| [7464]
|
johnjamesjacoby
|
Templates: Use static topic tag confirmations.
This change prevents topic tag names from being interpreted as JavaScript when moderators merge or delete tags.
In 2.6, for 2.6.16.
Props rafiem.
|
| [7465]
|
johnjamesjacoby
|
Topic Tags: Escape names before template output.
This change hardens all current topic-tag name presentation contexts, including copied template overrides, by applying HTML escaping through the existing getter filter. It preserves extension behavior at the standard filter priority and avoids double-encoding stored entities.
In trunk, for 2.7.
Props faran66.
|
| [7466]
|
johnjamesjacoby
|
Topic Tags: Escape names before template output.
This change hardens all current topic-tag name presentation contexts, including copied template overrides, by applying HTML escaping through the existing getter filter. It preserves extension behavior at the standard filter priority and avoids double-encoding stored entities.
In 2.6, for 2.6.16.
Props faran66.
|
| [7467]
|
johnjamesjacoby
|
Counts: synchronize metadata across concurrent writes.
Introduce `bbp_bump_count_meta()` to update existing numeric metadata with bounded compare-and-swap retries while preserving WordPress metadata filters, actions, sanitization, and cache invalidation. Apply atomic differences to forum, topic, reply, ancestor, and user contribution counts.
Reconcile counts, engagements, and voices across status transitions, permanent deletion, author changes and reassignment, moderator move/merge/split operations, and repair recounts. Correct recursive forum totals and reply visibility, and preserve term-backed favorites and subscriptions during engagement rebuilds.
Document the count-hook compatibility changes and new helper arguments, and add regression coverage for single-site and multisite workflows.
In trunk, for 2.7.
Props alex-ye.
Fixes #2233.
Fixes #3678.
|
| [7468]
|
johnjamesjacoby
|
Counts: synchronize metadata across concurrent writes.
Introduce `bbp_bump_count_meta()` to update existing numeric metadata with bounded compare-and-swap retries while preserving WordPress metadata filters, actions, sanitization, and cache invalidation. Apply atomic differences to forum, topic, reply, ancestor, and user contribution counts.
Reconcile counts, engagements, and voices across status transitions, permanent deletion, author changes and reassignment, moderator move/merge/split operations, and repair recounts. Correct recursive forum totals and reply visibility, and preserve term-backed favorites and subscriptions during engagement rebuilds.
Document the count-hook compatibility changes and new helper arguments, and add regression coverage for single-site and multisite workflows.
Merges r7467 to 2.6.
In 2.6, for 2.6.16.
See #2233, #3678.
|
| [7469]
|
johnjamesjacoby
|
Forums: Enforce inherited forum visibility.
Forum descendants inherit the most restrictive visibility in their ancestor chain. This change resolves the source forum before displaying aggregate freshness and author links, preventing private or hidden descendant details from appearing through a public parent while preserving them for users who can read every restricted forum in the hierarchy.
In trunk, for 2.7.
Props im_rootkid.
|
| [7470]
|
johnjamesjacoby
|
Forums: Enforce inherited forum visibility.
Forum descendants inherit the most restrictive visibility in their ancestor chain. This change resolves the source forum before displaying aggregate freshness and author links, preventing private or hidden descendant details from appearing through a public parent while preserving them for users who can read every restricted forum in the hierarchy.
In 2.6, for 2.6.16.
Props im_rootkid.
|
| [7471]
|
johnjamesjacoby
|
Documentation: expand count compatibility notes.
Document count-hook timing for creation and moderation, custom-status integration, atomic metadata retry semantics, subforum query filters, and selective repair guidance for existing sites.
In trunk, for 2.7.
See #3678.
|
| [7472]
|
johnjamesjacoby
|
Documentation: expand count compatibility notes.
Document count-hook timing for creation and moderation, custom-status integration, atomic metadata retry semantics, subforum query filters, and selective repair guidance for existing sites.
Merges r7471 to 2.6.
In 2.6, for 2.6.16.
See #3678.
|
| [7473]
|
johnjamesjacoby
|
Forums: Enforce inherited visibility in queries.
Expand restricted forum exclusions to include countable descendants and make read_forum check ancestor access. This prevents search and feeds from exposing content below restricted parents.
Resolve the current user correctly when honoring filtered per-forum moderator access, preserving explicit moderator exceptions throughout descendant trees.
In trunk, for 2.7.
Props winty.
|
| [7474]
|
johnjamesjacoby
|
Forums: Enforce inherited visibility in queries.
Expand restricted forum exclusions to include countable descendants and make read_forum check ancestor access. This prevents search and feeds from exposing content below restricted parents.
Resolve the current user correctly when honoring filtered per-forum moderator access, preserving explicit moderator exceptions throughout descendant trees.
In 2.6, for 2.6.16.
Props winty.
|
| [7475]
|
johnjamesjacoby
|
Counts: avoid forum-wide reply recounts.
Apply a topic's stored public reply count as an atomic forum difference when the topic enters or leaves the public status set. Add a short-circuit filter for integrations that replace the complete persisted transition count operation.
Add coverage for custom hidden statuses, moderation cascades, and the replacement lifecycle.
In trunk, for 2.7.
See #3678.
|
| [7476]
|
johnjamesjacoby
|
Topics: preserve forum context during walker refreshes.
Retain the resolved forum ID during a full topic walker refresh so forum freshness and last-post metadata continue to update after topic moderation and user spam or ham transitions.
In trunk, for 2.7.
See #3679.
|
| [7477]
|
johnjamesjacoby
|
Tests: account for ports in nonce requests.
Build test request hosts from the complete home URL so nonce verification remains stable when the WordPress test environment uses a nonstandard port.
In trunk, for 2.7.
See #3650.
|
| [7478]
|
johnjamesjacoby
|
Counts: avoid forum-wide reply recounts.
Apply a topic's stored public reply count as an atomic forum difference when the topic enters or leaves the public status set. Add a short-circuit filter for integrations that replace the complete persisted transition count operation.
Add coverage for custom hidden statuses, moderation cascades, and the replacement lifecycle.
Merges [7475] to 2.6.
In 2.6, for 2.6.16.
See #3678.
|
| [7479]
|
johnjamesjacoby
|
Topics: preserve forum context during walker refreshes.
Retain the resolved forum ID during a full topic walker refresh so forum freshness and last-post metadata continue to update after topic moderation and user spam or ham transitions.
Merges [7476] to 2.6.
In 2.6, for 2.6.16.
See #3679.
|
| [7480]
|
johnjamesjacoby
|
Tests: account for ports in nonce requests.
Build test request hosts from the complete home URL so nonce verification remains stable when the WordPress test environment uses a nonstandard port.
Merges [7477] to 2.6.
In 2.6, for 2.6.16.
See #3650.
|
| [7481]
|
johnjamesjacoby
|
REST API: Enforce forum visibility for content responses.
This change checks private and hidden forum access, including restricted ancestors, before returning forums, topics, replies, or their attachments through WordPress REST API endpoints.
In trunk, for 2.7.
Props winstoncrooker.
|
| [7482]
|
johnjamesjacoby
|
REST API: Enforce forum visibility for content responses.
This change checks private and hidden forum access, including restricted ancestors, before returning forums, topics, replies, or their attachments through WordPress REST API endpoints enabled by extensions.
In branches/2.6, for 2.6.16.
Props winstoncrooker.
|
| [7483]
|
johnjamesjacoby
|
Replies: Authorize the topic's forum.
Always derive the forum used for reply creation and capability checks from the submitted topic. Continue validating the form's forum ID, but do not allow it to replace the topic's canonical forum.
Add regression coverage for participants and anonymous posters targeting private, hidden, and inherited restricted forums.
In trunk, for 2.7.
Props vvh1te3zz.
|
| [7484]
|
johnjamesjacoby
|
Replies: Authorize the topic's forum.
Backport the reply forum authorization fix from trunk. Always derive the forum used for reply creation and capability checks from the submitted topic, and call `read_forum` for every forum so inherited restrictions are enforced.
Add regression coverage for normal replies and participant attempts to target hidden and inherited restricted forums.
Merges r7483 to 2.6.
In branches/2.6, for 2.6.16.
Props vvh1te3zz.
|
| [7485]
|
johnjamesjacoby
|
XML-RPC: Enforce topic and reply edit rules.
Validate XML-RPC edits and revision restores against bbPress forum access, content structure, and moderation rules. Prevent parent, status, and reply-order changes from bypassing the bbPress lifecycle while preserving allowed content edits and holding moderated content for review.
In trunk, for 2.7.
Props mickey_cyberkid.
|
| [7486]
|
johnjamesjacoby
|
XML-RPC: Enforce topic and reply edit rules.
Validate XML-RPC edits and revision restores against bbPress forum access, content structure, and moderation rules. Prevent parent, status, and reply-order changes from bypassing the bbPress lifecycle while preserving allowed content edits and holding moderated content for review.
In branches/2.6, for 2.6.16.
Props mickey_cyberkid.
|
| [7487]
|
johnjamesjacoby
|
Replies/Topics: Stop writes after failed move and split checks.
Prevent the front-end reply-move and topic-split handlers from changing content after validation errors have accumulated. Preserve the existing shared error handling while stopping move and conversion writes before they occur.
Add regression coverage for unauthorized participant actions, accumulated errors, and successful moderator moves and conversions.
In trunk, for 2.7.
Props phanphanhailong.
|
| [7488]
|
johnjamesjacoby
|
Replies/Topics: Stop writes after failed move and split checks.
Prevent the front-end reply-move and topic-split handlers from changing content after validation errors have accumulated. Preserve the existing shared error handling while stopping move and conversion writes before they occur.
Add regression coverage for unauthorized participant actions, accumulated errors, and successful moderator moves and conversions.
In branches/2.6, for 2.6.16.
Props phanphanhailong.
|
| [7489]
|
johnjamesjacoby
|
Forums: Restrict forum structure and attributes.
Require global forum authority to change hierarchy, order, moderator assignments, and access attributes across theme, admin, REST, and XML-RPC edits. Introduce an object-level capability so BuddyPress Group Admins can manage attributes for their own Group Forums without granting structural access to Group Moderators.
In trunk, for 2.7.
Props hieunx91.
|
| [7490]
|
johnjamesjacoby
|
Forums: Restrict forum structure and attributes.
Require global forum authority to change hierarchy, order, moderator assignments, and access attributes across theme, admin, REST, and XML-RPC edits. Introduce an object-level capability so BuddyPress Group Admins can manage attributes for their own Group Forums without granting structural access to Group Moderators.
In branches/2.6, for 2.6.16.
Props hieunx91.
|
| [7491]
|
johnjamesjacoby
|
Formatting: Use WordPress link relationship parsing.
Preserve bbPress's output-time nofollow wrapper while using the WordPress callback to parse and rebuild link attributes safely. Correct the historical revision annotations and add regression coverage for standard, internal, existing-rel, valueless, and escaped-attribute links.
In trunk, for 2.7.
Props rafiem.
|
| [7492]
|
johnjamesjacoby
|
Formatting: Use WordPress link relationship parsing.
Backport the safer link attribute parsing from trunk while preserving bbPress's output-time nofollow wrapper. Correct the historical revision annotations and add regression coverage for standard, internal, existing-rel, valueless, and escaped-attribute links.
Merges [7491] to 2.6.
In branches/2.6, for 2.6.16.
Props rafiem.
|
| [7493]
|
johnjamesjacoby
|
Subscriptions: Check recipient access before sending notifications.
Subscription relationships can outlive access changes. This change checks each recipient's current forum, topic, and reply permissions before including them in an email, while preserving BuddyPress group-forum access for current members and moderators.
In trunk, for 2.7.
Props jassbugbounty, im_rootkid, nextdoorsec, akemi20, amedit.
|
| [7494]
|
johnjamesjacoby
|
Subscriptions: Check recipient access before sending notifications.
Subscription relationships can outlive access changes. This change checks each recipient's current forum, topic, and reply permissions before including them in an email, while preserving BuddyPress group-forum access for current members and moderators.
This is a backport of [7493] to the 2.6 branch.
In branches/2.6, for 2.6.16.
Props jassbugbounty, im_rootkid, nextdoorsec, akemi20, amedit.
|
| [7495]
|
johnjamesjacoby
|
BuddyPress Groups: Enforce restricted forum visibility.
Apply BuddyPress group membership checks to private and hidden Group Forums outside group requests, including feeds and aggregate queries. Preserve ancestor restrictions, inactive-user denials, moderator filters, subscription checks, and current-group object boundaries.
In trunk, for 2.7.
Props djsplatt.
|
| [7496]
|
johnjamesjacoby
|
BuddyPress Groups: Enforce restricted forum visibility.
Apply BuddyPress group membership checks to private and hidden Group Forums outside group requests, including feeds and aggregate queries. Preserve ancestor restrictions, inactive-user denials, moderator filters, subscription checks, and current-group object boundaries.
This is a backport of [7495] to the 2.6 branch.
In branches/2.6, for 2.6.16.
Props djsplatt.
|
| [7497]
|
johnjamesjacoby
|
Forum Visibility: Exclude restricted explicit-ID queries.
WordPress ignores post__not_in when WP_Query is constrained by p. Replace unreadable forum IDs with an impossible inclusion so private and hidden forums never reach templates which render populated queries after a 404.
In trunk, for 2.7.
Props antonade.
|
| [7498]
|
johnjamesjacoby
|
Forum Visibility: Exclude restricted explicit-ID queries.
WordPress ignores post__not_in when WP_Query is constrained by p. Replace unreadable forum IDs with an impossible inclusion so private and hidden forums never reach templates which render populated queries after a 404.
This is a backport of [7497] to the 2.6 branch.
In branches/2.6, for 2.6.16.
Props antonade.
|
| [7499]
|
johnjamesjacoby
|
Canonical: Prevent permalink guessing for bbPress post types.
Prevent WordPress from guessing canonical permalinks for bbPress post types, because forum visibility may restrict access to the matched content. Extend bbp_is_custom_post_type() to accept post-type names and arrays while preserving its existing post object and ID behavior.
In trunk, for 2.7.
Props foobar7.
|
| [7500]
|
johnjamesjacoby
|
Canonical: Prevent permalink guessing for bbPress post types.
Prevent WordPress from guessing canonical permalinks for bbPress post types, because forum visibility may restrict access to the matched content. Extend bbp_is_custom_post_type() to accept post-type names and arrays while preserving its existing post object and ID behavior.
In branches/2.6, for 2.6.16.
Props foobar7.
|
| [7501]
|
johnjamesjacoby
|
Subscriptions: Protect password-protected content.
Redact author names and post bodies from subscription emails for password-protected forums, topics, replies, and descendant content, while retaining titles and links. This keeps subscription alerts useful without disclosing protected content.
In trunk, for 2.7.
Props vvh1te3zz.
|
| [7502]
|
johnjamesjacoby
|
Subscriptions: Protect password-protected content.
Redact author names and post bodies from subscription emails for password-protected forums, topics, replies, and descendant content, while retaining titles and links. This keeps subscription alerts useful without disclosing protected content.
In branches/2.6, for 2.6.16.
Props vvh1te3zz.
|
| [7503]
|
johnjamesjacoby
|
REST API: Enforce forum visibility for edits.
Apply current forum visibility and inherited access rules to topic and reply edit capabilities, and require the same permission before REST updates. This keeps update, revision, and autosave authorization consistent with direct item responses.
Introduce a shared helper for user-specific restricted-forum checks and add regression coverage.
In trunk, for 2.7.
Props paulos__.
|
| [7504]
|
johnjamesjacoby
|
REST API: Enforce forum visibility for edits.
Backport current forum visibility and inherited access checks for topic and reply edit capabilities and REST updates. This keeps update, revision, and autosave authorization consistent with direct item responses.
Introduce a shared helper for user-specific restricted-forum checks and add regression coverage.
This is a backport of [7503] to the 2.6 branch.
In branches/2.6, for 2.6.16.
Props paulos__.
|
| [7505]
|
johnjamesjacoby
|
Search: Restrict statuses in mixed queries.
Keep forum visibility normalization from broadening topic and reply statuses in shared searches. Apply post-type-aware status constraints so private and hidden content remains unavailable to anonymous users while preserving closed and explicitly authorized statuses.
Introduce a shared string-array normalization helper and regression coverage.
In trunk, for 2.7.
Props vvh1te3zz.
|
| [7506]
|
johnjamesjacoby
|
Search: Restrict statuses in mixed queries.
Backport post-type-aware status constraints for mixed searches, preserving closed and explicitly authorized topic and reply statuses while preventing broader forum visibilities from exposing private and hidden content.
Introduce a shared string-array normalization helper and regression coverage.
This is a backport of [7505] to the 2.6 branch.
In branches/2.6, for 2.6.16.
Props vvh1te3zz.
|
| [7507]
|
johnjamesjacoby
|
Administration: Normalize forum list filter IDs.
Cast the forum filter value to an integer before passing it into numeric meta queries for topic and reply list tables.
This keeps identifier handling consistent with the filter dropdown and avoids passing untyped request data into the query layer.
In trunk, for 2.7.
|
| [7508]
|
johnjamesjacoby
|
Administration: Normalize forum list filter IDs.
Cast the forum filter value to an integer before passing it into numeric meta queries for topic and reply list tables.
This keeps identifier handling consistent with the filter dropdown and avoids passing untyped request data into the query layer.
This is a backport of [7507] to the 2.6 branch.
In branches/2.6, for 2.6.16.
|
| [7509]
|
johnjamesjacoby
|
Topic Tags: Prevent unauthorized tag removal.
Introduce a per-topic, per-tag `remove_topic_tag` meta capability and preserve topic tags a user cannot remove when processing topic and reply forms. This prevents anonymous submissions from clearing existing tags while preserving current behavior for participants and moderators.
In trunk, for 2.7.
Props nomadsyndiode.
|
| [7510]
|
johnjamesjacoby
|
Topic Tags: Prevent unauthorized tag removal.
Introduce a per-topic, per-tag `remove_topic_tag` meta capability and preserve topic tags a user cannot remove when processing topic and reply forms. This prevents anonymous submissions from clearing existing tags while preserving current behavior for participants and moderators.
This backport also restores anonymous read capability mapping for public forum content so enabled guest posting continues through the current reply handler checks.
In branches/2.6, for 2.6.16.
Props nomadsyndiode.
|
| [7511]
|
johnjamesjacoby
|
Topics: Validate converted topic titles.
Apply the standard topic-title filter and validation before converting replies into topics through reply moves or topic splits.
This keeps these alternate creation paths consistent with the normal new-topic handler.
In trunk, for 2.7.
Props rafiem.
|
| [7512]
|
johnjamesjacoby
|
Topics: Validate converted topic titles.
Apply the standard topic-title filter and validation before converting replies into topics through reply moves or topic splits.
This keeps these alternate creation paths consistent with the normal new-topic handler.
This is a backport of [7511] to the 2.6 branch.
In branches/2.6, for 2.6.16.
Props rafiem.
|
| [7513]
|
johnjamesjacoby
|
Users: Restrict Super Moderator profile editing.
Scope Super Moderator user-edit capabilities to front-end bbPress profiles, protect privileged targets, and enforce filterable field and forum-role policies before WordPress writes user data.
In trunk, for 2.7.
Props rafiem, paulos__.
|
| [7514]
|
johnjamesjacoby
|
Users: Restrict Super Moderator profile editing.
Scope Super Moderator user-edit capabilities to front-end bbPress profiles, protect privileged targets, and enforce filterable field and forum-role policies before WordPress writes user data.
In branches/2.6, for 2.6.16.
Props rafiem, paulos__.
|
| [7515]
|
johnjamesjacoby
|
Users: Correct version annotations.
These functions first ship in the 2.6.16 maintenance release, so use that version in trunk as well.
In trunk, for 2.7.
|
| [7516]
|
johnjamesjacoby
|
BuddyPress Groups: Test cross-group access boundaries.
Add regression coverage for forum, topic, and reply shortcodes in an unrelated Group context, along with edit and delete capability checks. This confirms that Group permissions remain scoped to their attached forums while preserving access within the current Group.
In trunk, for 2.7.
Props mickey_cyberkid.
|
| [7517]
|
johnjamesjacoby
|
BuddyPress Groups: Test cross-group access boundaries.
Add regression coverage for forum, topic, and reply shortcodes in an unrelated Group context, along with edit and delete capability checks. This confirms that Group permissions remain scoped to their attached forums while preserving access within the current Group.
This is a backport of [7516] to the 2.6 branch.
In branches/2.6, for 2.6.16.
Props mickey_cyberkid.
|
| [7518]
|
johnjamesjacoby
|
Tests: Update user and BuddyPress compatibility.
Preserve WordPress's native multisite user-permission expectations and rely on the supported current-user setup used by BuddyPress tests. This keeps the suites compatible with current WordPress and BuddyPress releases.
In trunk, for 2.7.
|
| [7519]
|
johnjamesjacoby
|
Tests: Update user and BuddyPress compatibility.
Preserve WordPress's native multisite user-permission expectations and rely on the supported current-user setup used by BuddyPress tests. This is a backport of the test-only compatibility changes for the 2.6 release suite.
In branches/2.6, for 2.6.16.
|
| [7520]
|
johnjamesjacoby
|
Build: Prepare bbPress 2.6.16.
Update package and runtime versions, the stable tag, and the changelog for the 2.6.16 release.
In branches/2.6, for 2.6.16.
|
| [7521]
|
johnjamesjacoby
|
Build: Bump trunk to 2.7.0-alpha-3.
Advance the trunk package and runtime versions to the next alpha and update its stable-release reference to bbPress 2.6.16.
In trunk, for 2.7.
|
| [7522]
|
johnjamesjacoby
|
Build: Tag bbPress 2.6.16.
Copy the 2.6 maintenance branch to its canonical release tag.
In tags/2.6.16, for 2.6.16.
|
| [7523]
|
johnjamesjacoby
|
Build: Install Subversion for releases.
Install the Subversion client in both release jobs before verifying canonical source tags or staging Plugin SVN. Current Ubuntu runners no longer include svn.
In trunk, for 2.7.
|
| [7524]
|
johnjamesjacoby
|
Build: Allow packaged Composer metadata.
Permit composer.json in Plugin SVN release candidates because it is an intentional runtime package file copied from src. Continue rejecting composer.lock and other development-only files.
In trunk, for 2.7.
|
| [7525]
|
johnjamesjacoby
|
Build: Keep smoke-test credentials out of logs.
Suppress WP-CLI command echoes while creating the disposable WordPress configuration and installing WordPress. Retain sanitized progress messages in release evidence.
In trunk, for 2.7.
|
| [7526]
|
johnjamesjacoby
|
Users: Preserve reply status when moderating users.
Process a user's replies before their topics when marking the user as spam or ham. Topic status helpers can transition child replies, so deterministic parent-last processing preserves each reply's stored status and keeps counts synchronized across database result orders.
In trunk, for 2.7.
See #3678.
|
| [7527]
|
johnjamesjacoby
|
Users: Preserve reply status when moderating users.
Process a user's replies before their topics when marking the user as spam or ham. Topic status helpers can transition child replies, so deterministic parent-last processing preserves each reply's stored status and keeps counts synchronized across database result orders.
This is a backport of [7526] to the 2.6 branch.
In branches/2.6, for 2.6.16.
See #3678.
|
| [7528]
|
johnjamesjacoby
|
Build: Prepare bbPress 2.6.17.
Advance the release metadata from 2.6.16 to 2.6.17 after the protected 2.6.16 source tag prevented correcting its release candidate. Reconcile unreleased @since annotations with their first shipped version and include the deterministic user-moderation ordering fix.
In branches/2.6, for 2.6.17.
|
| [7529]
|
johnjamesjacoby
|
Build: Reference bbPress 2.6.17.
Update trunk's stable-release metadata and reconcile unreleased 2.6.16 annotations with their actual first shipped version.
In trunk, for 2.7.
|
| [7530]
|
johnjamesjacoby
|
Build: Tag bbPress 2.6.17.
|
| [7531]
|
johnjamesjacoby
|
Changelog: Link 2.6.17 documentation.
Add links to the Codex upgrade notes and release announcement.
In the 2.6 branch, for 2.6.18.
|
| [7532]
|
johnjamesjacoby
|
Changelog: Link 2.6.17 documentation.
Add links to the Codex upgrade notes and release announcement.
In trunk, for 2.7.
|
| [7533]
|
johnjamesjacoby
|
Build/Test Tools: preserve Plugin SVN development trunk.
Stable releases now update only their maintenance branch, deployment tag, and Playground blueprint. Add regression coverage that requires Plugin SVN trunk to remain unchanged so a stable package cannot replace the development build.
In trunk, for 2.7.
|
| [7534]
|
johnjamesjacoby
|
API - Importers: support modern phpBB password hashes.
This change lets imported phpBB users upgrade bcrypt, Argon2, and combined phpass/bcrypt password hashes on first login. It also validates imported password metadata and adds regression coverage for supported hashes and the password-upgrade callback.
In branches/2.6, for 2.6.18.
Fixes #3683.
|
| [7535]
|
johnjamesjacoby
|
API - Importers: support modern phpBB password hashes.
This change lets imported phpBB users upgrade bcrypt, Argon2, and combined phpass/bcrypt password hashes on first login. It also validates imported password metadata and adds regression coverage for supported hashes and the password-upgrade callback.
In trunk, for 2.7.
See #3683.
|
| [7536]
|
johnjamesjacoby
|
Converters: Fix MyBB password upgrades.
Correct MyBB 1.6 salted MD5 verification and ensure the converter class metadata is imported so first-login password migration can run. Add coverage for password metadata, verification, malformed data, and the complete WordPress password upgrade path.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7537]
|
johnjamesjacoby
|
Converters: Fix MyBB password upgrades.
Correct MyBB 1.6 salted MD5 verification and ensure the converter class metadata is imported so first-login password migration can run. Add coverage for password metadata, verification, malformed data, and the complete WordPress password upgrade path.
In trunk, for 2.7.
See #3684.
|
| [7538]
|
johnjamesjacoby
|
Converters: Fix FluxBB password upgrades.
Verify FluxBB 1.2 MD5, 1.3 salted SHA-1, and newer SHA-1 passwords using their native formats. Detect the optional legacy salt column without breaking current schemas, import the converter class metadata, and add first-login upgrade coverage.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7539]
|
johnjamesjacoby
|
Converters: Fix FluxBB password upgrades.
Verify FluxBB 1.2 MD5, 1.3 salted SHA-1, and newer SHA-1 passwords using their native formats. Detect the optional legacy salt column without breaking current schemas, import the converter class metadata, and add first-login upgrade coverage.
In trunk, for 2.7.
See #3684.
|
| [7540]
|
johnjamesjacoby
|
Converters: Fix PunBB password upgrades.
Verify current salted SHA-1 and legacy unsalted SHA-1 and MD5 passwords using PunBB's native formats. Preserve printable salt characters through WordPress metadata writes, import the converter class metadata, and add first-login upgrade coverage.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7541]
|
johnjamesjacoby
|
Converters: Fix PunBB password upgrades.
Verify current salted SHA-1 and legacy unsalted SHA-1 and MD5 passwords using PunBB's native formats. Preserve printable salt characters through WordPress metadata writes, import the converter class metadata, and add first-login upgrade coverage.
In trunk, for 2.7.
See #3684.
|
| [7542]
|
johnjamesjacoby
|
Converters: Fix Phorum password upgrades.
Verify Phorum 5.2 passwords using their native unsalted MD5 format, remove nonexistent salt handling, and import the converter class metadata so first-login migration can run. Add coverage for metadata, verification, malformed input, and the complete WordPress password upgrade path.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7543]
|
johnjamesjacoby
|
Converters: Fix Phorum password upgrades.
Verify Phorum 5.2 passwords using their native unsalted MD5 format, remove nonexistent salt handling, and import the converter class metadata so first-login migration can run. Add coverage for metadata, verification, malformed input, and the complete WordPress password upgrade path.
In trunk, for 2.7.
See #3684.
|
| [7544]
|
johnjamesjacoby
|
Converters: Delay source database connections until import.
First-login password upgrades use the legacy hash and salt already stored in WordPress user metadata, but converter construction also required the source database to remain available. Connect to the source database only when table conversion begins so imported users can upgrade their passwords after the source database has been retired.
This preserves converter construction and extension points, retains the existing import connection error, and adds coverage for successful and unsuccessful first-login attempts without a source database connection.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7545]
|
johnjamesjacoby
|
Converters: Delay source database connections until import.
First-login password upgrades use the legacy hash and salt already stored in WordPress user metadata, but converter construction also required the source database to remain available. Connect to the source database only when table conversion begins so imported users can upgrade their passwords after the source database has been retired.
This preserves converter construction and extension points, retains the existing import connection error, and adds coverage for successful and unsuccessful first-login attempts without a source database connection.
In trunk, for 2.7.
See #3684.
|
| [7546]
|
johnjamesjacoby
|
Importers: Improve first-login password handling.
Preserve the literal legacy password for verification while passing WordPress the slashed value it expects when storing the upgraded hash. Also support email login and the password `0`, and reject malformed non-string credentials.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7547]
|
johnjamesjacoby
|
Importers: Improve first-login password handling.
Preserve the literal legacy password for verification while passing WordPress the slashed value it expects when storing the upgraded hash. Also support email login and the password `0`, and reject malformed non-string credentials.
In trunk, for 2.7.
See #3684.
|
| [7548]
|
johnjamesjacoby
|
Importers: Correct AEF password upgrades.
Use AEF 1.0.9's charset-aware escaping and salted MD5 algorithm when verifying imported passwords, and store the converter class under the valid user mapping. Add focused and end-to-end regression coverage.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7549]
|
johnjamesjacoby
|
Importers: Correct AEF password upgrades.
Use AEF 1.0.9's charset-aware escaping and salted MD5 algorithm when verifying imported passwords, and store the converter class under the valid user mapping. Add focused and end-to-end regression coverage.
In trunk, for 2.7.
See #3684.
|
| [7550]
|
johnjamesjacoby
|
Importers: Recover password upgrades without class metadata.
Use the saved importer platform when an imported user retains `_bbp_password` but lacks `_bbp_class`. Existing per-user converter metadata remains authoritative, password verification still fails closed, and normal conversions continue to connect to the configured source database.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7551]
|
johnjamesjacoby
|
Importers: Recover password upgrades without class metadata.
Use the saved importer platform when an imported user retains `_bbp_password` but lacks `_bbp_class`. Existing per-user converter metadata remains authoritative, password verification still fails closed, and normal conversions continue to connect to the configured source database.
In trunk, for 2.7.
See #3684.
|
| [7552]
|
johnjamesjacoby
|
Importers: Correct Kunena 1 password upgrades.
Store Joomla's complete `digest:salt` password value, verify its documented salted and legacy unsalted MD5 formats, and persist the converter class for future imports. Existing imported users without class metadata can recover through the saved importer platform.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7553]
|
johnjamesjacoby
|
Importers: Correct Kunena 1 password upgrades.
Store Joomla's complete `digest:salt` password value, verify its documented salted and legacy unsalted MD5 formats, and persist the converter class for future imports. Existing imported users without class metadata can recover through the saved importer platform.
In trunk, for 2.7.
See #3684.
|
| [7554]
|
johnjamesjacoby
|
Importers: Correct Kunena 2 password upgrades.
Preserve Joomla's complete password value and verify its portable, salted MD5, and unsalted MD5 formats. Persist the converter class for new imports while retaining compatibility with existing imported metadata.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7555]
|
johnjamesjacoby
|
Importers: Correct Kunena 2 password upgrades.
Preserve Joomla's complete password value and verify its portable, salted MD5, and unsalted MD5 formats. Persist the converter class for new imports while retaining compatibility with existing imported metadata.
In trunk, for 2.7.
See #3684.
|
| [7556]
|
johnjamesjacoby
|
Importers: Correct Kunena 3 password upgrades.
Preserve Joomla's complete password value and verify its portable, bcrypt, Argon2, SHA-256, and legacy MD5 formats. Persist the converter class for new imports while retaining compatibility with existing imported metadata.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7557]
|
johnjamesjacoby
|
Importers: Correct Kunena 3 password upgrades.
Preserve Joomla's complete password value and verify its portable, bcrypt, Argon2, SHA-256, and legacy MD5 formats. Persist the converter class for new imports while retaining compatibility with existing imported metadata.
In trunk, for 2.7.
See #3684.
|
| [7558]
|
johnjamesjacoby
|
Importers: Correct e107 v1 password upgrades.
Use e107 v1's unsalted MD5 verifier and preserve compatibility with its legacy UTF-8 conversion mode. Retain support for password metadata written by previous bbPress imports.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7559]
|
johnjamesjacoby
|
Importers: Correct e107 v1 password upgrades.
Use e107 v1's unsalted MD5 verifier and preserve compatibility with its legacy UTF-8 conversion mode. Retain support for password metadata written by previous bbPress imports.
In trunk, for 2.7.
See #3684.
|
| [7560]
|
johnjamesjacoby
|
Importers: Correct XMB password upgrades.
Use XMB's unsalted MD5 verifier, persist the converter class correctly for new imports, and retain support for metadata from existing imports.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7561]
|
johnjamesjacoby
|
Importers: Correct XMB password upgrades.
Use XMB's unsalted MD5 verifier, persist the converter class correctly for new imports, and retain support for metadata from existing imports.
In trunk, for 2.7.
See #3684.
|
| [7562]
|
johnjamesjacoby
|
Importers: Correct Drupal 7 password upgrades.
Use Drupal 7's portable password verifier, persist the converter class correctly for new imports, and retain first-login upgrades for interrupted and completed existing imports without requiring the source database. Avoid replacing passwords already recognized by WordPress or password plugins.
In branches/2.6, for 2.6.18.
See #3684.
|
| [7563]
|
johnjamesjacoby
|
Importers: Correct Drupal 7 password upgrades.
Use Drupal 7's portable password verifier, persist the converter class correctly for new imports, and retain first-login upgrades for interrupted and completed existing imports without requiring the source database. Avoid replacing passwords already recognized by WordPress or password plugins.
In trunk, for 2.7.
See #3684.
|
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
