Exponential Project Update

mybb-exponential@4x

MyBB’s ecosystem spans across several platforms connecting contributors, authors, and users. In this post, we’ll collect a number of recent highlights from around the Project.

10³ Stars on GitHub

Software is often divided into closed- and open-style development.

Back in 2009, MyBB switched from the former to the latter, enabling administrators and developers, who tweak their forums in the most random ways, to submit and see their fixes in official releases. The move also opened up the development process and allowed a crowd of enthusiasts to critique any upcoming changes and test them on their own servers, and with custom plugins.

Since then, code from 100+ contributors has made its way into MyBB, and earlier this year, the Project’s main repository passed the symbolic threshold of 1K stars from members of the open source community.

If you have patches of your own, or would like to otherwise make MyBB a better forum software, explore some of the options in the CONTRIBUTING.md file.

10² Stars for Top Extensions

If you’ve been using MyBB, you’ll know that the core package is only a part of its identity: extensions have an important place in the ecosystem that’s been maturing for two decades.

Today, the Extend platform hosts over 1300 projects that have published more than five thousand releases downloaded well over two million times, and a pair of extensions have already crossed the 100-star mark — taking a portion of over 6.5 thousand stars given in total.

Starring projects allows you to find them in a single place when you’re ready to start your new forum, and subscribing to them (which was done more than a thousand times) will notify you of new releases to check out.

As we work to define MyBB as lightweight software with modern features, we aim to further strengthen extensions as a pillar of the application by building authoring aids and APIs into the core to make the experience easier and more pleasant for everyone involved.

10¹ Development News

In recent months, numerous key elements of the upcoming series have taken shape. Read ten notes about the View system, extending MyBB, merged features, requirements, and upcoming works in the 1.9 Development Milestone thread.

We have also published a Quick Start cheatsheet, allowing you to set up the development branch and preview it right away using your favorite workflow.

If you’re ready for some tinkering and a deeper dive, read Experimenting with Inheritance Basics, where we make use of the new theming system and track how the application handles it so far.

10⁰ Familiar-looking Theme

When patrolling the Extend section, we noticed one submission was particularly reminiscent, but we couldn’t put our finger on it. A careful investigation that included, among other methods, reading its documentation revealed that it’s MyBB 1.9’s official theme — for MyBB 1.8.

The Curves UI takes the upcoming series’ look and backports it visually into the current stable version. It is also maintained on GitHub, where you can work with authors to improve it further.

It joins many responsive Community-maintained themes, so it’s another good starting point for customization, and if you’re looking to prepare your forum for the style transition into 1.9.x, you can now use its latest build to make the eventual switch extra smooth.

The Base

With the Community-driven environment giving the Project its power, the base of organizing work and tying up all loose ends is done by the MyBB Team.

To ensure this exponentiation yields the best product, we’ve recently brushed up and published the list of Roles, including ten nonmanagement focus areas within the Team. Those now include separate teams for testing and developer relations, in adjustment according to the direction we’d like to take.

While those spots are often filled through invitation, if some of the listed activities pique your interest, tell us about it (the worst you’ll get is a friendly nudge in the right direction on how to make a positive impact!).



If you’d like to keep up to date with various news related to MyBB development and the Project behind it on the fediverse, use our verified handle @[email protected].

MyBB 1.8.38 Released — Security & Maintenance Release

MyBB 1.8.38 is now available, and is a security & maintenance release.

Administrators of installed boards should update the existing configuration (inc/config.php) to include all addresses blocked by default in Disallowed Remote Addresses.

  • 2 security vulnerabilities addressed:

    • Low risk: Incomplete disallowed remote addresses list SSRF (advisory) — reported by shin24
    • Low risk: Backups directory .htaccess deletion (advisory) — reported by shin24
  • 16 issues resolved

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.37 Released — Security & Maintenance Release

MyBB 1.8.37 is now available, and is a security & maintenance release.

This version includes improvements for compatibility with mailing configurations and recent PHP versions.

  • 2 security vulnerabilities addressed:

    • Medium risk: Visual editor size code persistent XSS (advisory) — reported by Paulos Yibelo (Octagon Networks)
    • Low risk: ACP Themes persistent XSS (advisory) — reported by Or4nG.M4n
  • 12 issues resolved

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.36 Released — Security Release

MyBB 1.8.36 is now available, and is a security release.

After applying the patch, we recommend using the Admin CP’s Tools & Maintenance → System Health → Check Templates tool to scan for security issues that may not have been detected before this version.

  • 1 security vulnerability addressed:

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.35 Released — Maintenance Release

MyBB 1.8.35 is now available, and is a maintenance release.

This version improves stability and compatibility with various PHP versions.

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.34 Released — Security & Maintenance Release

MyBB 1.8.34 is now available, and is a security & maintenance release.

  • 1 security vulnerability addressed:

    • Low risk: User CP email persistent XSS (advisory) — reported by Ahmet Altuntaş
  • 13 issues resolved

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

To keep up with Project news, you can now follow MyBB on Mastodon.

Thanks,
MyBB Team

Designing MyBB 1.9’s Installer

One key to keeping software projects and the surrounding communities healthy is keeping friction for all audiences to a minimum.

In MyBB, this friction is derivative of user experience and developer experience. Our largest audience is formed by the end users — people browsing online forums, not expected to know what MyBB is, yet benefitting from fine-tuned visuals, phrases, and flows that come out-of-the-box. At the same time, we target two groups further down the forum assembly line, for whom both UX and DX apply.

For site owners and community leaders, the software needs to be approachable and intuitive — without requiring particular knowledge of languages and technologies — but also allow tweaking its look and functionality by maintainers with technical experience.

For developers, in addition to a useful extension system, APIs, and documentation, the software needs to expose the appropriate tools to allow speedy development and testing — without assuming one’s familiarity with it.

These factors are crucial in the world of free and open-source software, where the development relies on external contributors and their ease of work.

A setup mechanism is where their paths cross: it has to break down unavoidable complexity, without getting in expert users’ way. Besides having to meet best UX and DX practices, it also carries the weight of defining the first impression of the product for everyone.

The Need for Speed

kawaii — 2:56 PM

I wonder how many of the PostgreSQL installs are me with my Docker stack

People who work with, and on MyBB, install it a lot. To comfortably test new code and eliminate bugs in the core and extensions, their setup should require minimal time and attention better spent on the task at hand.

The existing installation experience left much to be desired — among others, the old installer:

A screenshot of the Table Creation page displayed during the installation of MyBB 1.8, with an unnecessarily long list of names of created tables.
              • is strictly synchronous and static, making users alternate between waiting and filling out forms,
              • asks for information that’s either nonessential (e.g. a website URL for the optionally displayed link), or derived (e.g. cookie settings that can be deduced from the forum URL),
              • contains technical details of little to no relevance, which also makes it more difficult to navigate,
              • loads pages only for the user to press Next, instead of proceeding automatically,
              • offers no shortcuts for quick setup for testing or development, and
              • can’t be scripted or automated.

The special part of the application accessed through install/ was largely self-contained and separate from the rest, offering a good target for improvements parallel to other work on the 1.9 series.

In this post, we share how the system was disassembled, redesigned, and rebuilt.

Continue reading

MyBB 1.8.33 Released — Security & Maintenance Release

MyBB 1.8.33 is now available, and is a security & maintenance release.

This version improves cache system stability, and compatibility with PostgreSQL (PDO) and recent PHP versions.

  • 1 security vulnerability addressed:

    • High risk: ACP Languages local file inclusion (advisory) — reported by yelang123 (Stealien), NGA (Stealien)
  • 8 issues resolved

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.32 Released — Security & Maintenance Release

MyBB 1.8.32 is now available, and is a security & maintenance release.

This version addresses reported security problems and updates SCEditor to the latest version.

  • 3 security vulnerabilities addressed:

    • High risk: Visual editor persistent XSS (advisory) — reported by Aleksey Solovev (Positive Technologies)
    • Medium risk: ACP Users SQL injection (advisory) — reported by Aleksey Solovev (Positive Technologies)
    • Low risk: Attachment upload XSS (advisory) — reported by Aleksey Solovev (Positive Technologies)
  • 1 issues resolved

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

The MyBB Project extends thanks to reporters and researchers following responsible disclosure.
Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team

MyBB 1.8.31 Released — Security & Maintenance Release

MyBB 1.8.31 is now available, and is a security & maintenance release.

This version resolves discovered bugs and regressions, and improves compatibility with database engines and recent PHP versions.

Please note that the value of Additional Parameters for PHP’s mail() (Mail Settings) now only takes effect when saved in the Configuration File.

Check the Release Notes for more information.

Get latest MyBB Full & Upgrade Packages →

Go to mybb.com/security to report possible security concerns or to learn more about security research at MyBB.
If you would like to contribute to the Project, Get Involved.

Thanks,
MyBB Team