The Official vBulletin Modifications Site.

vBulletin 3.7.2

As promised last week, today sees the scheduled release of a maintenance version for vBulletin 3.7.x.

vBulletin 3.7.2 contains only bug fixes, details of which can be found in the bug tracker.

The security fixes included in vBulletin 3.7.1 PL1 and PL2 are also included in vBulletin 3.7.2.


Upgrading from Previous Versions

3.7.2 is a maintenance release. We recommend that all customers running prior versions of vBulletin 3.7 upgrade to benefit from bug fixes and stability improvements.

Full instructions for upgrading vBulletin are available here.


PHP and MySQL Requirements

Please note that vBulletin 3.7.x requires at least PHP 4.3.3 and MySQL 4.0.16 or later.

However, we recommend that vBulletin 3.7.x is run on PHP 5.2.6 with APC (or a similar opcode cache) and MySQL 5.0.51 for best performance and stability.


End of Life for PHP 4

The PHP group has announced the end of life for PHP 4. We strongly recommend that customers update their servers to PHP 5.2.6 if they are still running PHP 4. vBulletin 3.7.x supports PHP 5 without any problems, though you may need to disable strict mode for MySQL, see here on how to enable 'force_sql_mode'.

Note: We will continue to support PHP 4 in the vBulletin 3 series.


Download vBulletin 3.7.2

As usual, vBulletin 3.7.2 is available for all customers with valid, active licenses to download from the vBulletin Members' Area.

vBulletin Members Area


More...

Please do not use this thread for support questions.

vBulletin 3.7.1 PL2 / vBulletin 3.6.10 PL2

An XSS flaw affecting the vBulletin URL redirection system has been identified. It could allow an attacker to trick a moderator or admin into unwittingly performing an action in either the front-end or control panel that they had not intended. To resolve this issue, it is necessary to release PL2 versions of vBulletin 3.7.1 and 3.6.10.

This XSS flaw, and that which made the release of the PL1 versions necessary, was discovered by Jessica Hope and others.

The upgrade process is the same as the PL1 releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.


vBulletin 3.7.2 to be Released Next Week

In line with our new scheduled maintenance release policy, we have evaluated the merits of providing a new maintenance release one month after the previous release or waiting until next month. It has been decided that we will bring forward the release of vBulletin 3.7.2 from Tuesday July 29th to this coming Tuesday, June 24th.

This release will be mentioned in the security bulletin sent out to customers today, but we will not send a further notification next week when 3.7.2 is released. Watch your Admin CP News, or the latest version check in the Admin CP to see when the new version is available. Alternatively, keep an eye on this forum for the 3.7.2 announcement.

To reiterate, vBulletin 3.7.2 will be released on Tuesday, June 24th 2008.


Upgrading from 3.7.1, 3.6.10 or their PL1 versions

If you are already running 3.7.1, 3.6.10 or their PL1 patch versions, the process you will be required to follow to make your board immune to the XSS problem is very simple.

There is no need to run an upgrade script if you are already running 3.7.1, 3.6.10 or their PL1 versions.

Visit the Patches section of the vBulletin Members' Area and download either the patch for 3.7.1, or the patch for 3.6.10, according to the version you are currently running, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL2 release.

The 3.7.1 PL2 patch file also includes the PL1 fixes. The same is true of the 3.6.10 PL2 patch file.


Upgrading from Versions Earlier than 3.7.1 or 3.6.10

If you are not already running 3.7.1 or 3.6.10, you should download the most latest version from the Members' Area and perform an upgrade as normal.

Full instructions for upgrading vBulletin are available here.


Download vBulletin 3.7.1 PL2 or 3.6.10 PL2

As usual, both versions released today are available for all customers with valid, active licenses to download from the vBulletin Members' Area.

vBulletin Members Area


More...

Like the vBulletin Blog, the vBulletin Project Tools add-on will also be receiving an update in the near future. There has been great feedback on the features you want in the Project Tools, from project management improvements to additional integration with forum features.

This upcoming Project Tools release aims to implement some of the most popular feature requests we've received. Here's a list of some of the things you'll be getting:

Project Subscriptions
Users can now subscribe to individual issue types (bug, feature, task) within a project and get a digest with the latest changes, just like forum subscriptions.

Notification of Issue Assignment
If a user is assigned to an issue by someone else, he or she will be sent an email about the assignment.

Persistent Read Marking / New Post Indicators
A standard feature of the forums, the Project Tools now track what issues you've read and whether a project has new content. There are a bunch of features that follow from this:

• Bold/unbold issue titles
• "Go to new" links
• Project icons that indicate new content
• Issue type counters that indicate new content specifically to that type
• Improved display of unread issues on the User CP
• "Find New Issues" links

Issue Closing
A relatively simple feature, but issues that get out of hand can be closed. Like in the forum, this prevents replies except from those that can open the issue. It also locks the issue's metadata unless you can open the issue.

Improved Tracking of Private Issues/Replies
Previously, if someone replied privately to an issue, it wouldn't affect the last post information, thus making it very easy to miss the message. Now, private replies will change the last post time and reply counts (if you can see the private message). This way you won't miss anything.

This isn't a full list, as I'm sure you expect. Look for information on some of the new features in the vBulletin developers' blog.



Oh, and one more thing... Expect to see this Project Tools update here on vBulletin this month. Betas will be available to Project Tools license owners next month (July).


More...

Since its initial release, the vBulletin Blog add-on product has proved itself to be a popular addition to the vBulletin software suite. It has been well received and sold in good numbers.

Of course, no software is perfect, and we appreciate the feedback we have received from our customers regarding existing features and those that the product would benefit from having.

Therefore, we are pleased to announce that a significant update to the vBulletin Blog is in development, which will introduce new features and implement several popular suggestions for improvements to existing functionality.

There has been no shortage of feature suggestions and feature change requests made in the blog suggestion forum. Careful attention to all of these was paid, with consideration given to them all. This update is slated to be available in the near future, so the kitchen sink is not in the feature list, but what is on the list is sure to please and satisfy everyone while at the same time allowing a release within a reasonable timeframe.

Here is a short list of some of the new features in the vBulletin Blog update.

Tags
Is a blog really a blog if it doesn't have tags? We really wanted to get tag support into Blog 1.0 but we just ran out of time. Well we have tags now that feature a cloud at the top level (all blogs) and at the level of each blog.

Featured Entries
Customers asked for more capability out of the Featured Entry feature. Now you will be able to select multiple entries from an increased set of criteria.

Blog Roll
Your users will now be able to create their own custom blocks to appear in their blog sidebar. They will even be able to rearrange the order of their custom blocks and the pre-existing blocks.

Categories
As an admin, you can now create categories that are accessible to all users or can be limited to specific usergroups.

Blog Customization
One of the most requested features must be the ability for users to personalize their blog. As users can now do with their profiles in 3.7, these style customizations will now be applicable to their blog too.

Further Use of vBulletin 3.7 Features
vBulletin 3.7 introduced several new features that are applicable to the blog.

• The lightbox is now used in the blog.
• Social Bookmarking links have been implemented for each entry.
• The old vBulletin standbys of quick editing and quick loading deleted items have been implemented as well.

Of course, this is not a complete feature list - we wouldn't want to spoil the surprise before you unwrap the shiny package.

We hope to provide further information as time goes on regarding the Blog update via the vBulletin developers' blog.


More...

vBulletin 3.7.1 PL1 / vBulletin 3.6.10 PL1

The recent discovery of an obscure method in which to expose a cross-site scripting (XSS) error in vBulletin when using specific browser software means that it is necessary to release Patch Level (PL) versions of both 3.7.1 and 3.6.10.

Although it is difficult to exploit the XSS flaw, and the potential for exposure and damage is limited, we nonetheless recommend that customers upgrade to protect themselves.

Upgrading from 3.7.1 or 3.6.10

If you are already running 3.7.1 or 3.6.10, the process you will be required to follow to make your board immune to the XSS problem is very simple. Visit the Patches section of the vBulletin Members' Area and download either the patch for 3.7.1, or the patch for 3.6.10, according to the version you are currently running, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 release.

There is no need to run an upgrade script if you are already running 3.7.1 or 3.6.10.

Upgrading from Versions Earlier than 3.7.1 or 3.6.10

If you are not already running 3.7.1 or 3.6.10, you should download the most latest version from the Members' Area and perform an upgrade as normal.

Full instructions for upgrading vBulletin are available here.

PHP and MySQL Requirements

Please note that vBulletin 3.7.x requires at least PHP 4.3.3 and MySQL 4.0.16 or later.

However, we recommend that vBulletin 3.7.x is run on PHP 5.2.6 with APC (or a similar opcode cache) and MySQL 5.0.51 for best performance and stability.

End of Life for PHP 4

The PHP group has announced the end of life for PHP 4. We strongly recommend that customers update their servers to PHP 5.2.6 if they are still running PHP 4. vBulletin 3.7.1 supports PHP 5 and MySQL 5 fully, though you may need to disable strict mode for MySQL, see here on how to enable 'force_sql_mode'.

Note: We will continue to support PHP 4 in the vBulletin 3 series.

Download vBulletin 3.7.1 PL1 or 3.6.10 PL1

As usual, both versions released today are available for all customers with valid, active licenses to download from the vBulletin Members' Area.

vBulletin Members Area


More...