[新聞] phpBB3 RC 釋出 (Update RC7)
發表於 : 2007-10-15 08:56
http://www.phpbb.com/community/viewtopi ... 4&t=585093
這一次 phpBB Group 使用了 SektionEins 的外部安全稽核，因此以下標為「安全相關」的問題皆是經由這個公司所找出來的
RC5 => RC7 的重大改變
[修正] Further fixing user profile view (please do not forget to update/refresh your template and style) (Bug #14230)
[修正] Adjust google adsense bot information (Bug #14296)
[修正] Fix horizontal scrollbar problem in IE6 (Bug #14228) - fix provided by Danny-dev
[修正] Correctly set user style for guest user (able to be changed within user management)
[修正] Do not use register_shutdown_function within cron.php if handling the queue and the mail function being used (Bug #14321)
[修正] Fixing private message on-hold code if moving messages into folder based on rules (Bug #14309)
[修正] Allow the merge selection screen to work (Bug #14363)
[修正] Local magic URLs no longer get an additional trailing slash (Bug #14362)
[修正] Do not let the cron script stale for one hour if register_shutdown_function is not able to be called (Bug #14436)
[修正] Fixed token handling in jabber class for extremely spec-compliant XMPP server (Bug #14445)
[修正] Use correct dimension (width x height) in ACP (Bug #14452)
[修正] Fixing google cache display problems with Firefox (Bug #14472) - patch provided by Raimon
[改變] Moved note about dns_get_record function for using GTalk (Jabber) from Jabber log to Jabber ACP panel
[改變] Require additional permissions for copying permission when editing forums
[改變] Listing the board url within the email text instead of appending it to the subject (Bug #14378)
[改變] Allow years in future be selected for date custom profile field (Bug #14519)
[新功能] Added /includes/db/db_tools.php file, which includes tools for handling cross-db actions such as altering columns, etc.
[新功能] Added completely new hook system to allow better application/mod integration - see docs/hook_system.html
[新功能] Added an option to enforce that users spend a configurable amount of time on the terms page during registration
[安全相關] Fixing possible XSS through compromised WHOIS server (#i63, #i64)
[安全相關] Missing access control on whois in viewonline.php (#i51)
[安全相關] Encoding some variables within user::page array correctly (to cope with browser not doing it correctly) to prevent XSS through functions re-using them (#i61)
[安全相關] Fixed XSS through memberlist search feature (#i62)
[安全相關] Fixed XSS through colour swatch (#i65)
[安全相關] Fixed insecure attachment deletion (#i53)
[安全相關] Only allow whitelisted protocols in meta_redirect/redirect (#i66)
[安全相關] Check file names to be written in language management panel (#i52)
[安全相關] Deregister globals if ini_get has been disabled (#i112)
[安全相關] Added form tokens to most forms to enforce a lighter variant of CSRF protection (#i91 - #i96)
[安全相關] Use new password hash method for forum passwords (#i43)
[安全相關] Changed download file location to prevent flash crossdomain policies taking effect (#i8)
[安全相關] Do not allow autocompletion for password on admin re-authentication (#i41)
[安全相關] Made sure users are not completely locked out if they have a GLOBALS cookie (#i101)
[安全相關] Use the secure hash to generate BBCODE_UIDs (#i71)
[安全相關] Increase the length of BBCODE_UIDs (#i72)
[安全相關] New password hashing mechanism for storing passwords (#i42)
下載：http://www.phpbb.com/downloads/
~Mac
這一次 phpBB Group 使用了 SektionEins 的外部安全稽核，因此以下標為「安全相關」的問題皆是經由這個公司所找出來的
RC5 => RC7 的重大改變
[修正] Further fixing user profile view (please do not forget to update/refresh your template and style) (Bug #14230)
[修正] Adjust google adsense bot information (Bug #14296)
[修正] Fix horizontal scrollbar problem in IE6 (Bug #14228) - fix provided by Danny-dev
[修正] Correctly set user style for guest user (able to be changed within user management)
[修正] Do not use register_shutdown_function within cron.php if handling the queue and the mail function being used (Bug #14321)
[修正] Fixing private message on-hold code if moving messages into folder based on rules (Bug #14309)
[修正] Allow the merge selection screen to work (Bug #14363)
[修正] Local magic URLs no longer get an additional trailing slash (Bug #14362)
[修正] Do not let the cron script stale for one hour if register_shutdown_function is not able to be called (Bug #14436)
[修正] Fixed token handling in jabber class for extremely spec-compliant XMPP server (Bug #14445)
[修正] Use correct dimension (width x height) in ACP (Bug #14452)
[修正] Fixing google cache display problems with Firefox (Bug #14472) - patch provided by Raimon
[改變] Moved note about dns_get_record function for using GTalk (Jabber) from Jabber log to Jabber ACP panel
[改變] Require additional permissions for copying permission when editing forums
[改變] Listing the board url within the email text instead of appending it to the subject (Bug #14378)
[改變] Allow years in future be selected for date custom profile field (Bug #14519)
[新功能] Added /includes/db/db_tools.php file, which includes tools for handling cross-db actions such as altering columns, etc.
[新功能] Added completely new hook system to allow better application/mod integration - see docs/hook_system.html
[新功能] Added an option to enforce that users spend a configurable amount of time on the terms page during registration
[安全相關] Fixing possible XSS through compromised WHOIS server (#i63, #i64)
[安全相關] Missing access control on whois in viewonline.php (#i51)
[安全相關] Encoding some variables within user::page array correctly (to cope with browser not doing it correctly) to prevent XSS through functions re-using them (#i61)
[安全相關] Fixed XSS through memberlist search feature (#i62)
[安全相關] Fixed XSS through colour swatch (#i65)
[安全相關] Fixed insecure attachment deletion (#i53)
[安全相關] Only allow whitelisted protocols in meta_redirect/redirect (#i66)
[安全相關] Check file names to be written in language management panel (#i52)
[安全相關] Deregister globals if ini_get has been disabled (#i112)
[安全相關] Added form tokens to most forms to enforce a lighter variant of CSRF protection (#i91 - #i96)
[安全相關] Use new password hash method for forum passwords (#i43)
[安全相關] Changed download file location to prevent flash crossdomain policies taking effect (#i8)
[安全相關] Do not allow autocompletion for password on admin re-authentication (#i41)
[安全相關] Made sure users are not completely locked out if they have a GLOBALS cookie (#i101)
[安全相關] Use the secure hash to generate BBCODE_UIDs (#i71)
[安全相關] Increase the length of BBCODE_UIDs (#i72)
[安全相關] New password hashing mechanism for storing passwords (#i42)
下載：http://www.phpbb.com/downloads/
~Mac