Aurora
Adminer
Auto Root
WP Admin
cPanel Reset
Anti Backdoor
Root
var
softaculous
phpbb
Upload
New Folder
New File
Name
Size
Permissions
Actions
..
-
-
-
Upload File
Select File
New Folder
Folder Name
New File
File Name
Add WordPress Admin
Database Host
Database Name
Database User
Database Password
Admin Username
Admin Password
cPanel Password Reset
Email Address
Edit: changelog.txt
Changes since 3.3.18 Security & Hardening [SECURITY-298] - Resend rate limiting incorrectly updating expiration time [SECURITY-300] - Attachment comment hijacking by other users [SECURITY-301] - Reflected XSS via data passed to registration page [SECURITY-302] - Hide oauth provider secrets in ACP [SECURITY-303] - Potential stored XSS for string profile fields when allowing any character [SECURITY-305] - Missing permission type check when applying role based permissions [SECURITY-306] - Disclosure of hidden or unapproved topic title when emailing topic [SECURITY-307] - Banned Users can email members despite ban status: [SECURITY-308] - Releasing of held private messages missing CSRF protection [SECURITY-309] - Missing encoding of username in anti abuse header [SECURITY-310] - MCP topic view mixing access checks for post and topic [SECURITY-311] - Moderators with f_user_lock permission may close other user's topics [SECURITY-312] - Unauthenticated SMTP Command Injection via Contact Form [SECURITY-313] - Moderators can close/delete reports outside their forum permissions [SECURITY-314] - MCP make normal action for topics missing check for forum-scoped moderators Changes since 3.3.17 Bug [PHPBB-17134] - BBCode UID Throwing Deprecation Errors [PHPBB-17607] - Missing language key for copy_file in convertor [PHPBB-17652] - set_custom_style() in acp_extensions uses hardcoded adm path instead of $phpbb_admin_path [PHPBB-17662] - Inline attachments are not sorted correctly in other topic viewers [PHPBB-17694] - Incorrect "disapprove whole topic" detection due to undefined $topic_id in disapprove_posts() [PHPBB-17697] - Bot can be added with no name Improvement [PHPBB-17623] - switch twitter to x in profile [PHPBB-17640] - Add php event for custom quick actions in groups [PHPBB-17643] - Github actions merging branches should only occur in source repo [PHPBB-17656] - Add shorter guest session time and AI bots group [PHPBB-17661] - Add event to 'View topic' in MCP to modify template New Feature [PHPBB-17665] - Add automatic admin notifications on security updates Security & Hardening [SECURITY-298] - Resend rate limiting incorrectly updating expiration time [SECURITY-300] - Attachment comment hijacking by other users [SECURITY-301] - Reflected XSS via data passed to registration page [SECURITY-303] - Potential stored XSS for string profile fields when allowing any character [SECURITY-305] - Missing permission type check when applying role based permissions [SECURITY-306] - Disclosure of hidden or unapproved topic title when emailing topic [SECURITY-307] - Banned Users can email members despite ban status: [SECURITY-308] - Releasing of held private messages missing CSRF protection [SECURITY-309] - Missing encoding of username in anti abuse header [SECURITY-310] - MCP topic view mixing access checks for post and topic [SECURITY-311] - Moderators with f_user_lock permission may close other user's topics [SECURITY-312] - Unauthenticated SMTP Command Injection via Contact Form [SECURITY-313] - Moderators can close/delete reports outside their forum permissions [SECURITY-314] - MCP make normal action for topics missing check for forum-scoped moderators Changes since 3.3.16 Bug [PHPBB-17639] - Installation under PHP 8.4 failed with timeout detection reason check_filesystem.php [PHPBB-17650] - Migrator bug prevents complete uninstallation for certain extensions [PHPBB-17651] - Notification manager tests fail on mssql [PHPBB-17658] - Testing for 3.3.x is broken on PHP 8 Improvement [PHPBB-17659] - Move oauth login to controllers Hardening [SECURITY-292] - Improve secure downloads referer checking [SECURITY-295] - Hardening of hostname lookups Security Issue [SECURITY-293] - Improper state verification in OAuth implementation [SECURITY-294] - Improper access verification when setting permissions in ACP [SECURITY-296] - Ensure proper casting in profile field migration Changes since 3.3.16-RC1 Hardening [SECURITY-289] - Hardening against non-rasterized image uploads Security Issue [SECURITY-285] - Password Reset Link Poisoning [SECURITY-286] - IDOR when composing PMs [SECURITY-287] - CSRF on report submission [SECURITY-290] - Cross-User Notification Read State Manipulation Changes since 3.3.16-RC1 Hardening [SECURITY-289] - Hardening against non-rasterized image uploads Security Issue [SECURITY-285] - Password Reset Link Poisoning [SECURITY-286] - IDOR when composing PMs [SECURITY-287] - CSRF on report submission [SECURITY-290] - Cross-User Notification Read State Manipulation Changes since 3.3.15 Bug [PHPBB-14401] - Sphinx: Remove ending slash from binlog_path [PHPBB-15085] - HTTP authentication from feeds served via controller [PHPBB-17034] - Rank post limit [PHPBB-17157] - Read Topic Permission With Search permission [PHPBB-17399] - Add select attribute for British English the default language [PHPBB-17475] - Overflow on resynchronize statistics when running on MSSQL with large number of attachments [PHPBB-17477] - Problem with Whois lookups returning incorrect information due to ARIN/RIPE changes [PHPBB-17486] - Upgrade from 3.0 to 3.3 fails with SQL "Incorrect integer value" error [PHPBB-17491] - Ascending posts pagination in version 3.3.15 [PHPBB-17504] - Tests fail because of changed label of ondrej/php repo [PHPBB-17506] - PHP fatal error on install [PHPBB-17510] - CodeSniffer ruleset is reported as DEPRECATED [PHPBB-17519] - Cron URLs are encoded incorrectly [PHPBB-17527] - PHP fatal error when decorating Twig phpBB extension service in phpBB extension [PHPBB-17533] - Reverting migrations may cause restoring incorrect data and throw "module exists" exceptions [PHPBB-17563] - CodeSniffer ruleset (PPSSE) not fully compatible with CS 4 [PHPBB-17565] - Incorrect exporting PM as CSV for Excel [PHPBB-17580] - Downloading files with a byte range of 8192 bytes causes fatal error [PHPBB-17589] - QA captcha appears on every other login attempt [PHPBB-17622] - Version helper may return update from newer branch Improvement [PHPBB-13481] - Explain in ACP Attachment settings images get resized (at client-side) [PHPBB-15007] - Add Restart link to installer [PHPBB-16941] - Add Sphinx search backend tests [PHPBB-17498] - Move GitHub Actions Ubuntu 20.04 runners to Ubuntu 22.04 [PHPBB-17536] - Add event to Edit forum in ACP to modify template [PHPBB-17538] - Terms and Policy wording improvements [PHPBB-17555] - Improve running of tests on windows runners in GitHub Actions [PHPBB-17570] - Replace an old CSS accessibility hack with a modern, recommended and W3C compliant method [PHPBB-17598] - Deny access to composer files in apache [PHPBB-17605] - Fix homestead and use a fork since is no longer maintained [PHPBB-17620] - Skip whois test when daily rate-limit is reached [PHPBB-17621] - Change U_WARN to use new warn_allowed variable New Feature [PHPBB-17515] - Add new event to: ucp_pm_viewmessage.html Task [PHPBB-17110] - Reword "slander" to "libel" in registration legalese [PHPBB-17545] - Improve handling of DDoS/brute force attacks on login form [PHPBB-17584] - Exclude tests from PSR1 code sniffs [PHPBB-17591] - Update to Code Sniffer 4 [PHPBB-17593] - Allow functional tests on a secure local server [PHPBB-17612] - Remove imageset to css converter [PHPBB-17613] - Remove support for retired WebPI packages [PHPBB-17628] - Update composer and node dependencies