Skip to content

Commit b227262

Browse files
marc1706marc1706
committed
Merge branch '3.3.x'
2 parents 32e6c63 + 2976314 commit b227262

18 files changed

Lines changed: 287 additions & 67 deletions

File tree

‎build/build.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
<project name="phpBB" description="The phpBB forum software" default="all" basedir="../">
44
<!-- a few settings for the build -->
55
<property name="newversion" value="4.0.0-a1-dev" />
6-
<property name="prevversion" value="3.3.12-RC1" />
6+
<property name="prevversion" value="3.3.12" />
77
<property name="olderversions" value="3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.7-pl1, 3.1.8, 3.1.9, 3.1.10, 3.1.11, 3.1.12, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 3.2.10, 3.2.11, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.3.10, 3.3.11" />
88
<!-- no configuration should be needed beyond this point -->
99

‎phpBB/docs/CHANGELOG.html‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@ <h1>Changelog</h1>
5050
<ol>
5151
<li><a href="#changelog">Changelog</a>
5252
<ul>
53+
<li><a href="#v3312rc1">Changes since 3.3.12-RC1</a></li>
5354
<li><a href="#v3311">Changes since 3.3.11</a></li>
5455
<li><a href="#v3310">Changes since 3.3.10</a></li>
5556
<li><a href="#v3310rc1">Changes since 3.3.10-RC1</a></li>
@@ -168,6 +169,21 @@ <h1>Changelog</h1>
168169
<div class="inner">
169170

170171
<div class="content">
172+
<a name="v3312rc1"></a><h3>Changes since 3.3.12-RC1</h3>
173+
<h4>Bug</h4>
174+
<ul>
175+
<li>[<a href="https://tracker.phpbb.com/browse/PHPBB3-17312">PHPBB3-17312</a>] - User last visit gets updated too often</li>
176+
</ul>
177+
<h4>Improvement</h4>
178+
<ul>
179+
<li>[<a href="https://tracker.phpbb.com/browse/PHPBB3-17324">PHPBB3-17324</a>] - Add template event to notification_dropdown.html</li>
180+
</ul>
181+
<h4>Hardening</h4>
182+
<ul>
183+
<li>[<a href="https://tracker.phpbb.com/browse/SECURITY-276">SECURITY-276</a>] - Prevent resending activation email too often</li>
184+
<li>[<a href="https://tracker.phpbb.com/browse/SECURITY-278">SECURITY-278</a>] - Always release cron lock, even invalid task is passed</li>
185+
</ul>
186+
171187
<a name="v3311"></a><h3>Changes since 3.3.11</h3>
172188
<h4>Bug</h4>
173189
<ul>

‎phpBB/includes/acp/acp_inactive.php‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -238,10 +238,11 @@ function main($id, $mode)
238238

239239
$messenger->save_queue();
240240

241-
// Add the remind state to the database
241+
// Add the remind state to the database and increase activation expiration by one day
242242
$sql = 'UPDATE ' . USERS_TABLE . '
243243
SET user_reminded = user_reminded + 1,
244-
user_reminded_time = ' . time() . '
244+
user_reminded_time = ' . time() . ',
245+
user_actkey_expiration = ' . (int) $user::get_token_expiration() . '
245246
WHERE ' . $db->sql_in_set('user_id', $user_ids);
246247
$db->sql_query($sql);
247248

‎phpBB/includes/acp/acp_users.php‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -391,14 +391,18 @@ function main($id, $mode)
391391
$user_actkey = empty($user_activation_key) ? $user_actkey : $user_activation_key;
392392
}
393393

394-
if ($user_row['user_type'] == USER_NORMAL || empty($user_activation_key))
395-
{
396-
$sql = 'UPDATE ' . USERS_TABLE . "
397-
SET user_actkey = '" . $db->sql_escape($user_actkey) . "'
398-
WHERE user_id = $user_id";
399-
$db->sql_query($sql);
400-
}
401-
394+
// Always update actkey even if same and also update actkey expiration to 24 hours from now
395+
$sql_ary = [
396+
'user_actkey' => $user_actkey,
397+
'user_actkey_expiration' => $user::get_token_expiration(),
398+
];
399+
400+
$sql = 'UPDATE ' . USERS_TABLE . '
401+
SET ' . $db->sql_build_array('UPDATE', $sql_ary) . '
402+
WHERE user_id = ' . (int) $user_id;
403+
$db->sql_query($sql);
404+
405+
// Start sending email
402406
$messenger = new messenger(false);
403407

404408
$messenger->template($email_template, $user_row['user_lang']);

‎phpBB/includes/functions_user.php‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -210,24 +210,23 @@ function user_add($user_row, $cp_data = false, $notifications_data = null)
210210

211211
// These are the additional vars able to be specified
212212
$additional_vars = array(
213-
'user_permissions' => '',
214-
'user_timezone' => $config['board_timezone'],
215-
'user_dateformat' => $config['default_dateformat'],
216-
'user_lang' => $config['default_lang'],
217-
'user_style' => (int) $config['default_style'],
218-
'user_actkey' => '',
219-
'user_ip' => '',
220-
'user_regdate' => time(),
221-
'user_passchg' => time(),
222-
'user_options' => 230271,
213+
'user_permissions' => '',
214+
'user_timezone' => $config['board_timezone'],
215+
'user_dateformat' => $config['default_dateformat'],
216+
'user_lang' => $config['default_lang'],
217+
'user_style' => (int) $config['default_style'],
218+
'user_actkey' => '',
219+
'user_ip' => '',
220+
'user_regdate' => time(),
221+
'user_passchg' => time(),
222+
'user_options' => 230271,
223223
// We do not set the new flag here - registration scripts need to specify it
224-
'user_new' => 0,
224+
'user_new' => 0,
225225

226226
'user_inactive_reason' => 0,
227227
'user_inactive_time' => 0,
228228
'user_lastmark' => time(),
229229
'user_lastvisit' => 0,
230-
'user_last_active' => 0,
231230
'user_lastpost_time' => 0,
232231
'user_lastpage' => '',
233232
'user_posts' => 0,

‎phpBB/includes/ucp/ucp_profile.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -196,9 +196,10 @@ function main($id, $mode)
196196
{
197197
$notifications_manager = $phpbb_container->get('notification_manager');
198198
$notifications_manager->add_notifications('notification.type.admin_activate_user', array(
199-
'user_id' => $user->data['user_id'],
200-
'user_actkey' => $user_actkey,
201-
'user_regdate' => time(), // Notification time
199+
'user_id' => $user->data['user_id'],
200+
'user_actkey' => $user_actkey,
201+
'user_actkey_expiration' => $user::get_token_expiration(),
202+
'user_regdate' => time(), // Notification time
202203
));
203204
}
204205

‎phpBB/includes/ucp/ucp_register.php‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -380,18 +380,19 @@ function main($id, $mode)
380380
$passwords_manager = $phpbb_container->get('passwords.manager');
381381

382382
$user_row = array(
383-
'username' => $data['username'],
384-
'user_password' => $passwords_manager->hash($data['new_password']),
385-
'user_email' => $data['email'],
386-
'group_id' => (int) $group_id,
387-
'user_timezone' => $data['tz'],
388-
'user_lang' => $data['lang'],
389-
'user_type' => $user_type,
390-
'user_actkey' => $user_actkey,
391-
'user_ip' => $user->ip,
392-
'user_regdate' => time(),
393-
'user_inactive_reason' => $user_inactive_reason,
394-
'user_inactive_time' => $user_inactive_time,
383+
'username' => $data['username'],
384+
'user_password' => $passwords_manager->hash($data['new_password']),
385+
'user_email' => $data['email'],
386+
'group_id' => (int) $group_id,
387+
'user_timezone' => $data['tz'],
388+
'user_lang' => $data['lang'],
389+
'user_type' => $user_type,
390+
'user_actkey' => $user_actkey,
391+
'user_actkey_expiration' => $user::get_token_expiration(),
392+
'user_ip' => $user->ip,
393+
'user_regdate' => time(),
394+
'user_inactive_reason' => $user_inactive_reason,
395+
'user_inactive_time' => $user_inactive_time,
395396
);
396397

397398
if ($config['new_member_post_limit'])

‎phpBB/includes/ucp/ucp_resend.php‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ function main($id, $mode)
4545
trigger_error('FORM_INVALID');
4646
}
4747

48-
$sql = 'SELECT user_id, group_id, username, user_email, user_type, user_lang, user_actkey, user_inactive_reason
48+
$sql = 'SELECT user_id, group_id, username, user_email, user_type, user_lang, user_actkey, user_actkey_expiration, user_inactive_reason
4949
FROM ' . USERS_TABLE . "
5050
WHERE user_email = '" . $db->sql_escape($email) . "'
5151
AND username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'";
@@ -73,6 +73,12 @@ function main($id, $mode)
7373
trigger_error('ACCOUNT_DEACTIVATED');
7474
}
7575

76+
// Do not resend activation email if valid one still exists
77+
if (!empty($user_row['user_actkey']) && (int) $user_row['user_actkey_expiration'] >= time())
78+
{
79+
trigger_error('ACTIVATION_ALREADY_SENT');
80+
}
81+
7682
// Determine coppa status on group (REGISTERED(_COPPA))
7783
$sql = 'SELECT group_name, group_type
7884
FROM ' . GROUPS_TABLE . '
@@ -144,6 +150,8 @@ function main($id, $mode)
144150
$db->sql_freeresult($result);
145151
}
146152

153+
$this->update_activation_expiration();
154+
147155
meta_refresh(3, append_sid("{$phpbb_root_path}index.$phpEx"));
148156

149157
$message = ($config['require_activation'] == USER_ACTIVATION_ADMIN) ? $user->lang['ACTIVATION_EMAIL_SENT_ADMIN'] : $user->lang['ACTIVATION_EMAIL_SENT'];
@@ -160,4 +168,23 @@ function main($id, $mode)
160168
$this->tpl_name = 'ucp_resend';
161169
$this->page_title = 'UCP_RESEND';
162170
}
171+
172+
/**
173+
* Update activation expiration to 1 day from now
174+
*
175+
* @return void
176+
*/
177+
protected function update_activation_expiration(): void
178+
{
179+
global $db, $user;
180+
181+
$sql_ary = [
182+
'user_actkey_expiration' => $user::get_token_expiration(),
183+
];
184+
185+
$sql = 'UPDATE ' . USERS_TABLE . '
186+
SET ' . $db->sql_build_array('UPDATE', $sql_ary) . '
187+
WHERE user_id = ' . (int) $user->id();
188+
$db->sql_query($sql);
189+
}
163190
}

‎phpBB/install/schemas/schema_data.sql‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -538,10 +538,10 @@ INSERT INTO phpbb_forums (forum_name, forum_desc, left_id, right_id, parent_id,
538538
INSERT INTO phpbb_forums (forum_name, forum_desc, left_id, right_id, parent_id, forum_type, forum_posts_approved, forum_posts_unapproved, forum_posts_softdeleted, forum_topics_approved, forum_topics_unapproved, forum_topics_softdeleted, forum_last_post_id, forum_last_poster_id, forum_last_poster_name, forum_last_poster_colour, forum_last_post_subject, forum_last_post_time, forum_link, forum_password, forum_image, forum_rules, forum_rules_link, forum_rules_uid, forum_desc_uid, prune_freq, prune_days, prune_viewed, forum_parents, forum_flags) VALUES ('{L_FORUMS_TEST_FORUM_TITLE}', '{L_FORUMS_TEST_FORUM_DESC}', 2, 3, 1, 1, 1, 0, 0, 1, 0, 0, 1, 2, 'Admin', 'AA0000', '{L_TOPICS_TOPIC_TITLE}', 972086460, '', '', '', '', '', '', '', 1, 7, 7, '', 48);
539539

540540
# -- Users / Anonymous user
541-
INSERT INTO phpbb_users (user_type, group_id, username, username_clean, user_regdate, user_password, user_email, user_lang, user_style, user_rank, user_colour, user_posts, user_permissions, user_ip, user_birthday, user_lastpage, user_last_confirm_key, user_post_sortby_type, user_post_sortby_dir, user_topic_sortby_type, user_topic_sortby_dir, user_avatar, user_sig, user_sig_bbcode_uid, user_jabber, user_actkey, user_newpasswd, user_allow_massemail) VALUES (2, 1, 'Anonymous', 'anonymous', 0, '', '', 'en', 1, 0, '', 0, '', '', '', '', '', 't', 'a', 't', 'd', '', '', '', '', '', '', 0);
541+
INSERT INTO phpbb_users (user_type, group_id, username, username_clean, user_regdate, user_password, user_email, user_lang, user_style, user_rank, user_colour, user_posts, user_permissions, user_ip, user_birthday, user_lastpage, user_last_confirm_key, user_post_sortby_type, user_post_sortby_dir, user_topic_sortby_type, user_topic_sortby_dir, user_avatar, user_sig, user_sig_bbcode_uid, user_jabber, user_actkey, user_actkey_expiration, user_newpasswd, user_allow_massemail) VALUES (2, 1, 'Anonymous', 'anonymous', 0, '', '', 'en', 1, 0, '', 0, '', '', '', '', '', 't', 'a', 't', 'd', '', '', '', '', '', 0, '', 0);
542542

543543
# -- username: Admin password: admin (change this or remove it once everything is working!)
544-
INSERT INTO phpbb_users (user_type, group_id, username, username_clean, user_regdate, user_password, user_email, user_lang, user_style, user_rank, user_colour, user_posts, user_permissions, user_ip, user_birthday, user_lastpage, user_last_confirm_key, user_post_sortby_type, user_post_sortby_dir, user_topic_sortby_type, user_topic_sortby_dir, user_avatar, user_sig, user_sig_bbcode_uid, user_jabber, user_actkey, user_newpasswd) VALUES (3, 5, 'Admin', 'admin', 0, '21232f297a57a5a743894a0e4a801fc3', 'admin@yourdomain.com', 'en', 1, 1, 'AA0000', 1, '', '', '', '', '', 't', 'a', 't', 'd', '', '', '', '', '', '');
544+
INSERT INTO phpbb_users (user_type, group_id, username, username_clean, user_regdate, user_password, user_email, user_lang, user_style, user_rank, user_colour, user_posts, user_permissions, user_ip, user_birthday, user_lastpage, user_last_confirm_key, user_post_sortby_type, user_post_sortby_dir, user_topic_sortby_type, user_topic_sortby_dir, user_avatar, user_sig, user_sig_bbcode_uid, user_jabber, user_actkey, user_actkey_expiration, user_newpasswd) VALUES (3, 5, 'Admin', 'admin', 0, '21232f297a57a5a743894a0e4a801fc3', 'admin@yourdomain.com', 'en', 1, 1, 'AA0000', 1, '', '', '', '', '', 't', 'a', 't', 'd', '', '', '', '', '', 0, '');
545545

546546
# -- Groups
547547
INSERT INTO phpbb_groups (group_name, group_type, group_founder_manage, group_colour, group_legend, group_avatar, group_desc, group_desc_uid, group_max_recipients) VALUES ('GUESTS', 3, 0, '', 0, '', '', '', 5);

‎phpBB/language/en/common.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@
5757
'ACCOUNT_DEACTIVATED' => 'Your account has been manually deactivated and is only able to be reactivated by an administrator.',
5858
'ACP' => 'Administration Control Panel',
5959
'ACP_SHORT' => 'ACP',
60+
'ACTIVATION_ALREADY_SENT' => 'The activation email has already been sent to your email address. You can try again after 24 hours. If you continue to have problems activating your account, please contact a board administrator.',
6061
'ACTIVE' => 'active',
6162
'ACTIVE_ERROR' => 'The specified username is currently inactive. If you have problems activating your account, please contact a board administrator.',
6263
'ADMINISTRATOR' => 'Administrator',

0 commit comments

Comments
 (0)