and its contents are Copyright © 2002 phpBB Group, All Rights Reserved.