vBulletin 3.0.2 Released

[Kier]

vBulletin 3.0.2

This release contains a security fix for a minor XSS vulnerability related to the WYSIWYG editor, various other bug fixes, and several improvements.

• We would recommend all vBulletin 3 users to upgrade their installations as soon as possible, or else disable the WYSIWYG editor until such time as you are ready to upgrade.
• If you are currently running vBulletin 3.0.1 and do not wish to upgrade, you may replace includes/functions_editor.php with the version included in the 3.0.2 download to obtain the security fix.
• Other versions of 3.0 that do not wish to upgrade will need to turn off the WYSIWYG editor to be secure.

Backing Up Your Forums
Please be sure to check your backups, that they are complete before continuing with an upgrade. We had reports that PHP was causing time out errors when creating the back up SQL, and this was causing for incomplete or corrupted backups. The safest way to do a backup is to use the mysqldump utility through SSH/Telnet, as it will not suffer from any such problems. Full instructions for backing up your database are available in the vBulletin 3 Manual.

Installing or Upgrading vBulletin
Please see the appropriate manual sections: Installing vBulletin and Upgrading vBulletin.

Improvements Since 3.0.1

• If attachments are in the file system, thumbnails will now be stored in the file system. Everyone who has thumbnails enabled needs, in the file system or in the database, has to rebuild Thumbnails from Update Counters->Rebuild Thumbnails after the 3.0.2 upgrade.
• Custom Profile fields (input, textarea) can now contain more than 250 characters.
• Viewing of hidden custom profile fields is now an usergroup permission. After the 3.0.2 upgrade, Admins and Super Moderators should have this permission enabled. You will need to enable it for any other groups.
• Better detection for Mac browsers specifically webkit based browsers such as Omniweb.
• A custom profile field can now be set to allow modification only at registration.
• New Reputation Usergroup Permissions (Can Leave Negative Feedback, Can Use Reputation, Can Hide Reputation, Can See Own Reputation)
• Two new functions in the counter's section: Remove Orphan Posts and Remove Orphan Threads
• A moderator log will now appear when you edit a thread. Also added logging for when a moderator edits a poll, adds an attachment and deletes an attachment.
• Optimization to attachment.php by removing one query.
• Optimization to "New Posts" by altering query to use the index already in place.
• Several PDA-specific enhancements to the archive.

There are also two unsupported improvements. If you wish to implement these, you will need to make minor code changes (at the least).

• Full-text searching for MySQL 4.0 users.
• Ability to use an external SMTP server (with username and password) instead of PHP's built-in mail() function.

Bugs Fixed Since 3.0.1

Some of the bugs fixed include:

• Archive now sorted oldest to newest to ensure that users will see the same page as the search engine did when the page was indexed. (View)
• Invalid censorship options could cause PHP errors to be displayed. (View)
• XSS issue. (View)
• Users pruned with lastvisit instead of last activity. (View)
• Content type not always detected properly. (View)
• Permission denied error could be displayed when enabling load limits. (View)
• PHP error message could be displayed when editing forums in the control panel. (View)
• URLs are no longer automatically parsed in certain BB codes. (View)
• Entering multiple emails that received notification of user registrations did not work. (View)
• Regular expression matching for custom profile fields did not work. (View)
• Birthday info not always saved on registration. (View)
• Smilies parsed in code/html/php tags in WYSIWYG editor. (View)
• Displaygroupid could not be changed in the CP. (View)
• Made vbstrtolower attempt to use multibyte string functions if available. (View)
• Extremely long (valid) email addresses were not accepted.. (View)
• FAQ variable names not limited to alphanumeric characters. (View)
• Word wrapping made more effective. (View)
• Various phrase and template problems. (See below for template changes.)

Click here for a full list of bug fixes

Files Changed Since 3.0.1
See post below for changed files list.

To discuss this release, click here:

http://www.vbulletin.com/forum/showthread.php?t=109184

[Kier]

Templates Changed Since vBulletin 3.0.1

pollresults_table

Changes a misplaced </strong> to </span> i.e. "$pollstatus</strong>" becomes
"$pollstatus</span>"

Requires revert? Yes for XHTML compliance


help_bbcodes

Expanded the examples for [ left], [ center], and [ right] a bit.

Requires revert? No.


footer

Added a conditional to display the privacy url.

Requires revert: Only if you have a privacy statement.


editpost

Removed this from the template as it is no longer needed due to a bug fix that I decided to change some queries about for.

<input type="hidden" name="reason_exists" value="$edit[reason_exists]" />

Requires revert: No


calendar_showevents

Moved calendarjump from the left side to the right.

Requires revert? No


modifyprofile

Moved the birthday html to its own template (modifyprofile_birthday) in order to dynamically display it either in the required or optional sections depending on the birthday registration setting.

Requires revert? Yes if you require birthdays and wish for the fields to appear in the required section.


memberlist

Removed several redundant </td> tags (look for </td></td>) and added missing closing slashes to several input tags.

Requires revert? Yes for compliance.


postbit_legacy

Altered conditional so that announcement dates span two columns rather than wrapping in the first column. Also deprecated the $show['start_until_end'] conditional in favor of $show['announcement']. Either can be used though.


USERCP_SHELL

Change the first instance of $vbphrase[edit_private_message_folders] to $vbphrase[folders], change the second instance of $vbphrase[edit_private_message_folders] to $vbphrase[edit_folders]


pm_editfolders

Change $vbphrase[edit_private_message_folders] to $vbphrase[edit_folders]


SUBSCRIBE
subscribe_showfolders
USERCP_SHELL

Change $vbphrase[edit_subscription_folders] to $vbphrase[edit_folders]

Requires Revert? Yes


pm_popup_script

Added a check to see if the popup window was blocked and an alert is shown if this happens.

Requires Revert? No


SHOWTHREAD

Added $highlightwords to the Switch Mode links so search highlighting is carried over when switching modes.

Requires Revert? No


STANDARD_REDIRECT

find:

timerID = setTimeout("timed_submit();", 100);

change to:

timerID = setTimeout("submit_form();", 100);

Requires revert? Yes


modifyusergroups_memberbit

Changed $isleader to $show['isleader']

Requires revert? Yes


memberlist_resultsbit

Added a conditional to hide the checkbox of a usergroup leader.

Requires Revert? Yes


threadadmin_editthread

Added moderator log to bottom of template in lieu of using the "Notes" field to track this information.

Requires Revert: Yes


newpost_preview

Add html to display the post icon and message title to the previewed message.

Require Revert? Only if you want the above functionality.


threadbit
SUBSCRIBE

Checkbox for subscription type changing moved into a new column (details)

Requires revert: No, but if you revert one, you must revert the other too.

[Kier]

Files Changed Since vBulletin 3.0.1

• /
  • announcement.php
  • attachment.php
  • calendar.php
  • editpost.php
  • external.php
  • faq.php
  • forumdisplay.php
  • global.php
  • index.php
  • joinrequests.php
  • login.php
  • member.php
  • memberlist.php
  • newattachment.php
  • poll.php
  • postings.php
  • private.php
  • profile.php
  • register.php
  • reputation.php
  • search.php
  • sendmessage.php
  • showgroups.php
  • showpost.php
  • showthread.php
  • subscription.php
  • usercp.php
  • usernote.php
• /admincp/
  • adminlog.php
  • adminpermissions.php
  • adminreputation.php
  • attachment.php
  • backup.php
  • css.php
  • diagnostic.php
  • faq.php
  • forum.php
  • global.php
  • image.php
  • index.php
  • misc.php
  • options.php
  • profilefield.php
  • repair.php
  • stats.php
  • subscriptions.php
  • thread.php
  • user.php
  • usergroup.php
  • usertitle.php
  • usertools.php
• /archive/
  • archive.css
  • global.php
  • index.php
• /clientscript/
  • vbulletin_global.js
  • vbulletin_md5.js
  • vbulletin_stdedit.js
  • vbulletin_thrdpostlist.js
  • vbulletin_wysiwyg.js
• /includes/
  • adminfunctions.php
  • adminfunctions_backup.php
  • adminfunctions_language.php
  • adminfunctions_options.php
  • adminfunctions_template.php
  • datastore_cache.php
  • db_mysql.php
  • functions.php
  • functions_bbcodeparse.php
  • functions_calendar.php
  • functions_databuild.php
  • functions_editor.php
  • functions_faq.php
  • functions_file.php
  • functions_forumdisplay.php
  • functions_image.php
  • functions_log_error.php
  • functions_login.php
  • functions_newpost.php
  • functions_online.php
  • functions_reputation.php
  • functions_search.php
  • functions_showthread.php
  • functions_subscriptions.php
  • functions_threadmanage.php
  • functions_upload.php
  • functions_user.php
  • init.php
  • mail.php
  • sessions.php
  • vbulletin_credits.php
  • /includes/cron/
    • cron/birthday.php
    • cron/cleanup.php
    • cron/cleanup2.php
    • cron/promotion.php
• /install/
  • install_language_en.php
  • mysql-schema.php
  • upgrade.php
  • upgrade1.php
  • upgrade13.php
  • upgrade_language_en.php
  • upgradecore.php
  • vbulletin-adminhelp.xml
  • vbulletin-language.xml
  • vbulletin-settings.xml
  • vbulletin-style.xml
• /modcp/
  • announcement.php
  • banning.php
  • global.php
  • index.php
  • moderate.php
  • user.php
• /subscriptions/
  • nochex.php
  • paypal.php
  
  
  

[Freddie Bingham]

There is an issue rebuilding thumbnails in that you may receive an error if you have the in the FS or you'll receive broken images if you have them in the database. Please upload the attached misc.php to your admincp directory and then rebuild your thumbnails.

[Scott MacVicar]

Another issue regarding the removal of titles when a subscription finishes has been reported. If you receive a database error regarding this please upload the attached file to the includes folder.

[Kier]

The members' area package now contains the patched files listed above.