Software update: phpBB 3.2.6

Version 3.2.6 of phpBB has been released. With this program it is possible to set up a web forum. PhpBB is made available under the gpl license and uses PHP and a database program to store messages. Besides MySQL, PostgreSQL, Oracle Database, Microsoft SQL Server and SQLite are also supported as database software. Version 3.2 includes support for php 7, recaptcha 2.0 and Symfony 2.8. Furthermore, the update process has been improved, more information is shown in quoted text and more emojis can be used. The release notes for this release can be found below.

phpBB 3.2.6 Release – Please Update

We are pleased to announce the release of phpBB 3.2.6 “You Know Nothing, Bertie Snow”. This version is a maintenance and security release of the 3.2.x branch which fixes two security issues, introduces further hardening, and resolves various issues reported in previous versions.

Previous versions of phpBB allowed users to run searches that might result in long execution times and load on larger boards when using the fulltext native search engine. To combat this, we have now introduced further restrictions on search queries. We’d like to thank Snover for his report and responsible disclosure. The issue has been assigned CVE-2019-9826.
In addition to this, another edge case that allowed testing for the existence of files and services on the local network of the host using the remote avatar functionality was resolved. Due to the nature of the remote avatar functionality, it’s not possible to cover all potential accesses to the local network. Therefore we have decided to deactivate this feature in this update and admins will be shown a warning of the potential side effects in the Admin Control Panel if they want to re-enable it. The functionality itself will be removed in the next minor feature release. We’d like to thank Do Ha Anh of Viettel Cyber ​​Security for his report and responsible disclosure.

The hardening introduced are among others the removal of the functionality to download database backups, further validation on administrative input in the Admin Control Panel, and the addition of form tokens to the login box. Most of these changes have been introduced to reduce the potential impact of admin account compromises or rogue administrators.

In our endeavours to deliver the most secure forum solution we have decided to further our reach in the security industry by joining the security platform HackerOne.
Some of the security improvements in this release are already the result of running a pilot program. We’ll soon change to a public program to allow submissions from everyone and add another way to easily report security issues. Until then security issues can be reported to the Security Tracker or by emailing to security [at] phpbb.com.

The fixed issues include, among others, support for cookies on domains with special chars, support for the Q&A plugin on MySQL 5.7, as well as preventing the installation of phpBB 3.2 on PHP 7.3. Full PHP 7.3 compatibility will be included in phpBB 3.3.

The full list of changes is available in the changelog file within the docs folder contained in the release package. You can find the key highlights of this release on the wiki and a list of all issues fixed on our tracker.