NodeBB Versions Save

security release

Release build (patch) of NodeBB @ 2023-08-20T04:14:33.512Z

v3.3.4 (2023-08-20)

Bug Fixes

• upgrade script, get rid of nested processSortedSet (78a7cfe9)

Release build (patch) of NodeBB @ 2023-08-19T01:24:16.854Z

v3.3.3 (2023-08-19)

Bug Fixes

• one more fix (51587ca3)
• one more upgrade script fix (b5d1e917)
• post preview on skins remove clearfix and floats (5a8e6af4)

Refactors

• add connectionTimeout to psql (90f29571)

Release build (patch) of NodeBB @ 2023-08-18T20:29:02.655Z

v3.3.2 (2023-08-18)

Bug Fixes

• upgrade script (c02f1d70)

Release build (patch) of NodeBB @ 2023-08-18T17:36:28.696Z

v3.3.1 (2023-08-18)

New Features

• #11930, ability to set custom skins as default (db07ab15)

Bug Fixes

• some more upgrade script fixes (f23b0b5b)
• #11906, userData.sso — don't serve deauthUrl or non-associated url if caller uid is not same as target uid (19e047e2)
• include latin-ext subset of fonts in admin styles (#11918) (556a1c48)

Other Changes

• fix lint (d1949cee)

Release build (minor) of NodeBB @ 2023-08-16T14:42:43.050Z

v3.3.0 (2023-08-16)

Chores

• deps:

  • update dependency smtp-server to v3.13.0 (#11913) (7f6865cc)
  • update dependency lint-staged to v14 (#11909) (ee78b418)
  • update dependency lint-staged to v13.3.0 (#11908) (6f3b7bc8)
  • update dependency eslint to v8.47.0 (#11904) (af3c5e54)
  • update dependency @commitlint/cli to v17.7.1 (#11896) (1d44b004)
  • update commitlint monorepo to v17.7.0 (#11892) (d1d38097)
  • update dependency sass-embedded to v1.64.2 (#11858) (c9c23513)
  • update dependency eslint to v8.46.0 (#11852) (8a761ff7)
  • update dependency sass-embedded to v1.64.1 (#11833) (1cca1760)
  • update commitlint monorepo to v17.6.7 (#11817) (ac65ab42)
  • update dependency sass-embedded to v1.64.0 (#11821) (560bb29c)
  • update actions/setup-node action to v3 (#10347) (c8387828)
  • update mongo docker tag to v6 (#10889) (f2715979)
  • update dependency eslint to v8.45.0 (#11800) (b53da688)
  • update coverallsapp/github-action action to v2.2.1 (#11795) (adfde1d4)
  • update redis docker tag to v7.0.12 (#11789) (40477c85)
  • update dependency eslint to v8.44.0 (#11771) (0bad8578)

• i18n:

  • fallback strings for new resources: nodebb.admin-dashboard (80ea4eb0)
  • fallback strings for new resources: nodebb.admin-settings-chat, nodebb.error (e27d1743)
  • fallback strings for new resources: nodebb.modules (ab668617)
  • fallback strings for new resources: nodebb.global (bee5a9b4)
  • fallback strings for new resources: nodebb.error (eca28302)
  • fallback strings for new resources: nodebb.admin-dashboard (ac355acd)
  • fallback strings for new resources: nodebb.admin-dashboard (62b7be1c)
  • fallback strings for new resources: nodebb.admin-menu (ad9d8f77)
  • fallback strings for new resources: nodebb.admin-admin, nodebb.admin-manage-categories (f075e12a)
  • fallback strings for new resources: nodebb.modules (2c54e362)
  • fallback strings for new resources: nodebb.admin-manage-users (9284b7e4)
  • fallback strings for new resources: nodebb.modules (4ed0ed45)
  • fallback strings for new resources: nodebb.topic (9c0b98df)
  • fallback strings for new resources: nodebb.email (3613d1e6)
  • fallback strings for new resources: nodebb.modules (a7dae508)
  • fallback strings for new resources: nodebb.admin-settings-guest (640e32d4)
  • fallback strings for new resources: nodebb.error, nodebb.modules (2710037c)
  • fallback strings for new resources: nodebb.admin-admin (58bdedaf)

New Features

• closes #11902, ability to clear search history (7a79fed8)
• #11897, show guest handles in post queue and after using POST /compose (76fde8ef)
• #11881, limit room names (9349cb63)
• add toMid to chat messages (0316f324)
• add category selector to analytics page (acef5e33)
• middleware.handleMultipart, applies on API routes — invokes multipart middleware based on content-type header (bcc4b82c)
• #11868 apply blacklist to routes (#11873) (23404ad1)
• add icon to invite/accept notifs (78c5dfdc)
• add flags link to acp manage menu, closes #11867 (99c22942)
• move to npm fontawesome dependency and support fa pro (#11820) (b709ed9e)
• password check hook (#11853) (8ac34f8e)
• #11850, chat msg search (11bfeaf1)
• #11814, dont check content len for admins (f359a767)
• closes #11843, refresh search after changing filters (907c5fa6)
• #11842, ability to change reputation of users (ac027387)
• closes #11812, add unread public rooms into digest (eb0fcd32)
• allow multiple room owners, closes #6503 (91642cb3)
• show online users at the top of userlist and update (911ef058)
• simplified api module handler logic, content-type detection/parsing (2d016af8)
• allow FormData object to be passed in to the API module (ed99ea20)

Bug Fixes

• if you send message scrollToBottom (223c85e4)
• clicking on email consent form label checks the wrong box (2fe93361)
• clicking on email consent form label checks the wrong box (514af5d6)
• copy FA fonts to build directory instead of serving them directly (#11891) (ac4623ee)
• use config.undoTimeout instead of hardcoded value (850cfb33)
• add missing id/for to all checkboxes (ae747875)
• #11875, simplify alerts and show progress (881a28eb)
• bug where api module would throw if response contained no content-type header (007d735f)
• chat mark read regression (f4e2e617)
• fix escaped characters in tooltips, fix priv checks in tooltips (82562bec)
• #11855, remove superfluous password challenge on admin email update (unless they're updating their own) (4ca71f63)
• register abort can error on weird session state (#11854) (c9511915)
• #11847, typo in markNotification (5a8b4125)
• #11837, use userslug for check (e2fa8cf3)
• #11841, use unique nid per user who flagged (17783440)
• reset_code.tpl card block expanding to bottom of container (2792d771)
• closes #11825, user icons in global privileges (dae4f9f7)
• fallback for room timestamp (77550a50)
• dont error if timestamp is missing (6cc86b6e)
• topic postercount field if owner is changed (00be053e)
• updateOwner (16fe1eb9)
• unread notif filter (3e7ca4f2)
• closes #11806, fix code blocks (165b0f85)
• allow escape to close chat modals (4c311502)
• on leave/kick remove matching sockets from rooms (a766f74f)
• spec (79fae26d)
• lint (1e38a16b)
• client side js crash (adb3a5e6)
• #11797, update title on chat switch (840792ae)
• always return empty array if its not set (5c208610)
• mobile back button (9149a9a2)
• clear cache on sort (e03fdcd6)
• #11787 (bf2c429a)
• fetch handler not passing back errors or success payloads (8a531826)
• group membership methods for guests/spiders (2791eb8a)

Other Changes

• new filter to filter skins (c1361ee5)
• //github.com/NodeBB/NodeBB/issues/11818 (f7ae8963)
• //github.com/NodeBB/NodeBB/issues/11818 (0dce4c46)

Performance Improvements

• faster upgrade script (43060f3c)

Refactors

• ip blacklist.test (38c0c8de)
• dont load all tokens in verify token (2fe193d6)
• dont sleep if iteration is done on first one (0136e924)
• use fetch() throughout, instead of jQuery .ajax() (7415b16d)

Tests

• fix test if ip is invalid (38377982)
• fix tests to use regular uid (d615273d)
• fix tests since nid format changed (e41042ee)
• fix test (9e574e07)
• log e11000 errors (934df69e)
• fix spec (b63cd548)
• fix (e31f5c42)

backport https://github.com/NodeBB/NodeBB/commit/9ec7ab4afc6f860e818f9e5ab8eb8586b2358544

Backport security fixes to 1.x branch

• https://github.com/NodeBB/NodeBB/commit/1d1639d46f15c5a9c84d3ccfc7a334244c28039a
• https://community.nodebb.org/topic/17029/nodebb-2-8-7-security-update
• https://community.nodebb.org/topic/16882/nodebb-2-8-1-security-update
• https://community.nodebb.org/topic/17200/nodebb-2-8-13-3-1-3-security-releases
• https://community.nodebb.org/topic/16829/nodebb-2-6-1-security-update

Release build (patch) of NodeBB @ 2023-07-19T16:08:16.790Z

v3.2.3 (2023-07-19)

Chores

• downgrade harmony to correct version (7c94506b)

Bug Fixes

• typo in replied to link (3024dac1)
• logs page whitespace (2a3d6d5c)
• version alert in acp (05c9cca7)
• #11804, fix direction of dropdown on rtl (a4dba8d3)
• #11802, fix anchor ids in acp settings (562e4d6e)
• #11803, fix rtl in acp (a0478c70)

Release build (patch) of NodeBB @ 2023-07-12T14:56:08.509Z

v3.2.2 (2023-07-12)

Bug Fixes

• #11787 (6ae0df4f)
• #11786 fix selector for upgradable plugins (bf114c11)