e107 v2.3.4

Caution

v2.3.4 is a bug-fix release for sites on v2.3.3 or earlier.
Upgrade from v2.3.3 or earlier 2.x. If your site tracks the master branch, you are already past v2.3.4, so installing it would be a downgrade. v2.4.x is planned to be the next forward step.

Important

v2.3.4 collects the most overdue work in the queue: security advisory fixes for password reset, comment editing, and Media Manager imports; the PHP 8.x compatibility patches that have been accumulating; and the bug fixes that really needed to ship. It's not a feature release; the goal is to give v2.3.x sites a stable point release they can adopt while v2.4 work continues separately.

Highlights

• [Security] Critical Broken Access Control on comment edit (GHSA-5w63-63rh-99q6). comment.php previously allowed any authenticated user to overwrite another user's comment by passing that comment's itemid. The updateComment() SQL now requires the row's comment_author_id to match the editor's USERID, so cross-user edits return "Update Failed" instead of succeeding silently. (23961a8f)
• [Security] Server-Side Request Forgery in Media Manager imports (GHSA-92fr-7h4f-22pp). e_file::getRemoteFile() and getRemoteContent() now reject URLs that resolve to private, loopback, link-local, or otherwise reserved IP addresses, and limit cURL to HTTP/HTTPS. Sites that legitimately need to fetch from intranet hosts can opt back in by defining e_REMOTE_FILE_ALLOW_PRIVATE to true. (5f98cc9f, 40b2d111)
• [Security] Host Header Injection in password reset (GHSA-7pmw-jwvr-cq2x). The emailed password-reset link no longer trusts the incoming HTTP Host header. Requests with a Host that doesn't match the configured siteurl are rejected, and fpw.php now refuses to run at all if siteurl is unset rather than falling back to HTTP_HOST. (04511f9f, b0dee823, c4f9f71b)
• [Security] Privilege hardening. Media Manager preferences and avatar settings now require Main Admin. The default userclass visibility and edit permissions are also Main Admin by default (previously Admin). (#5489, #5477)
• Admin area usability. Numerous fatal-error and rendering fixes across admin search, admin UI grids, mailout, polls, datetimepicker, phpinfo, and legacy admin pages. (#5211, #5464, #5271, #5473)
• Email reliability. Fixes to CC handling, DKIM identity, persistent-recipient leakage across sendEmail() calls, and IP logging in notifications. (#5498, #5535, #5545)
• PHP 8.x compatibility. Several warnings and fatals on PHP 8.0–8.5 removed from db_verify, thumb.php, file_class, theme_handler, and rating-/forum-info rendering. (#4501, #5443, #5482)
• Forum info restored. sc_foruminfo now renders active-user counts and the newest member again. Two long-standing bugs had been hiding the whole block: the SELECT for the newest user was commented out, and the e_TRACKING_DISABLED ternary condition was inverted so the block was only shown when tracking was disabled, which is never the default. (0e23f651, 54e4b9de)

Note

A note from the maintainer, @Deltik:

v2.4 is going to need more time before it's at the quality level the e107 community deserves. Here's what's upcoming:

• MyISAM → InnoDB as the default engine, for crash recovery, row-level locking, and proper transactions
• utf8mb3 → utf8mb4 for native emoji support and full Unicode in usernames, posts, and comments
• Implicit FULLTEXT indexes that work on InnoDB, so search no longer pins us to MyISAM
• JWT-backed CAPTCHAs where the challenge carries its own server-signed solution token, eliminating the need to stash state in a guest session
• No more sessions for guests. Every anonymous visitor today gets a server-side session row; that goes away.
• New admin area skin with a collapsible sidebar, badges, and mobile navigation
• Bootstrap 5.3 + FontAwesome 6 UI refresh across the front-end and admin
• Admin change history with revert for auditable database edits
• Custom domains per page and static URL mapping for editorial control over URLs
• Schema.org (JSON-LD) support for better SEO, with news schema baked in
• Sitemap index support for sites past the single-sitemap limit
• Image alt-attribute management in Media Manager
• Plugin test runner so plugin authors can ship PHPUnit/Codeception tests with their plugins
• The community PR backlog finally getting reviewed and processed

For Administrators

Added

• Misconfiguration error on fpw.php when the siteurl preference is empty, so admins get a visible signal instead of silently broken password-reset emails. (GHSA-7pmw-jwvr-cq2x, 04511f9f)

Changed

• Comment editing (security). comment.updateComment() now scopes the SQL update to the editor's own user id, so cross-user comment edits via /comment.php?mode=edit are rejected. Ref: GHSA-5w63-63rh-99q6. (23961a8f)
• Remote file fetching (security). e_file::getRemoteFile() and getRemoteContent() now block private, loopback, link-local, and reserved IP ranges by default and limit cURL to HTTP/HTTPS. Define e_REMOTE_FILE_ALLOW_PRIVATE = true to opt back in for intranet/self-hosted use. Ref: GHSA-92fr-7h4f-22pp. (5f98cc9f, 40b2d111)
• Password reset (security). fpw.php now refuses to process any request when the siteurl preference is unset, and builds the reset link from the pref directly rather than from SITEURL (which could be derived from HTTP_HOST). Ref: GHSA-7pmw-jwvr-cq2x. (04511f9f)
• Host header validation (security). The core URL bootstrap now rejects requests whose Host header doesn't match the configured siteurl or the site_hosts config entry, with subdomain support. Misconfigured setups now fail fast with a "Site Configuration Issue" message. (#5458, GHSA-7pmw-jwvr-cq2x, b0dee823, c4f9f71b)
• Media Manager permissions (security). Media Manager Preferences and Avatar settings now require Main Admin. Media Category management is restricted to the A2 permission. (#5489)
• Userclass defaults (security). Default userclass visibility and edit permissions now default to Main Admin instead of Admin. (#5477)
• Admin area theme gate. Non-bootstrap3 admin themes that were known to break the admin area are no longer accepted; the admin falls back to a working theme. (3b7097e0)
• Site redirection. www. → bare-domain (and vice versa) handling was refactored out of class2.php into a dedicated method. (#5097)

Fixed

• Fatal errors on the admin search page (#5211), the admin-UI with custom method attribute+filter (#5464), the polls form column selector (#5271), and the plugin-repair extended-user-field path (#5483).
• Admin user area: avatar rendering (#5146), extended user fields restored after plugin refresh (#5483), unbanned users keeping "not verified" status (e875515d), oversized navigation icons (#5345).
• Admin email/mailout: CC recipients added correctly, DKIM identity corrected, recipients no longer persist across multiple sendEmail() calls, core prefs no longer stored on instance, mailout mailer-type restriction that was blocking pref saves. (#5498, #5535, #4123, #5355)
• Admin log: query-speed optimization and indexing improvements, duplicate column removed from the rolling log, debug SQL query output. (#5490, #5473)
• Admin phpinfo page: responsive layout, dark-on-dark text readability in modern-light theme, refactored rendering for theme compatibility, and sidebar menu added to legacy admin pages. (730245ef, 929f5494, 48b30bc8)
• Password reset: Bootstrap 5 fpw template rendering. (#5336)
• Avatars: remote file checks (#5146, #5387), missing-avatar fallback (295a5dad), default avatar rendering (81ae03c3), MIME type handling for remote images (#5387), .wav audio (#5390) and video dimension handling (#5396) in the media parser.
• Forum plugin: newforumposts_menu page rendering (#5340), shortcodes now use e_HTTP for online.php links (PR #5340), sc_foruminfo now renders the active-users block and the newest-member link (previously hidden by an inverted condition, with the underlying user lookup query commented out) (0e23f651, 54e4b9de).
• Ratings: widget renders cleanly for items that have not been rated yet; previously a missing rating row triggered a PHP...

e107 v2.3.3

Features

• Add missing setMetaTitle() method to e_admin_response #5112
• Change length of newsfeed_image field in db #5108
• Add option to alt_auth plugin #5107
• Improve system notifications handling in the admin area. #5106
• Display current time when settings timezone in admin preferences. #5099
• Add option to e_file::getRemoteFile() to prevent time out on larger files or slow connections. #5098
• Allow developers to choose which fields to export in e107Export(). #5094
• Render favicon in admin area the same way as on frontend #5062
• Add option to email any critical error message to an admin #4986
• Add {NEWS_MODIFIED} shortcode for modified date #4978
• Add FontAwsome 6 support #4969
• Add support for PUT or JSON POST to e_file::initCurl() method #4941
• Provide more options to resize the rich text editor. (bbarea, Tinymce) #4927
• Allow plugins to provide their own routing for notifications. #4922
• Allow plugins to use their own email templates when using e107::getEmail()->sendEmail(); #4919
• Improved Database SQL Verify page use of space by using 3 columns. #4907
• Admin-UI: Allow for entry of Primary ID in create/edit modes if needed. #4906
• Enhance e107 to allow for third-party email address validation. #4900
• Update plupload #4887
• Add eventName to Featurebox like News #4841
• Add dedicated Pages/Menus "delete" perms #4827
• Allow plugins to create siteLinks in areas other than the main navigation. #4810
• Exclude the currently viewed news item for the 'latest news' menu. #4786
• Custom SEO title for News and Pages #4783
• Add This Week, This Month and This Year to Admin-UI date filtering options. #4778
• Allow developers to set the URL that users will be directed to after they log out #4777
• Add support for images in plugin-generated sitemaps. #4760

Fixes

• Comments without ajax issue #5111
• Cron Schedule might not trigger with some timezones set in the preferences. #5096
• Admin-UI: Using the label 'True' or 'False' in a select (dropdown) displays incorrect labels. #5093
• Plugin Builder - Generated customPage method contains an error. #5092
• Errors showing up in error_log when running cron. #5091
• Admin-UI: renderValue() of type boolean ignores custom true/false readParm string values when inline editing is not enabled. #5089
• activatejavascript.org as found in default header is a broken link #5087
• Array order not being retained by x-editable inline dropdown/checkbox list. #5083
• PHP 8.1 - Fatal error: Uncaught Error: Undefined constant "USERNAME" in ***\ehandlers\mail.php on line 451 #5080
• "Force user to update settings" breaks home page for logged in users on PHP 8 #5052
• An Admin with only "Quick Add User" permission can see all users and access inline edit for all #5045
• Force user to update settings causes fatal error im PHP 8.2 #5041
• sendEmail() may render an 'info' message "Could not access file:" under some circumstances. #5020
• Emptying browser cache adds "Empty Thumbnail Cache" to the system logs. #5017
• Admin-UI: Setting readonly=true for a field containing an array value, posts 'Array' in the form results. #5016
• e107 corrupts form-submitted array values when GET method is used. #5005
• Canonical URL is not consistent when parked domains are in use. #4994
• Fatal errors - userposts.php - IMODE is not defined #4966
• Banner plugin - banner_campaign is saving only first campain #4959
• $_GET contains 'configure' key on all pages of admin area. #4945
• Flexpanel layout is not working #4940
• Cron 'Last-Run' value in admin area is always empty #4933
• National characters in title are not converted to sef url correctly. #4925
• sendMail() not using latest PHPMailer methods. #4924
• data-modal-submit attribute fails when an input tag is used instead of a button tag #4923
• Anomoly with some plugins losing their entry from e_url_list after upgrading others. #4917
• FAQs - PHP 8 error #4916
• Bootstrap-notify won't display alerts in admin area #4915
• Wrong HTML markup for date field in advanced search #4904
• PHP 8 - Fatal error LAN_PLUGIN_DOWNLOAD_NAME in comment's search #4890

User Contributions

• Bump guzzlehttp/guzzle from 7.4.3 to 7.4.4 in /e107_tests by @dependabot #4791
• Bump guzzlehttp/guzzle from 7.4.4 to 7.4.5 in /e107_tests by @dependabot #4796
• Some corrections by @yesszus #4788
• #4844: File Inspector: Do not traverse above the base directory by @Deltik #4845
• #4830: Sensible no delete log in admin_log_ui::maintenanceProcess() by @Deltik #4831
• Add support for wrappers in contact menu by @Jimmi08 #4850
• Fix for #4860 and correct fix for #3983 - correct second authorization by @Jimmi08 #4864
• Login flow consistency: Do not use redirect in admin area login box by @Deltik #4865
• sef-url for RSS news - category news #4868 by @Jimmi08 #4870
• Add support for wrapper in custom menus by @Jimmi08 #4873
• Bump twig/twig from 3.4.1 to 3.4.3 in /e107_tests by @dependabot #4877
• Fix #4847 - mistypo in route by @Jimmi08 #4882
• add wrapper support on fpw page #4883 by @Jimmi08 #4884
• Fix for #4895 - wrong message chatbox plugin by @Jimmi08 #4896
• #4897 class parameter for CB_AVATAR shortcode by @Jimmi08 #4898
• Tests: MDEV-29446 workaround: Ignore COLLATE clause in SHOW CREATE TABLE by @Deltik #4913
• Hotfix for tests failing after PHP 8.2 released by @Deltik #4921
• missing national character from toAscii() by @Jimmi08 #4926
• #4929: Fix type mismatch in usage of e107forum::getForumClassMembers() by @Deltik #4931
• #4938: Workaround for PHP 8.2.0 segmentation fault / assertion error by @Deltik #4939
• Reintroduce automated acceptance tests by @Deltik #4943
• fix for ranks in top.php #4967 by @Jimmi08 #4975
• Fix news category breadcrumbs by @RichardBarrell #4982
• deprecated static::method() calls for PHP 8.2 by @Jimmi08 #4988
• news: Fix category link in both breadcrumb and menu by @Deltik #4984
• #4991: Fix improper array access in sc_signup_extended_user_fields by @Deltik #4993
• Bump guzzlehttp/psr7 from 2.4.3 to 2.5.0 in /e107_tests by @dependabot #4995
• partial fix #4517 - fix for sett...

e107 v2.3.2

What's Changed

• Handle previously unhandled exceptions with social plugin and Hybridauth by @Deltik in #4643
• Bump twig/twig from 3.3.4 to 3.3.8 in /e107_tests by @dependabot in #4691
• New API to concatenate an array of HTML attributes by @Deltik in #4688
• fix for templating signature bbcodes by @Jimmi08 in #4709
• use the same markup (bootstrap) for pagination in forum and topic by @Jimmi08 in #4714
• Forum breadcrumbs on topic view with 3 forums #4286 by @Jimmi08 in #4710
• fix for not clearing forum cache by @Jimmi08 in #4716
• fix for access / check for access to forum type in forum post by @Jimmi08 in #4717
• Fix for Forum permissions for creating topics by @Jimmi08 in #4718
• Update theme.html by @brwnie in #4632
• Fix for Recalculation forum replies in Tools by @Jimmi08 in #4721
• #4724 forum - possibility to add forum ID as column by @Jimmi08 in #4729
• #4715 correct display of Last Post info by @Jimmi08 in #4723
• #4659 forum main admin as silent moderator by @Jimmi08 in #4730
• #4712 canonical URLs for paged forum topic by @Jimmi08 in #4733
• #3470 login error message is loaded 2x by @Jimmi08 in #4734
• #4670 ranks issue for first level by @Jimmi08 in #4735
• #4708 load bbcode buttons only if HTML is allowed for user by @Jimmi08 in #4732
• #4665 correct user last visit information by @Jimmi08 in #4741
• #4245 stay on correct page after editing paginated topic by @Jimmi08 in #4742

Full Changelog: v2.3.1...v2.3.2

v2.3.1

Highlights

• Support for PHP 5.6 through PHP 8.1 (#4554) – e107 v2 now adds PHP 8.0 and 8.1 support while maintaining support for PHP 5.6.

• New Admin Theme Skins – Modern Light and Modern Dark. May now be selected during initial installation of e107.

• Collapsible Navigation Panel – Option to reduce left-panel admin area navigation to icons only, for increased screen real-estate where it matters.

• Database session handler performance improvement (#4575) – e107 v2.3.0 introduced a non-blocking session handler backed by the database; however, a missing index causes gradually slower performance the more rows there are in the session table. This release fixes that bug by adding the missing index through a database update (migration).

• Thumbnail Generator rebuilt to use Intervention library.

• WebP image support (#4270) – e107 can now serve WebP images to compatible browsers and convert existing images on-the-fly. Requires PHP 7.0+ with the GD WebP extension installed.

• More reliable file uploads – A common complaint with e107 v2.3.0 was rejected file uploads. To fix this, e107 now recognizes files based on their MIME type.

• Increased protection against cross-site scripting (XSS) – There is now improved layering of HTML tag rendering to reduce the likelihood of corrupting pages with bad HTML.

• Increased protection against cross-site request forgery (CSRF) – Nonces have been added to some forms to prevent external sites from submitting them unbeknown to the authenticated user.

• New theming features – Theme developers can now take advantage of Bootstrap 5 and customisable breadcrumbs.

• SEO optimizations for Google, Facebook (Open Graph) and Twitter.

• New "Hero" plugin for home page carousel management. Supports animated bullet points and buttons. (see e107.org home page for example)

• News item Previous/Next navigation shortcode options.

• jQuery updated to v3.6.0

• FontAwesome updated to v5.14.0

v2.3.0

Highlights

• Support for PHP 5.6 through PHP 7.4 – e107 v2 now adds PHP 7.4 support while maintaining support for PHP 5.6. Note that PHP 8.0 support is not yet available but will be added in a future release (after #4269).
• Support for MySQL 8.0 (#4216) – Database integrity checks no longer persist their warnings on MySQL 8.0. MySQL 5.5 through MySQL 5.7 and MariaDB 10.0 through MariaDB 10.5 remain supported.
• New session handler with improved performance (#4113) – Non-blocking session handler backed by the database allows multiple concurrent requests to the e107 site per user session. A site administrator can enable this session handler at Settings » Preferences » Advanced Options » Security & Protection » Session Save Method and setting the value to "Database". New installations will use the database session handler by default.
• More social login providers (#3492) – The full list of supported social login providers can be found here.
• Code quality improvements – Automated tests are being introduced to reduce the chance of future changes breaking intended behavior.
• Many bugfixes – A ton of issues have been fixed both in the frontend and in the Admin-UI. Details about most of them can be found below.

For Administrators

Added

• New session handler for the session user tracking method: Database storage. Improves performance for concurrent requests in a session.
• Option to allow users to delete their own accounts (#4065)
• Updated social login providers (#3492)
• Basic per-item search engine robots handling added to News and Pages
• Support for automated Git sync with a theme repo
• Theme preferences import/export added to 'database' admin area.
• New admin permission to grant access to the theme manager
• Approve all comments has been added as an option.
• Added Rich Textarea (WYSIYWG) for EUF (#1775)
• Support for hosting providers that disable PHP readfile() (#3528)
• A PHP module check (similar to the one during installation) has been added to the PHPInfo page to quickly detect any missing modules after one migrates e107 to another PHP configuration.
• download plugin:
  • Added $host variable support to Downloads » Protection » NGINX secure_link_md5 (#4010)
• forum plugin:
  • Added minimal validation when creating new forum
  • Added new 'Forum icon' field (#3733)
  • Added confirmation dialog when deleting forum topic or post (#718)
  • Added cache for new forum posts menu

Changed

• The default user tracking method for new installations has been changed to session (was cookie). The cookie user tracking method is expected to be removed in a future release.
• The database handler PDO is now used by default. mysqli is available as a fallback.
• The social login flow has changed substantially. (#4099)
  • ?route=system/xup/signup was removed because ?route=system/xup/login now signs up and logs in via social login.
  • The return URL (query back) is no longer base64-encoded.
  • Some provider names have changed because the library (Hybridauth) has renamed them. These changes are accounted for in a database migration.
  • signup_shortcodes generates login buttons somewhat differently now.
  • The page ?route=system/xup/test is no longer enabled by default.
• The core integrity image (previously ./e107_admin/core_image.php, now ./e107_system/core_image.phar) has a new backwards-incompatible format. As it is now a binary file, administrators upgrading e107 over FTP should ensure that they are using binary transfer mode. (Issue reference)
  • Before: PHP array stored in a global variable
  • Now: JSON compressed into a phar
• Set initial value for email hide setting as TRUE when creating new user (#4107)
• Enable PHP session file garbage collection if it is not already enabled (#4113)
• Actually removed e_LEGACY_MODE this time (was only partially removed in v2.2.0)
• Removed obsolete ALLOW_AUTO_FIELD_DEFS constant
• Clear system cache after running Git pull or sync.
• Partial rewrite of ./e107_admin/fileinspector.php (#4114)
• ./e107_admin/message.php is now deprecated.
• Removed download_mail pref (#3622)
• Removed flood_protect pref (#3681)
• "Update ./e107_core/bbcodes/bb_p.php" (#3988)
• Admin-UI: Display ID number in create/update message
• Allow semicolons in URL query string (#3943)
• Allow <a rel> (#4128)
• Default access to post_script changed from Main Admin to Nobody
• Made mediapicker image selector the same width as Bootstrap input element.
• Removed admin-only limitation on system directory downloads.
• Removed bootstrap4 theme, which is now at https://github.com/e107inc/bootstrap4
• Removed landingzero theme, which is now at https://github.com/e107inc/landingzero

Fixed

• PHP 7.3+ compatibility:
  • Escape hyphen in regex for PHP 7.3 compatibility (#4036)
  • e_model refactoring for compatible subclass method signatures (#2146)
  • {NEWSTITLE} shortcode issue (#4035)
  • A bunch of PHP 7.4 syntax errors (524229b)
  • Fixed inconsistent output in PHP < 7.3 in e_parser::cleanHtml()
  • PHP 7.4.7+ fatal error involving core_index_index_controller (#4203)
  • Fixed all PHP syntax errors
• A lot of PHP E_NOTICE issues (some of them documented in #4074)
• MySQL 8.0.17+ support: INT types no longer return a width specification, so take that into consideration when verifying the database structure (#4216)
• "Bad File Detected" when uppercase extension used on image. (#4017)
• Fix for password filter in usersettings.php ("strong password not being hashed correctly") (#4004)
• Multiple comment navigation issues (#2425, #2281, #2937)
• Debug output removed from magic shortcode 'caption' (#3860)
• Added missing shortcode for MENUAREA
• {USER_EXTENDED} 'text_value' did not display the 'text' label correctly (#3957)
• Legacy shortcode wrapper conflict with email template (#3726)
• Banlist search by IP fails when using IPv4 (#4009)
• Update user_comments when deleting comments from comment manager (#1706)
• Automatic password rehashing added to admin login page.
• Sudden logouts in admin area immediately after logging in (#1836)
• Improved upgrade compatibility from e107 v1.x
• Detect and refresh language file lists when scanning plugin directories.
• Online language packs are not recognized in pre-release versions of e107 (#4229)
• Relative times displayed incorrectly, like on the user profile (#4080)
• User profile pager broken (#4146, #4252)
• Wrong comment avatar displayed when user is logged in (#4217)
• The email input field in usersettings.php is no longer required if the disable_emailcheck preference is truthy. (#4115)
• Handle chatbox nicknames with a "." in them (#4162)
• Quick add users does not save selected userclass permissions (#4095, #1728)
• ./e107_admin/cpage.php: Added check to prevent saving page/menu with empty page_title and menu_name fields when editing (#1474, #3986)
• Properly detect antiflood and online tracking prefs (#3681)
• Admin-UI:
  • Manual plugin upload (#4259)
  • Admin-UI/Form Handler: Fix for auto-link generation failing in create/edit mode.
  • Get rid of autocomplete in the Admin-UI (#3131)
  • Admin-UI: Boolean values are rendered differently if inline editing is enable or not (#3058)
  • Improved body ID when Admin-UI is in use
  • Unchecking all the display columns options and saving now clears the user preference and restores the coded default value found in $fieldpref
  • User Column preferences were being ignored when using ajax filtering. (#4121)
  • Inline editing was not triggering events. (#4183)
  • email_item_class preference was not saving (#4220)
  • Anonymous posting - wrong user displayed in Comments Manager (#3971)
  • Settings>Search Incorrectly displays Config Option for Downloads when uninstalled (#2003)
• Do not trigger user_login event if authentication fails (#4236)
• Issue with plugins, menus disappearing or displaying as being uninstalled. (#3741)
• Incorrect encoding of a plugin language file could cause json encoding to fail. (#3741)
• Anonymous comments wouldn't show up (#3829)
• Media-Manager Url fix. Fixed Media Preview. (#4049)
• Fixed Multiselect dropdown so that an empty value also gets saved
• Fixed <body> tag when using Menu Manager. Stored HTML-theme true/false var for each theme.
• Avoid conflicts with earlier themes that may have a 'layouts' folder. (#3961)
• Avoid legacy globals with v2.x theme templates. (#4124)
• Themes that need to be purchased are now opened in a new window/tab instead of in an <iframe> to avoid same-origin restrictions (#4208)
• Category template was changing news frontend template. Category template default should be blank. (#3739)
• Error display in ./e107_admin/newspost.php
• Nav styling small screens. (#4020)
• Removed Admin Nav button labels for all device and provided solution for plugins to add them back via CSS if required. Example added to admin_style.css (#4020)
• Corrected internal parser conflict when code/pre tags contained curly brackets.
• Not able to use <pre>, <code> syntax in TinyMCE area (#4058)
• TinyMCE video tags fix and expansion of allowed attributes. (#3793)
• Support for attributes onchange, onclick, etc. when script access is enabled (#3926, #4135)
• unsubscribe.php and white page (no error) (#4178)
• When invoking cron.php as an executable, the "Headers already sent" warning should no longer be emitted.
• Schedule task was failing wh...

v2.3.0-rc1

For Administrators

Added

• New session handler for the session user tracking method: Database storage. Improves performance for concurrent requests in a session.
• Option to allow users to delete their own accounts (#4065)
• Updated social login providers (#3492)
• Basic per-item search engine robots handling added to News and Pages
• Support for automated Git sync with a theme repo
• Theme preferences import/export added to 'database' admin area.
• New admin permission to grant access to the theme manager
• Approve all comments has been added as an option.
• Added Rich Textarea (WYSIYWG) for EUF (#1775)
• Support for hosting providers that disable PHP readfile() (#3528)
• A PHP module check (similar to the one during installation) has been added to the PHPInfo page to quickly detect any missing modules after one migrates e107 to another PHP configuration.
• download plugin:
  • Added $host variable support to Downloads » Protection » NGINX secure_link_md5 (#4010)
• forum plugin:
  • Added minimal validation when creating new forum
  • Added new 'Forum icon' field (#3733)
  • Added confirmation dialog when deleting forum topic or post (#718)
  • Added cache for new forum posts menu

Changed

• The default user tracking method for new installations has been changed to session (was cookie). The cookie user tracking method is expected to be removed in a future release.
• The database handler PDO is now used by default. mysqli is available as a fallback.
• The social login flow has changed substantially. (#4099)
  • ?route=system/xup/signup was removed because ?route=system/xup/login now signs up and logs in via social login.
  • The return URL (query back) is no longer base64-encoded.
  • Some provider names have changed because the library (Hybridauth) has renamed them. These changes are accounted for in a database migration.
  • signup_shortcodes generates login buttons somewhat differently now.
  • The page ?route=system/xup/test is no longer enabled by default.
• The core integrity image (previously ./e107_admin/core_image.php, now ./e107_system/core_image.phar) has a new backwards-incompatible format. As it is now a binary file, administrators upgrading e107 over FTP should ensure that they are using binary transfer mode. (Issue reference)
  • Before: PHP array stored in a global variable
  • Now: JSON compressed into a phar
• Set initial value for email hide setting as TRUE when creating new user (#4107)
• Enable PHP session file garbage collection if it is not already enabled (#4113)
• Actually removed e_LEGACY_MODE this time (was only partially removed in v2.2.0)
• Removed obsolete ALLOW_AUTO_FIELD_DEFS constant
• Clear system cache after running Git pull or sync.
• Partial rewrite of ./e107_admin/fileinspector.php (#4114)
• ./e107_admin/message.php is now deprecated.
• Removed download_mail pref (#3622)
• "Update ./e107_core/bbcodes/bb_p.php" (#3988)
• Allow semicolons in URL query string (#3943)
• Allow <a rel> (#4128)
• Default access to post_script changed from Main Admin to Nobody
• Made mediapicker image selector the same width as Bootstrap input element.
• Removed admin-only limitation on system directory downloads.
• Removed bootstrap4 theme, which is now at https://github.com/e107inc/bootstrap4
• Removed landingzero theme, which is now at https://github.com/e107inc/landingzero

Fixed

• PHP 7.3+ compatibility:
  • Escape hyphen in regex for PHP 7.3 compatibility (#4036)
  • e_model refactoring for compatible subclass method signatures (#2146)
  • {NEWSTITLE} shortcode issue (#4035)
  • A bunch of PHP 7.4 syntax errors (524229b)
  • Fixed inconsistent output in PHP < 7.3 in e_parser::cleanHtml()
  • PHP 7.4.7+ fatal error involving core_index_index_controller (#4203)
• A lot of PHP E_NOTICE issues (some of them documented in #4074)
• "Bad File Detected" when uppercase extension used on image. (#4017)
• Fix for password filter in usersettings.php ("strong password not being hashed correctly") (#4004)
• Multiple comment navigation issues (#2425, #2281, #2937)
• Debug output removed from magic shortcode 'caption' (#3860)
• Added missing shortcode for MENUAREA
• {USER_EXTENDED} 'text_value' did not display the 'text' label correctly (#3957)
• Legacy shortcode wrapper conflict with email template (#3726)
• Banlist search by IP fails when using IPv4 (#4009)
• Update user_comments when deleting comments from comment manager (#1706)
• Automatic password rehashing added to admin login page.
• Sudden logouts in admin area immediately after logging in (#1836)
• Improved upgrade compatibility from e107 v1.x
• Detect and refresh language file lists when scanning plugin directories.
• Relative times displayed incorrectly, like on the user profile (#4080)
• User profile pager broken (#4146)
• The email input field in usersettings.php is no longer required if the disable_emailcheck preference is truthy. (#4115)
• Handle chatbox nicknames with a "." in them (#4162)
• Quick add users does not save selected userclass permissions (#4095, #1728)
• ./e107_admin/cpage.php: Added check to prevent saving page/menu with empty page_title and menu_name fields when editing (#1474, #3986)
• Properly detect antiflood and online tracking prefs (#3681)
• Admin-UI:
  • Admin-UI/Form Handler: Fix for auto-link generation failing in create/edit mode.
  • Get rid of autocomplete in the Admin-UI (#3131)
  • Admin-UI: Boolean values are rendered differently if inline editing is enable or not (#3058)
  • Improved body ID when Admin-UI is in use
  • Unchecking all the display columns options and saving now clears the user preference and restores the coded default value found in $fieldpref
  • User Column preferences were being ignored when using ajax filtering. (#4121)
  • Inline editing was not triggering events. (#4183)
• Issue with plugins, menus disappearing or displaying as being uninstalled. (#3741)
• Incorrect encoding of a plugin language file could cause json encoding to fail. (#3741)
• Anonymous comments wouldn't show up (#3829)
• Media-Manager Url fix. Fixed Media Preview. (#4049)
• Fixed Multiselect dropdown so that an empty value also gets saved
• Fixed <body> tag when using Menu Manager. Stored HTML-theme true/false var for each theme.
• Avoid conflicts with earlier themes that may have a 'layouts' folder. (#3961)
• Avoid legacy globals with v2.x theme templates. (#4124)
• Themes that need to be purchased are now opened in a new window/tab instead of in an <iframe> to avoid same-origin restrictions (#4208)
• Category template was changing news frontend template. Category template default should be blank. (#3739)
• Error display in ./e107_admin/newspost.php
• Nav styling small screens. (#4020)
• Removed Admin Nav button labels for all device and provided solution for plugins to add them back via CSS if required. Example added to admin_style.css (#4020)
• Corrected internal parser conflict when code/pre tags contained curly brackets.
• Not able to use <pre>, <code> syntax in TinyMCE area (#4058)
• TinyMCE video tags fix and expansion of allowed attributes. (#3793)
• Support for attributes onchange, onclick, etc. when script access is enabled (#3926, #4135)
• unsubscribe.php and white page (no error) (#4178)
• Check for tablestyle() to avoid fatal error with some themes (#4012)
• bootstrap3 theme:
  • corporate.css fix font path glyphicons (#3998)
  • Moved modal to footer
  • Admin checkboxes are not visible in "Display Columns" window (#4171)
• bootstrap4 theme:
  • Alerts not showing (#3686)
  • Fix for btn-default in user update information button (#2898)
  • Formatting fixes for private messenger and usersettings
  • More formatting fixes (#4161)
• Fix for Google and Microsoft advertising auto-tags
• If the system or cache image directories' parents don't exist, mkdir() would fail to create the system or cache image directories.
• Prevent HTML code injection in e107::url() (#4054)
• Add missing Slovak letters to e_parse::toASCII() method (#4101)
• Removed Image srcset conflicts. Improves rendering quality of fine-lined PNGs under some conditions. (#2981)
• Mailout - display message when no email address sources are selected (#3303)
• Remove hardcoded value for parameter order in render_newsgrid() (#4092)
• Fixed Multiselect dropdown so that an empty value also gets saved.
• Clarify FPW testing mode button (#4007)
• Error page ignoring error_template changes (#4137)
• Fix for correct button class on core signup template (#2160)
• Signup template correct implementation of GDPR shortcode (#4055)
• Extended-User type=radio value conversion fix (#4144)
• Check theme version is compatible and disable installation if necessary (#4200)
• SQL insert error when creating news and pages while not restricting robots (#4207)
• alt_auth plugin:
  • Using e107 as secondary authorisation causes blank page (#3983)
  • Fix for fatal error because not supported MySQL function (#3981)
  • Stop using outdated db_* methods (#3993)
  • Fix for wrong user data while creating user (#3982)
  • Fix for missing scenario with secondary source (#3984)
• download plugin:
  • Download icons fix (#3865)
  • Reported links goto non SEF urls (#3622)
  • Allow class styling to download next/prev shortcodes (#3864)
  • Download RSS feed upgraded to v2 standards
  • Download meta description limit and formatting (#3270)
  • Multiple bugs in the report broken download feature (#2576, #3622)
• faq plugin:
  • FAQ classic layout broken (#2822)
• featurebox plugin:
  • Update Featurebox RSS feed to v2 standards
  • Fix for co...

e107 v2.2.1

New features:

• Added new News shortcode {NEWS_AUTHOR_EUF} to retrieve Extended User Fields (e.g. {NEWS_AUTHOR_EUF: field=biography})

Fixes & Improvements

• Fixed a database check/update issue that occurred when the database name contains a hyphen (-) (#3800)
• Fixed an issue with the Menu Manager preview not loading in some cases (#3815)
• Fixed frontpage button link to Admin Area (#3775)
• Fixed an issue with inserting a new custom page when using PHP 7.3 (#3812)
• Added tablerender id to error pages (#3801)
• Fixed an issue with (un)seralization (#2990)
• Fixed comment author avatar not showing correctly in comment form (#3813)
• Fixed issue in Download plugin with batch userclass options
• Fixed issue in Forum plugin with forum moderator userclass recognition (#3814), with the Userlist shortcode links (#3809), and added placeholder option in {SEARCH} shortcode
• Several Forum template optimizations for Bootstrap 4 (#2969)
• Several PHP 7.3 compatibility improvements

e107 v2.2.0

IMPORTANT NOTES:

• The minimum PHP version as of 2.2.0 is now set to 5.6. Using PHP 7.1+ is recommended.
• If you use any PHP version lower than 5.6, your website may break!
• Bootstrap 4 Library has been updated to latest version: 4.3.1. See examples in the bootstrap4 theme
• FontAwesome has been updated to the latest version 5.7.2. See examples in the _blank theme (theme.xml and theme.php)
• db_Fetch() in e_LEGACY_MODE permanently removed. Old plugins should use e107::getDb->fetch('both'); if this is still required.
• Changes to comments: Any reference to #comments-container (div ID) in the theme must be changed to .comments-container (div class) (#1944)

New features:

• GDPR features: added "Privacy Policy" and "Terms and conditions" preferences. Added {SIGNUP_GDPR_PRIVACYPOLICY_LINK} and {SIGNUP_GDPR_TERMSANDCONDITIONS_LINK} shortcodes. (#3175 and #3579).
• Admin Login with email address is now functional
• Chatbox plugin: new default templates added (#3630)
• Constants SITENAME SITEDESCRIPTION can be overridden using English_custom.php or English_global.php plugin LAN files.
• Added more styling functionality to {SIGNUP_IMAGES} and {SIGNUP_SIGNUP_TEXT} (#3582) and {LOGIN_*} shortcodes (#3466)
• Added event triggers for rate/like functionality: user_like_submitted & user_rate_submitted (#3552)
• Added load() method for the e_admin addon. See _blank plugin for examples. (#3695)
• New MySQL database export method integrated to increase performance when creating a backup
• "Under the hood" preparations to clean-up existing code (improving code quality) and introduction of new (database) interfaces for better support of up-to-date technology and easier 'hookings' of other/external interfaces (e.g. databases)
• For developers: automated tests added in e107-test repository https://github.com/e107inc/e107-test (to prevent bugs from being introduced, rather than having to fix them after they are an issue)
• FontAwesome is now used by the NextPrev
• New method added e107::getUserClass()->getUsersInClass
• News e_related, added {RELATED_DATE} shortcode
• Added afterPrefsSave() method in Admin-UI (#3799)

Fixes & Improvements

• Several improvements to plugin installation and related addons (#3531, #3536, #3592)
• Improvements to plugin identification when checking for updates (#3711)
• Several fixes to the Private Messenger plugin (#1758, #3413)
• Several fixes to the Banner plugin (#3141)
• Several fixes to the FAQ plugin
• Several fixes to the Forum plugin: not being able to move a forum post (#3619), forum moderators permissions (#3490), deleting of last post (#3490), forum pagination, newforumposts plugin (#3757), inline editing of forum name was changing SEF URL (#3798)
• Several fixes to the Download plugin (#3201, #3189, #3199, #2486, #3787)
• Fixed an issue where the verification of LAN pack would falsely return errors (#3632)
• Fixes to 'type' => 'country' in the Admin-UI (#3644)
• Enhancements to the 'search' functionality in Admin-UI across different fields
• User Extended Field country correctly displayed in User Profile (#3646)
• User Extended Fields 'read' permission is now properly checked (#1799)
• Avatars now support 'crop' to allow for non-square images. Simple usage: {USER_AVATAR: w=150&h=150&crop=1&shape=circle} (#3721)
• Fixed an issue with the Admin Area > Preferences page crashing on specific Windows server environments (#3625)
• Fixed an issue with the SEF URL configuration when social network tracking queries were used (e.g. Facebook links) (#3546)
• Several improvements to theme layout detection
• Improved user_forum_post_report, user_forum_post_report and user_forum_topic_created_probationary event triggers (#3618)
• Improved filetypes and filesize checks when uploading files (#3507, #3460)
• Added /contact SEF URL (#3566)
• Fixed an issue with navigation (site links) icons not resizing properly (#3712)
• Fixed an issue with list() method in the the e_admin addon (#3695)
• Fixed an issue with userclasses being reset when 'probationary' user was automatically promoted to 'normal' user (#3657)
• Rewritten "password reset" functionality to support webmail software pre-loading links. Links expire in 10 minutes now. (#3443)
• "Required fields" indicator now properly showing on signup page and usersettings (profile) (#3676)
• Relative datestamp now properly distinguishes between past and future dates (#3605)
• Improved backwards compatibility when using BBcodes and WYSIWYG editor
• Fixed an issue with Admin Help text not displaying in correct language (#3485)
• Several enhancements to handle deprecated mysql_*() methods and improved PDO usage
• Several compatibility fixes with Bootstrap 4 (#2962, #2969, and others)
• Several PHP 7 compatibility fixes (#3216, #3596, #3562 and others)
• PHPMailer upgraded to 5.2.27
• plupload upgraded to v2.3.6
• And dozens more fixes and improvements

e107 v2.1.9

Important: anyone experiencing core-prefs backward compatibility issues after this upgrade, please use the e107_2.1.9_bc_patch.zip patch

New features:

• It is now possible to override the chosen editor pref (WYSIWYG), using the e107::getForm()->bbarea() method by changing the $options array, e.g. $options['wysiwyg'] = 'tinymce4' (#3330)
• Added option define('X-FRAME-SAMEORIGIN', false); in e107_config to allow for external websites including an e107 website through an iframe (#3101)

Fixes & Improvements

• Fixed issue in update routine caused by an incorrect version number (#3302 #3311)
• Added backwards compatibility fix to handle old data formatting better (#3305)
• Fixed issue with multiple userclass selection in the Admin UI (#3249)
• The CSS file ensuring backwards compatibility for non-boostrap or legacy themes (backcompat.css) is now correctly loaded
• Fixed issue with LAN's not loading properly on contact.php page
• Fixed issue with parsing the + sign (#3307)
• Fixed issue with 'To' textbox not showing in mail-out functionality (#3303)
• Fixed issue with missing navigation text in Admin Area when using 'medium' width devices
• Improved support for SVG icons (#1958)
• Fixed several issues related to the displaying of comments (#2425 #2281 #2937)
• Fixed issue so 'Items per page' option is now respected on custom pages (#3188)
• Added default custom fields to Bootstrap 3 template (#3103)
• Improved support for Cyrillic characters on registration and login (#2440)
• Fixed an issue with the language packs not displaying in the Admin Area (#3059)
• Added e_gsitemap addon to News and Download plugin (#2606)
• Fixed an issue with error pages and redirection (#3179)
• Added new event triggers and notifications for the Forum plugin: user_forum_topic_created_probationary, user_forum_topic_updated, ser_forum_topic_moved, user_forum_topic_deleted, user_forum_topic_split, user_forum_post_created, user_forum_post_updated, user_forum_post_deleted, user_forum_post_report
• Added BBcode template for Forum plugin (#3317)
• New preferences in Forum plugin which allow to choose between BBcode or TinyMCE editor (#3318)
• Fixed issues with Forum plugin URLs (#3171)
• Fixed URL issue in Forum plugin when moving a forum topic (#3244)
• Improved Forum parsing: forum titles are only shown using plain text (no HTML or BBcode) (#3245)
• Plugin Builder generated output improved with examples of custom filter and batch options.
• Fixed an issue in the forum plugin when marking a forum topic as 'read' (#3338)
• Fixed issue in the featurebox plugin which caused debug information to show (#3290 #3074)
• Fixed issue with incorrect 'update required' message showing for the featurebox plugin
• Several PHP 7 compatibility fixes
• And dozens more fixes and improvements

e107 v2.1.8

New features:

• New functionalities for 'User ranks' (#2222)
• New addon e_gsitemap for Sitemap generation. See forum plugin for an example.
• Basic support for NGINX secure_link_md5 (#3075)
• Basic support for GPDR related functionalities (#3175)
• New addon e_output.php to capture the output of a page in a buffer (#3151)
• Forum plugin: categories can be copied using the Admin-UI

Fixes & Improvements

• Improved check for server requirements during installation
• Improvements to the loading and ordering of CSS files
• Numerous fixes related to the 'tree view' in the Admin-UI (News, Downloads, Sitelinks, etc.)
• PHP 7.x compatibility fixes
• Forum plugin: fixes to the newforumposts plugin
• Admin-UI: Searching for IP addresses (including wildcards *) works again
• Admin-UI: Added "Is Empty" option to type=number when filter is true.
• Admin-UI: $field 'filter' attribute now accepts 'future' and 'both', defaults to 'past' when set to true. ie. search future dates, past/future dates or past dates.
• And dozens for other fixes and improvements