| |
vBulletin 5.5.X (5.5.2, 5.5.3, and 5.5.4) Security Patch Level 2 |
A security update with respect to custom avatars has been made by vBulletin in the following security patch.
You can download the patch for your version in the Member's Area
We have made patches available for the following versions of vBulletin Connect:
5.5.4 Patch Level 2
5.5.3 Patch Level 2
5.5.2 Patch Level 2
Installing the Patch
Download the appropriate files for your version of vBulletin 5.5.X
Upload all files found within the zip file. Make sure to overwrite the existing files on your server.
Older Versions
If you are using a version of vBulletin 5 Connect prior to 5.5.2, it is imperative that you upgrade as soon as possible. For more information on upgrading please see Quick Overview: Upgrading vBulletin Connect in the support forums.
vBulletin Cloud
This security patch has already been applied to all vBulletin Cloud sites.
Read more (locally) ...
Fri, 04 Oct 2019 01:43:31 GMT |
vBulletin 5.5.5 Alpha 4 Available for Download |
vBulletin 5.5.5 Changes and Updates
A preview release of vBulletin 5.5.5 is now available for download. This version should be used for internal testing. We do not recommend using preview releases on a live site.
Front End Changes
New Landing Pages
We have added two new page layouts that users can select from when using Site Builder's Quick Setup. These new Home Pages allow you to change the focus of your site with a few clicks. They include:
Standard: This is the default home page and the same as the one used in previous vBulletin 5.X versions. This is a 70/30 layout with the Activity Stream, Statistics, and What's Going On located in the left column and various search modules in the Right Column. The activity stream defaults to the Forums tab.
Classic: Provides a home page similar to older versions of vBulletin. This layout only contains the Activity Stream, Statistics, and What's Going On module in a single full width column. The Activity Stream defaults to the Forums tab.
Community: An end user oriented Home Page. This includes a 30/70 layout. The left column includes the Channel Navigation Module, Friend's Activity, and Birthdays at 30% width. The Right column includes the Activity Stream, Statistics, and What's Going On module. The Activity Stream defaults to the Latest Activity tab in this view.
You can try these new pages out on your site by clicking on Quick Setup from the Site Builder menu and choosing the page you would like to be your site's home page. Your selection will take effect immediately.
[ATTACH=JSON]{"alt":"Click image for larger version Name:\tsite_builder.png Views:\t0 Size:\t9.3 KB ID:\t4423392","data-align":"center","data-attachmentid":"4423392","data-size":"full","title":"site_builder.png"}[/ATTACH]
[ATTACH=JSON]{"alt":"Click image for larger version Name:\tselect_homepage.png Views:\t0 Size:\t34.2 KB ID:\t4423393","data-align":"center","data-attachmentid":"4423393","data-size":"full","title":"select_homepage.png"}[/ATTACH]
Forum Status Icons
Forum Status icons are now larger and display at 32 X 32 pixels by default. This size can be reverted with a style variable.
Administrators can apply custom icons to individual forum channels. These will have their opacity reduced via CSS if a forum has been read. In addition to this, we have added "OnHover" events that will tell the user if the channel has been read or not.
Custom icons will have their background filled in with a prominent color similar to Group Icons. For information on configuring custom icons, see Custom Status Icons below.
[ATTACH=JSON]{"alt":"Click image for larger version Name:\tforum_icons.png Views:\t0 Size:\t79.3 KB ID:\t4423394","data-align":"center","data-attachmentid":"4423394","data-size":"full","title":"forum_icons.png"}[/ATTACH]
Tagging
We have added an interface to allow users with permission of "Can Tag Other's Topics" to add tags. Users with this permission will be able to select "Tags" in the Topic Starter to add new tags. If the user owns the Topic and has permission to modify Tags, they can delete tags added by others.
Inline Moderation
We have resolved a number of issues with Inline Moderation functionality. These updates will allow the following functions to behave as expected:
Moving multiple nodes now allows for redirects to be created.
Posts with Attachments can now be properly selected from the Inline Moderation menu.
Thread Redirects can now have their titles changed by double-clicking in the title area.
When selecting "View Topics" or "View Posts" when nothing is selected, an inline message is shown instead of redirecting to the search results page.
An updated message is displayed if you attempt to move a topic into a Category that doesn't accept posts.
Redirects are now deleted when the original node is deleted.
Blog Entries can now be selected for inline moderation if only Sticky Topics are displayed.
Channel Pagination should be calculated properly if you move nodes with redirects.
Back End / AdminCP Changes
Custom Status Icons
Administrators can now upload custom icons for individual forum channels. Icon upload is available within the AdminCP under Channel Management -> Channel Manager. Custom channel icons will be displayed at 50% opacity via CSS if the channel has been read by that user.
[ATTACH=JSON]{"alt":"Click image for larger version Name:\tadmincp_seticon.png Views:\t0 Size:\t19.7 KB ID:\t4423395","data-align":"center","data-attachmentid":"4423395","data-size":"full","title":"admincp_seticon.png"}[/ATTACH]
The display size of your channel icons is controlled by the value specified in the icon_size_forum_icon style variable. The default value is 32 X 32 pixels. A style variable was chosen so administrators can vary the value per style if necessary.
Date Range for Notices
The display date for Notices has been expanded to enable a range of dates to display them. Using the date range, the notice will automatically turn off at the end of the range.
File Scanning API
We have added new API routines to scan files when they are uploaded. The most common use of file scanning would be to check attachments for malware before saving them to disk. In order to demonstrate this functionality, we have provided a package that would enable scanning files via ClamAV. ClamAV is a popular command line tool used for malware detection. You can find information on installing ClamAV on their website.
If you wish to build your own file scanner, there is a sample package in the do_not_upload\development directory of your download package. The API is available in the vB_Utility_Filescanner class. The file for which is located at core\vb\utility\filescanner.php.
Image EXIF Information
We have added a configuration option to preserve image EXIF information on uploads. EXIF information contains data on color profiles, cameras, location, and more. Sometimes, EXIF information can be used to exploit either users or systems. Due to this we have previously stripped this information.
This functionality requires the use of the imagick or imagemagick image processing libraries. It will not work with the GD library. We strongly recommend that you install and configure ClamAV as well.
To enable this feature you must add a line to your config.php:
$config['Misc']['preserve_exif'] = true;
Note: This feature is not currently available for vBulletin Cloud customers at this time.
User Management
We have added a function to strip all tag associations created by a user. To accomplish this, edit the user within the AdminCP and select "Strip Tags" from the Quick User Tools drop down.
XML Sitemap Handling
You can now exclude Pages from being included in the XML Sitemap that is generated for search engine indexing. This is accomplished in the AdminCP under XML Sitemap -> Manage Content Priority. Set the priority for Pages to "Exclude" in order to prevent them from being listing in the generated XML Sitemap.
The Registration page has been removed from the XML Sitemap.
Refactored URL Class Handling
Handling and retrieving external URLs has been refactored in order to make the system more reliable and secure. Examples of where this is used include ReCaptcha, Facebook, and attachment uploads. Where necessary, we have merged the vB_Url class with the vB_Utility_Url class. After this, vB_Url has been removed from the system. This change will simplify code maintenance and improve security over time.
If you have third-party packages that rely on vB_Url, they will need to be updated to use the vB_Utility_Url class. Code for this class is located in \core\vb\utility\url.php.
For security purposes make sure the /core/vb/vurl.php file and /core/vb/vurl directories are deleted from your server. See File Cleanup below.
Security Patch
The code from the security patch has been applied to vBulletin 5.5.5.
Deprecated
Announcements
We are currently in the process of merging Announcement and Notice functionality. After this is completed, we will remove Announcements from the system in an upcoming version . Merging these similar features will simplify code maintenance and allow us to provide more features to the Notice system over time.
ImageMagick
Calling the ImageMagick executable directly has been deprecated in favor of using the imagick PECL library. We will remove direct support for ImageMagick in a future release. The imagick library functionality was added in vBulletin 5.5.4. We suggest updating your PHP installation to support imagick. You can find instructions on doing this in the PHP Documentation.
Internet Explorer Code
Internet Explorer 11 is currently supported but should be considered deprecated. Previous versions of Internet Explorer are not supported. We have removed some code specific to Internet Explorer from the system. This code had been added to support older versions of Internet Explorer. After upgrading, please make sure to follow the steps for File Cleanup. For more information on supported browsers please see the vBulletin System Requirements.
Users that access your site with IE should be encouraged to upgrade to the beta version of Microsoft's Edge Browser based on Chromium. This new browser is available for Windows 7, 8, 8.1, 10 and MacOS.
Additional Information
Install / Upgrade
Please see the forum topics below for the latest information on installing or upgrading vBulletin 5 communities.
Installation Instructions
Upgrade Instructions
File Cleanup
After upgrading your vBulletin system, you should delete any possible obsolete files. In order to cleanup obsolete PHP files in the /core/ directory, please run the Suspect File Diagnostic in the AdminCP under Maintenance -> Diagnostics. It will list the files that need to be deleted as "Not part of vBulletin." Delete these files from your server.
You can obtain more information on why this is needed and instructions on how to do complete a file cleanup in this topic in the vBulletin 5 Installs & Upgrades forum.
System Requirements
Minimum System Requirements
PHP Version: 7.1.0
MySQL Version: 5.6.10
MariaDB Version: 10.0.0
Recommended System Requirements
PHP Version: 7.3 or higher
MySQL Version: 8.0 or higher
MariaDB Version: 10.3+
For more information see vBulletin Connect System Requirements.
PHP 7.1 End of Life
PHP 7.1.X will reach end of life on December 1st, 2019. It is recommended to upgrade to a minimum version of PHP 7.2 before this happens. In early 2020, we will increase the minimum required version of PHP to 7.2.0.
Current Version Support Schedule
Active Version - 5.5.5
Security Patch - 5.5.4
Security Patch - 5.5.3
No Patch Release - 5.5.2 or earlier.
Discussion
If you have any questions about these changes you may discuss them here: https://forum.vbulletin.com/node/4423284
If you find an issue with the software or wish to place a feature request please visit our tracker.
In order to receive support for your vBulletin Product please visit our community forums.
Read more (locally) ...
Tue, 01 Oct 2019 18:31:34 GMT |
vBulletin Security Patch Released. Versions 5.5.2, 5.53, and 5.5.4 |
A security issue has been reported to the vBulletin team. To fix this issue, we have created a new security patch.
You can download the patch for your version in the Member's Area
We have made patches available for the following versions of vBulletin Connect:
5.5.4 Patch Level 1
5.5.3 Patch Level 1
5.5.2 Patch Level 1
Installing the Patch
Download the appropriate files for your version of vBulletin 5.5.X
Upload all files found within the zip file. Make sure to overwrite the existing files on your server.
Older Versions
If you are using a version of vBulletin 5 Connect prior to 5.5.2, it is imperative that you upgrade as soon as possible to protect your content. For more information on upgrading please see Quick Overview: Upgrading vBulletin Connect in the support forums.
vBulletin Cloud
This security patch has already been applied to all vBulletin Cloud sites.
Read more (locally) ...
Wed, 25 Sep 2019 18:17:36 GMT |
vBulletin Mobile Suite 2.1 is now available! |
vBulletin Mobile Suite 2.1 Changes
You can now build version 2.1 of the vBulletin Mobile Suite Apps within the Mobile Publisher. This release provides a number of feature enhancements and bug fixes for both Android and iOS.
Android
Image attachments should be handled better.
Push Notifications work again.
iOS
New Private Messages will properly append to the existing topic.
The word delete is misspelled.
General Feature Updates
Added forgot password feature on the login page.
Improved registration on sites with paid subscriptions.
Tags are now displayed on topic starters.
Fixed Facebook login config
Added Push notification support for Facebook Logins.
Added Privacy consent for Facebook Logins.
Users can now update their Avatars on their profile page.
The option to send a private message should now appear on the profile page.
Social Media Share options are available across the app
General Bug Fixes
Messages - Empty folder should display a message
0 Flag Reports in Notifications
Login fails to redirect if site has no category
Hide Blogs, Articles, Friends from Main Menu if they are disabled
Firebase get Device token crashes for some devices
Cannot direct to detail topic from Flag report
App unable to copy text in private messages
App unable to scroll to view longer messages
Topics with many posts no longer jump to 2nd page upon opening
Ignore feature stuck at Unignore
Upgrade popup feature for Android
"text_body" color is not being used
User cannot return to the previous page by clicking the back button
Crash due to unhandled youtube exception
Crash due to undefined variable
Remove version number
Registration Page - Incorrect message when trying to register
Write a Forum Page - Error when max allowed chars in Content
Write a Forum Page - Error when min allowed chars in Tags
Post Page - Error when max allowed chars in Quick Reply
Post Page - App crashes when attempting to post a reply
Incorrect spelling for flag report notifications
Message Post Page - Error when sending 2 consecutive messages to same user
Message Post Page - Error when max allowed chars in Private Message
Log In Page - App has an infinite buffer at log in
Registration shouldn't always require Date of Birth
Activity Stream - Created Blogs do not have the correct label
Activity Stream - Created Articles do not have the correct label
UI/UX - Icons of Content in Blog/Article need padding
Sending a Friend request should display confirmation message
Multiple image attachment picked at one
Increase the grey level of Unread messages
Update Firebase library
New message shouldn't require semicolon in the To field to proceed
Calendar title doesn't render HTML characters correctly
Read more (locally) ...
Fri, 20 Sep 2019 18:25:00 GMT |
vBulletin Connect 5.5.4 is now available for Download. |
vBulletin 5.5.4 Changes and Updates
The Preview Release of vBulletin 5.5.4 is now available to download customers. Preview Releases should not be used on production servers and are for testing purposes only.
Front End Changes
Avatars as Status Icons
A new option has been added to show the user's avatar instead of the status icon in Topic Lists. This allows the system to be consistent with the responsive view. All views will display the same icons based on this option. You can access the option in the AdminCP under Settings -> Options -> Topic Display Options.
When displaying avatars as status icons, the avatar will link to the user's profile for consistency. Administrators and moderators will not be able to double-click on the status icon to open and close topics. If this functionality is important for your site, you will need to use the standard status icons.
Note: Previous versions of vBulletin 5 would always show avatars in Responsive View. In order to maintain consistency, Responsive View now follows this new setting.
Semantic HTML
By using semantic HTML tags, we can provide additional information to search engines and accessibility tools (e.g. Screen Readers). Using these tags allows the system to signify which information is more important on the page.
We have converted the header, footer, and Channel Navigation Modules to better use Semantic HTML tags. The system is now using the <header>, <footer>, <nav>, and <main> tags where appropriate. Header elements are wrapped in the <header> tag instead of using the <div> tag. Footer elements on each page now use the <footer> tag. Menus and breadcrumbs are wrapped in the <nav> tag. The primary content of each page now uses the <main>. We have worked to make these changes backwards compatible and you should not see any difference in the rendering of your pages. However, if your custom CSS targets container.class (e.g. div.header) then you will need to update your CSS for these changes.
If you are using one of the provided styles, then you will not have to do anything to take advantage of this change.
Back End / AdminCP
Style Variable Validation
As a security measure, we have applied a series of validation rules to CSS attributes entered as Style Variable values and in User Profile Customization. These rules limit the amount of CSS that can be added to a variable and prevent users from adding their own attributes using third-party software to alter the page. As an Administrator, you can apply more complex CSS using the css_additional.css template for your style.
The following validation rules have been added to the system:
Default
Applies to all style variables unless specified below.
Limited to less than 250 characters.
Does not contain the characters "{}".
URL and Image
URLs must be quoted.
Unescaped braces "{}" are not allowed.
Base64 is allowed as long as there are no braces.
Font Family
No more than 20 font families listed.
Font Family list is comma separated.
Each font name is no more than 100 characters.
Font names with spaces must be enclosed within quotation marks.
Security Headers / Anti-Clickjacking
We have added several options to control how your site can be embedded in frames. Embedding a website within another is a frequent method used to PHISH for user data. vBulletin now allows you to prevent this and control where your site appears. This security measure will help safeguard your user's information and your site overall.
These HTTP Headers are sent to the browser for interpretation. Each browser may interpret these headers differently.
The options can be found in the AdminCP under Settings -> Options -> Cookie and HTTP Header Options.
Anti-Clickjacking Headers: This setting can be used to prevent your site from being included within HTML Frames. The default value will allow your site to be used in frames originating from the same URL. This will prevent sites that currently use frames from breaking. Setting this to Deny will prevent any framing. There are for options available:
Allow all Framing. This is how vBulletin works today. This option provides no security.
Deny all Framing. This is the most restrictive Option.
Allow from Same Site. Allows the system to be embedded in frames on your site. This provides basic security but will not break current sites. This will allow your site to be embedded in Frames that share the same domain as your Forum URL. Note: Accessing via domain name and IP Address will be considered two different sites.
Content-Security-Policy Header Value: This header is supported by all modern browsers and provides a robust framework for browser security. Please view the inline help for more information. This option is for Advanced Users and Network Administrators. For best results, you should set the Anti-Clickjacking Header value to Allow All and then handle that within your Content Security Policy.
Content Notifications
Administrators can specify words that will trigger notifications when they are used. The system works similarly to the existing word censor options. After you have created your list of words, the system will monitor them. When a word is used, the site Administrators and Moderators will be notified via their message center and email based on their notification settings.
The option for this is available in the AdminCP under Settings -> Options -> User Banning Options.
PHP Imagick Support
We have added support for the PECL imagick class available for PHP. Using this class can reduce server overhead and processing time when compared to the ImageMagick command line tools using the exec() function. Please see the PHP Documentation for information on installing this class on your server. Once installed, the class can be selected within the AdminCP under Settings -> Options -> Image Settings.
Note: In a future version of vBulletin, we will be removing the older command line implementation of ImageMagick.
Guest Permissions
On new installations, several permissions for the Guest Users usergroup have been changed. The following permissions have been changed so that they default to No for guests:
Can view Member Info.
Skip Moderation for Topics.
Skip Moderation for Replies.
Skip Moderation for Posts/Topics With Attachments.
Additional Information
Install / Upgrade
Installation Instructions
Upgrade Instructions
File Cleanup
After upgrading your vBulletin system, you should delete any possible obsolete files. You can obtain more information on why this is needed and instructions on how to do this in this topic in the vBulletin 5 Installs & Upgrades forum.
System Requirements
Minimum System Requirements
PHP Version: 7.1.0
MySQL Version: 5.6.10
MariaDB Version: 10.0.0
Recommended System Requirements
PHP Version: 7.3 or higher
MySQL Version: 8.0 or higher
MariaDB Version: 10.3+
For more information see vBulletin Connect System Requirements.
Current Version Support Schedule
It is recommended to use the latest version of vBulletin at all times.
Active Version - 5.5.4
Security Patch - 5.5.3
Security Patch - 5.5.2
No Patch Release - 5.5.1 or earlier.
Discussion
If you have any questions about these changes you may discuss them here:
If you find an issue with the software or wish to place a feature request please visit our tracker.
In order to receive support for your vBulletin Product please visit our community forums.
Read more (locally) ...
Tue, 03 Sep 2019 20:41:39 GMT |
|
