Our community blogs
We are releasing a patch for IP.Board 3.3.x and 3.4.x to address two CSRF issues and one XSS issue.
It has been brought to our attention that a cross site request forgery issue exists with gravatar images that can allow a potential attacker to cause a user to store a gravatar profile photo that was not desired. Further, during internal reviews of the issue we discovered another CSRF issue that can allow an attacker to mark all private messages as read. Finally, a minor "self XSS" issue has also been patched with this update.
To apply the patch
Simply download the attached zip for your IP.Board version and upload the files to your forum server.
If you are an IPS Community in the Cloud client running IP.Board 3.4 or above, no further action is necessary as we have already automatically patched your account. If you are using a version older than IP.Board 3.4, you should contact support to upgrade.
If you install or upgrade to IP.Board 3.4.7 after the date and time of this post, no further action is necessary as we have already updated the main download zips.
We extend our thanks to Daniel Price, A.K.A ShadeSpeed of the GameMaker Community for notifying us of the gravatar issue privately and promptly.
I would like to announce that I have reduced the price of Tutorials and Keyword Tooltips till the IPS4 official release date. New prices:
- Tutorials: http://community.invisionpower.com/contributors/files/5386-tutorials/
- Regular Price:
- Promotion: $30 - 25% OFF
- Regular Price:
- Keyword Tooltips: http://community.invisionpower.com/contributors/files/6559-keyword-tooltips/
- Regular Price:
- Promotion: $20 - 20% OFF
- Regular Price:
Both apps will be updated to work on IPS4. Tutorials is 95% updated and already in test on my live test board. Keywords Tooltips will be updated in a proper time (updates will take place according to the number of sales of each resource).
If you're willing to buy those resources, that's the time.
Please note that this entry may be a little technical, if you do have any questions, please post them in the comments below.
A little history
IP.Board was first released over ten years ago when the web landscape was very different. A lot of emerging technologies were still trying to define new standards. Very early versions of IP.Board allowed one to specify the document character set and had a default of "ISO-8559-1" which is useful for languages that use latin based characters. This meant, for example, that if you needed Chinese characters you would need to change the character set to something more suitable. This disparity between character sets creates many challenges when working with a single code base.
Even though IP.Board 3 introduced UTF-8 as the default character set for new installations, we're aware that we still have many clients that are not using UTF-8 currently. IPS 4.0 is going to be strictly UTF-8 only which means we need to convert the data before or as part of the upgrade process.
Converting to UTF-8 isn't as simple as changing the database encoding. Merely doing this will simply corrupt the data you have in your database. We need to be a little smarter and use a script to do this work for us.
The great news is that even if you choose to convert your data to UTF-8 today, your IP.Board 3.x will run just fine and you may even find it more efficient as it doesn't have to convert lots of data on the fly.
The IPS UTF-8 Database Converter
We've written a script that can safely convert your database to UTF-8. The script does not overwrite your data until you manually confirm that the conversion process has been successful. This means that there is no risk of corrupting your existing data.
Of course, it is good practice to perform a full MySQL back-up before making any changes to the database as a precaution and we recommend that you do this.
You can download the converter and its instructions here.
How can I tell if I need to convert my database?
When you first run the converter, it'll check your database and let you know if you need to convert or not. Even if you are running UTF-8, you may not be using the correct collation (utf8_unicode_ci) so you have the option of changing your collation which is a very fast procedure and does not need a full conversion to complete.
If you first used IP.Board with IP.Board 3.0 then you may only need to change your database table collation. This isn't a required step and the IPS 4 upgrade process will perform this task if you'd prefer to wait until IPS 4.0 is released.
Please note that while we're happy to provide some pointers within the client forums, this release is not officially supported by our technical support department.
As this is a beta release, please be aware that there may be bugs. If you do spot one, please post it to the IPS Extras bug tracker.