6.0.3 Fix Installer

v6.0.3

Release 6.0.3

6.0.1 Various bug fixes

v6.0.1

Release 6.0.1

6.0 PHP 8 support and security improvements

This release covers everything merged since 5.2.23: a PHP 8.2 compatibility pass and a
security-hardening pass across authentication, sessions, cookies, output escaping, and
outbound mail. It also drops several long-obsolete bundled third-party libraries in favor
of PHP 8 built-ins and current upstream versions.

Action required on upgrade: this release changes the database schema (patch
2026062900) and the format of stored passwords and session IDs. Run the admin upgrade
page after deploying. See "Upgrading" below before you roll this out.

Security

Critical

• Passwords are now hashed with bcrypt (password_hash() / password_verify(),
  PASSWORD_DEFAULT) instead of plain MD5. Existing MD5 hashes are transparently
  re-hashed to bcrypt the next time a user logs in successfully — no forced password
  reset is required.
• Session IDs are now cryptographically random — bin2hex(random_bytes(32)) instead
  of an MD5 hash of username/password/microtime.
• Admin session tokens now use HMAC-SHA256 instead of MD5, and are compared with
  hash_equals() to avoid timing attacks (previously a plain == comparison).
• Posting/data signatures now use HMAC-SHA256 (verified with hash_equals())
  instead of MD5.
• Database columns for password, password_temp, sessid_lt, and sessid_st were
  widened to fit the new hash/token formats, and the old userpass index (which
  indexed password hashes) was dropped.

High

• Session and login cookies are now set with HttpOnly, Secure (when the request is
  over HTTPS), and SameSite=Lax via a new phorum_set_cookie() helper.
• Fixed four unescaped XSS sinks: forum names in the moderator panel, search results,
  the admin user list, and the admin forum list.
• Fixed an open redirect on logout — the Referer used to redirect back is now
  validated against $PHORUM['http_path'] before use.

Medium

• Added security response headers on every request: X-Content-Type-Options: nosniff,
  X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, and
  a Content-Security-Policy.
• Outbound mail: newlines are now stripped from To addresses in
  email_functions.php to close a header-injection vector.

PHP 8.2 compatibility

• Removed the T_CHARACTER constant reference (removed in PHP 7) that caused a fatal
  error on boot.
• Fixed the E_WARN constant typo and bare-word (unquoted) array keys, both fatal
  under PHP 8.
• The admin sanity checks now enforce a PHP 8.2 minimum version.
• Added explicit property declarations for classes that relied on PHP's now-deprecated
  dynamic property creation, and #[AllowDynamicProperties] on the third-party
  Crypt_* classes that still need it.
• Replaced $php_errormsg (removed in PHP 8) with error_get_last() in five files.

Dependencies

• PHPMailer 5.2.10 → 6.9.2 (mods/smtp_mail).
• reCAPTCHA v1 → v2 ("I'm not a robot" checkbox) in the Spam Hurdles module —
  configure recaptcha_sitekey / recaptcha_secret; the old v1 keys will not work.
• Removed jQuery 1.4.4, the json2.js polyfill, and random_compat 2.0.2 — all
  superseded by PHP 8 / modern browser built-ins.

Testing & tooling

• Added PasswordMigrationTest (18 tests) covering MD5 detection, bcrypt
  verification, the needs_rehash flag, and the full MD5→bcrypt migration
  round-trip.
• Fixed Codeception config for Codeception 5 (paths.log → paths.output) and added
  codeception/module-asserts.
• Added .phan/config.php for static analysis and a Docker Compose setup
  (nginx + php-fpm 8.4 + MySQL 8) for local development.
• Added release.sh to build tagged, distribution-clean .zip/.tar.gz release
  archives.

Upgrading

1. Back up your database before upgrading.
2. Deploy the new code.
3. Visit the admin panel — Phorum will detect schema version 2026062900 is pending
   and prompt you to run the upgrade, which widens the password, password_temp,
   sessid_lt, and sessid_st columns and drops the userpass index.
4. If you use the Spam Hurdles reCAPTCHA integration, generate new reCAPTCHA v2 keys
   and update recaptcha_sitekey/recaptcha_secret in its settings.
5. No action is needed for existing user passwords — they migrate to bcrypt
   automatically on next login.

Phorum 5.2.23

Missing column force_password_change added.
Quoted text lines truncated after 50 characters #1020.

Phorum 5.2.22

• Redirect to index.php when there's no query string (fixing #1000).
• Replaced shortened array syntax as of PHP 5.4.
• Workaround for corrupted serialized meta data. When database encoding changed from single to multibyte character set unserialize function fails for data with multibyte characters.
• Check banlists for addon.php.
• random_int function defined too late.
• Force password change option. Start of renovation of our password system. First step: New administrator option to force a password change for individual or all users via the control center. After reload a page or after logging-in
  the user lands directly on the (already existing) "change password" dialog in the control center. A message in a red box says "For security reasons, you are required to change your password.". The user can only move inside the control center until he changed the password. Every other link is redirected to the change password dialog.
• Filter link for IP address in user admin panel. Provides an IP address filter clickable link without opening "details". Provided by Scott Finegan.

Template changes:

• Changed some indents and removed comment to closed trac issue 213.
• Unnecessary closing div removed.
• Revision of emerald template.

Phorum 5.2.21

• Convert $PHORUM = $GLOBALS['PHORUM'] to global $PHORUM (fixing #598)
• Fixing various invalid index warnings
• W3C validator: There is no attribute "onChange" (fixing #908)
• W3C validator: Value of attribute "method" cannot be "POST"
• Missing alt-attributes added
• Module Tidy Output is corrupting avatar images (fixing #911)
• Id and name attribute value mismatch (fixing #917)
• Fix character set for search title
• Multi byte safe word wrapping
• Do not substitute smileys in html entities (fixing #827)
• Replace nobr by css
• Create thumbnails as PNG (fixing #895)
• Fix Group Membership filtering
• Random Extension: Implements a PHP 5.x fallback for random_bytes and random_int functions
• Data validation enhanced (fixing #1001 partly)
• Set cookies with httponly (fixing #1001 partly)
• X-Frame-Options added
• Add posting token to login and register (fixing #1001 partly)
• Obsolete assignment by reference (&new) removed
• Replaced ENT_COMPAT by ENT_QUOTES
• Made admin interface XHTML 1.0 Transitional compliant
• Replace PHP short tags
• BBCode Module: New settings for stripping message bodies
• Event Logging Module: Support for for ipv6
• SMTP Module: Upgrade phpmailer

Phorum 5.2.20

• fixed message pruning with umlauts in forum name
• fixed possible stored and reflected XSS on attachment preview (minor, only could affect the author himself)
• fixed minor security flaw on IIS and open redirect, reported by Curesec
• send 500 HTTP status code in case of database error
• Fix access check for user given only by user_id (fixing #892 )
• Fixed PHP 5.4 notice for iScramble code