MyBB 1.8.13

07 November 2017

code 1813

SecurityMaintenance

Full Package

Install a new MyBB forum or upgrade from older versions.

.zip – 2.14 MB

Download from MyBB.com Download from GitHub

md5:

30f78d40160011f37bb071767bfea6a5

sha1:

61993c4a6991e1cdcb6de9c77e3760f89189a116

sha256:

1fe127bf840585f1738774b297e847ace4bccbc8a128b3e06ac48b097a1548c5

sha512:

35a7c9d2f98566c6f4e7a2f123b67a3da4163cb449ff400b56fe978d9b0a8df958cd8707f20341dd61e995a1a46372fc053a06a1ca305b5951df698f85f8af5f

Changed Files

Upgrade from the previous version.

.zip – 1.2 MB

Download from MyBB.com Download from GitHub

md5:

8a53d3c67a2a0f515eb9b6c9a090e83b

sha1:

831f8c6bee0bedac185d240a7a680212863a998d

sha256:

f17f6e1820a023427bd543e989dde2b885a865c0de5e1e734beba0385296cecc

sha512:

1a638b4039bbe4e874e7b57716258ffad367b3e6856c6eed0d972e6d763359c26612902f4a9fc2f24d030963100c0b9b7e793443d51e0e07f29fbf15975de10d

How to verify packages

Important Notes

Running the upgrade script is required.

Before performing any upgrade please remember to backup your forum’s files and database and store them safely. If you have edited core files, including language files, please make sure you make a changelog for these changes so you can make them again (if necessary) once the upgrade is complete.

Follow the Upgrade Documentation for more detailed instructions.

This update includes fixes related to compatibility with PostgreSQL, SQLite and PHP 7.2 and resolves attachment HTML output problems. Note that the theme’s CSS files may need to be updated.

Security vulnerabilities addressed (7)

High risk

Installer RCE on configuration file write

Reported by pabstersac

High risk

Language file headers RCE

Reported by Julian Rittweger

Medium risk

Installer XSS

Reported by pabstersac

Medium risk

Mod CP Edit Profile XSS

Reported by Julian Rittweger

Low risk

Insufficient moderator permission check in delayed moderation tools

Reported by Starpaul20 MyBB Team

Low risk

Announcements HTML filter bypass

Low risk

Language Pack Properties XSS

Reported by Julian Rittweger

Issues resolved (62)

View issues on GitHub

Changed Files (175)

moderation.php
member.php
newthread.php
contact.php
showthread.php
usercp.php
modcp.php
install/
- index.php
- resources/
  - language.lang.php
  - settings.xml
  - mysql_db_inserts.php
  - upgrade37.php
  - upgrade41.php
  - mybb_theme.xml
  - output.php
search.php
forumdisplay.php
portal.php
misc.php
archive/
- index.php
- screen.css
- print.css
admin/
- index.php
- jscripts/
  - codemirror/
    - lib/
      - codemirror.css
      - codemirror.js
    - addon/
      - fold/
        
        foldgutter.js
        
        foldcode.js
        
        indent-fold.js
        
        comment-fold.js
        
        brace-fold.js
        
        xml-fold.js
      - search/
        
        match-highlighter.js
        
        jump-to-line.js
        
        search.js
        
        matchesonscrollbar.js
        
        searchcursor.js
      - dialog/
        
        dialog.js
        
        dialog-mybb.css
        
        dialog.css
    - mode/
      - javascript/
        
        javascript.js
        
        test.js
        
        typescript.html
      - css/
        
        gss_test.js
        
        scss.html
        
        gss.html
        
        less.html
        
        scss_test.js
        
        less_test.js
        
        test.js
        
        css.js
      - htmlmixed/
        
        htmlmixed.js
      - xml/
        
        xml.js
    - LICENSE
  - jqueryui/
    - js/
      - jquery-ui.min.js
    - css/
      - redmond/
        
        jquery-ui.min.css
        
        images/
        
        ui-bg_glass_95_fef1ec_1x400.png
        
        ui-bg_inset-hard_100_fcfdfd_1x100.png
        
        ui-icons_6da8d5_256x240.png
        
        ui-bg_gloss-wave_55_5c9ccc_500x100.png
        
        ui-icons_f9bd01_256x240.png
        
        ui-bg_inset-hard_100_f5f8f9_1x100.png
        
        ui-bg_glass_85_dfeffc_1x400.png
        
        ui-icons_cd0a0a_256x240.png
        
        ui-bg_glass_75_d0e5f5_1x400.png
        
        ui-icons_d8e7f3_256x240.png
        
        ui-icons_469bdd_256x240.png
        
        ui-icons_2e83ff_256x240.png
        
        ui-icons_217bc0_256x240.png
        
        jquery-ui.theme.min.css
        
        jquery-ui.structure.min.css
- modules/
  - style/
    - templates.php
    - themes.php
  - user/
    - groups.php
    - group_promotions.php
    - banning.php
    - users.php
  - tools/
    - maillogs.php
    - recount_rebuild.php
    - mailerrors.php
    - statistics.php
    - modlog.php
    - system_health.php
    - tasks.php
    - spamlog.php
  - forum/
    - moderation_queue.php
    - attachments.php
    - announcements.php
  - home/
    - index.php
    - credits.php
  - config/
    - banning.php
    - settings.php
    - plugins.php
    - languages.php
- styles/
  - default/
    - modal.css
    - main.css
- inc/
  - class_page.php
  - functions_themes.php
jscripts/
- thread.js
- jquery.js
- inline_reports.js
- jquery.plugins.min.js
- jquery.plugins.js
- general.js
- validate/
  - jquery.validate.min.js
  - additional-methods.min.js
- bbcodes_sceditor.js
private.php
warnings.php
announcements.php
xmlhttp.php
editpost.php
global.php
calendar.php
newreply.php
inc/
- class_parser.php
- mailhandlers/
  - smtp.php
- functions_search.php
- db_mysqli.php
- languages/
  - english.php
  - english/
    - datahandler_user.lang.php
    - usercp.lang.php
    - helpdocs.lang.php
    - online.lang.php
    - admin/
      - config_settings.lang.php
      - tools_modlog.lang.php
      - user_groups.lang.php
      - home_preferences.lang.php
      - forum_attachments.lang.php
      - global.lang.php
      - home_dashboard.lang.php
      - tools_tasks.lang.php
    - moderation.lang.php
    - portal.lang.php
    - misc.lang.php
    - modcp.lang.php
    - global.lang.php
    - member.lang.php
- functions_post.php
- class_session.php
- db_sqlite.php
- class_captcha.php
- functions_forumlist.php
- functions.php
- 3rdparty/
  - diff/
    - Diff/
      - Engine/
        
        Native.php
        
        String.php
        
        Shell.php
        
        Xdiff.php
      - Exception.php
      - ThreeWay/
        
        Op/
        
        Base.php
        
        Copy.php
        
        BlockBuilder.php
      - Renderer/
        
        Unified/
        
        Colored.php
        
        Unified.php
        
        Context.php
        
        Inline.php
      - Mapped.php
      - Op/
        
        Delete.php
        
        Base.php
        
        Change.php
        
        Copy.php
        
        Add.php
      - ThreeWay.php
      - Renderer.php
    - Diff.php
- db_mysql.php
- class_core.php
- functions_indicators.php
- db_base.php
- class_stopforumspamchecker.php
- class_plugins.php
- functions_online.php
- datahandlers/
  - user.php
  - pm.php
  - post.php
- class_datacache.php

Removed Files (3)

admin/
- jscripts/
  - jqueryui/
    - css/
      - redmond/
        
        images/
        
        animated-overlay.gif
        
        ui-bg_flat_0_aaaaaa_40x100.png
        
        ui-bg_flat_55_fbec88_40x100.png

Changed Language Files (18)

There are changes to 18 language file(s). Changed languages files can be cross-referenced from the list above.

Changed Templates (63)

calendar
calendar_nextlink
calendar_prevlink
calendar_weekview
calendar_weekview_nextlink
calendar_weekview_prevlink
editpost
footer
forumdisplay_inlinemoderation
forumdisplay_thread
headerinclude
managegroup
member_profile_website
member_register
member_register_regimage_recaptcha_invisible
member_resetpassword
misc_whoposted_page
modcp_announcements_allowhtml
modcp_announcements_edit
modcp_announcements_new
modcp_finduser
modcp_ipsearch
modcp_ipsearch_results_information
modcp_modlogs
modcp_reports
modcp_reports_report
modcp_reports_selectall
moderation_delayedmoderation_approve
moderation_delayedmoderation_delete
moderation_delayedmoderation_openclose
moderation_delayedmoderation_softdeleterestore
moderation_delayedmoderation_stick
mycode_url
newreply
newthread
post_captcha
post_captcha_recaptcha_invisible
postbit
postbit_classic
postbit_deleted_member
postbit_editreason
postbit_status
postbit_www
printthread
private
private_advanced_search
private_search_results
search_results_inlinemodcol_empty
search_results_posts_inlinemoderation
search_results_posts_post
search_results_threads_inlinemoderation
search_results_threads_thread
showteam_moderators
showteam_moderators_forum
showthread
showthread_inlinemoderation
showthread_similarthreads_bit
usercp_attachments
usercp_latest_subscribed_threads
usercp_latest_threads_threads
usercp_subscriptions
usercp_subscriptions_thread
video_twitch_embed