YetAnotherForum.NET v4.0.11

• [NEW] Search: new option "Search for" with Posts (all matching posts), Topics (one result for each topic, with its latest matching post) and Forums (the forums with a matching name)
• [NEW] Short urls: the public pages have shorter lowercase urls (/topic/1/name, /forum/1/name, /post/1/name, /user/1/name, /category/1/name, /album, /albums, /members, /active-users and /team), the page number of a topic is in the path (/topic/1/name/2), the slugs are lowercase and at most 80 characters long, the old urls and urls with an outdated name redirect permanently to the new url
• [NEW] Reactions: the thanks button is replaced by reactions (like, love, haha, hooray, wow) as on Facebook or GitHub, each user can give one reaction to a post, change it, or remove it by clicking it again; the existing thanks are shown as love, and every reaction counts as a thanks for the profile statistics and the hide-thanks BB codes
• [NEW] Admin > Database > Backup (host admin): a zipped backup of the whole database every night (between 1 and 6 o'clock server time) or with "Backup now", the newest backups are kept (7 by default, 0 keeps all), the backups can be downloaded and deleted; the backups are stored outside wwwroot in the BackupFolder of the BoardConfiguration (default App_Data/Backups); the page is only shown when a backup is possible, Host Settings > Server Info shows why not; SQLite: a copy of the database file (VACUUM INTO)
• [NEW] Database backup for SQL Server: BACKUP DATABASE (COPY_ONLY, does not change the backup chain) into a folder that SQL Server and the application share, configured as SqlServerBackupFolder (the folder as SQL Server sees it) in the BoardConfiguration; the docker compose files share the volume yaf-backups between both containers; not available for Azure SQL, without the permission BACKUP DATABASE or when SQL Server doesn't see the folder of the application
• [NEW] Database backup for MySQL / MariaDB: a SQL dump made with MySqlBackup.NET over the connection of the forum (no mysqldump needed); the docker compose file stores the backups in the volume yaf-backups
• [NEW] Database backup for PostgreSQL: a SQL dump made with pg_dump (PgDumpPath in the BoardConfiguration, it must be the same or a newer version than the server); the docker image contains the newest PostgreSQL client tools, the docker compose file stores the backups in the volume yaf-backups
• [NEW] Database backup: the zip also contains the uploaded files and the images of the forum (wwwroot/uploads and wwwroot/images, of each board with MultiBoardFolders) in the folder wwwroot of the zip; files that can't be read are skipped and logged
• [NEW] Theme kit: the npm package @yafnet/theme-kit (same version as YAF.NET) contains the sources of all themes and the forum styles they import, its command line tool yafnet-theme creates a theme from one of them (npx yafnet-theme new mytheme --from cosmo) and builds it (npx yafnet-theme build: bootstrap-forum.min.css and the email templates, with bootstrap-email if installed, otherwise the prebuilt templates); custom themes no longer need the YAF.NET source code; npm run themeKit creates the package in yafsrc/YAFNET.ThemeKit, npm run publishThemeKit publishes it
• [CHANGES] Themes: bootstrap-forum.scss imports Bootstrap and the forum styles from the sass load paths (@import "bootstrap/scss/bootstrap", "forum/chat.scss", ...) instead of relative paths, so a theme folder can be built outside of the source; the compiled css is unchanged
• [CHANGES] Search: a clear button resets the search page
• [CHANGES] Build: npm run webp converts the images with webp-converter directly in build.js, simple-webp-converter is removed because it depends on a vulnerable glob version (GHSA-3g3m-2fjr-6pw4, GHSA-g3hv-75wg-m249); gif files are converted with gif2webp so animations are kept
• [CHANGES] Build: Grunt (only in maintenance mode) is replaced by the Node script build.js, the tasks are started with npm run (npm run build, npm run css, npm run updateVersionNumber, ...)
• [CHANGES] Search: the options (search for, keywords, titles only, results per page) are buttons instead of select lists, changing one updates the results
• [CHANGES] Responses are now compressed (Brotli or gzip, also over https), the css and js files of the forum (several hundred KB) were sent uncompressed
• [CHANGES] The icon font (Font Awesome solid) is preloaded, the browser found it only after the css was loaded, the icons appeared later
• [CHANGES] The forum css only contains the Font Awesome icons used by the forum (found by the new build task fontAwesomeIcons, part of the build and css task) instead of all ~2600 icons: forum.min.css is 52 KB instead of 169 KB (10 KB instead of 29 KB compressed), forum-admin.min.css 39 KB instead of 151 KB
• [CHANGES] The css files no longer contain vendor prefixes for outdated browsers (autoprefixer uses the browserslist defaults instead of the last 2 versions of every browser), each theme is ~40 KB smaller
• [CHANGES] Notify dropdown in the user menu: shows the latest 5 notifications as dropdown items (the whole item links to the post, with the time of the notification) and a "See all Notifications" link to the notification page, instead of the list with the pager that didn't work
• [CHANGES] Admin > Run SQL Query: the results of a select are shown as a table (one table for each result set, NULL values marked, at most 1000 rows each), the CSV text is still available on the CSV tab; the records affected and SQL errors are shown as messages
• [FIXED] Build: dotnet tool restore installed bootstrap-email 1.7.1, which looked for its sass files and templates in its own tool folder, so the email templates could only be built with a global bootstrap-email; the tool manifest now uses version 2.0.0
• [FIXED] Database backup SQL Server: a relative SqlServerBackupFolder (e.g. App_Data/Backups) was passed unresolved to SQL Server, so the backup was always "not supported" (SQL Server didn't find the folder); an absolute folder of SQL Server on another OS (e.g. /var/opt/mssql/backup with the application on Windows) was turned into a Windows path
• [FIXED] Search: the similar topics parsed the topic title as query syntax, so a title with special characters (e.g. the colon of a time) threw a ParseException on every topic view; the query is now built from the analyzed title without the QueryParser (no internal "read past eof" IOException either)
• [FIXED] user profile when there are no user albums
• [FIXED] NuGet packages: YAFNET.UI.Chat no longer contains tsconfig.json and package-lock.json, YAFNET.RazorPages no longer contains package-lock.json
• [FIXED] Cache: deleted and updated rows were announced before the change was written, a delete without rows cleared the caches, and every UpsertAsync raised its event twice
• [FIXED] Cache: a new row was announced before it was written, so the caches were cleared too early and could be filled again with the old data
• [FIXED] OrmLite: the SqlServer, MySql and Sqlite string converters ignored a custom MaxColumnDefinition
• [FIXED] OrmLite MySql: the temporary file of the bulk insert now has a random name and is created exclusively
• [FIXED] Cookies: the cookies of the last visit and the panel states had no HttpOnly flag and no Secure flag, they are HttpOnly now and Secure on https
• [FIXED] Theme Brite: the css file was not minified, it was 297 KB instead of 246 KB
• [FIXED] Search: "All Forums" was not selected in the forum select of the search page, a search url without a forum had no forum selected, a forum in the url was ignored without a search text
• [FIXED] Search: the search keyword was not highlighted in the text of the results, the mark tags were html encoded and shown as text (the title was highlighted correctly)
• [FIXED] Topics: marking a post as answer added the topic id to the url of the post (?t=1)
• [FIXED] Topics: every link to a topic or post was redirected to a longer url (with p, t or m in the query) just to set the page number, the right page is now shown at the requested url; a new topic opens at its topic url
• [FIXED] Admin edit user: the tab shown first was loaded twice, the second response replaced the tab, changes made in the meantime (e.g. moderated or the rank in the user info) were lost when saving
• [FIXED] Register: the page after the registration (the message to confirm the e-mail address) had a script error, the password strength script was added without the password fields
• [FIXED] Register: visiting the register page again after a registration showed the message of the registration again instead of the form
• [FIXED] Search index update task: the nightly update indexed every post of each forum with new posts again (and loaded them all into memory at once), which caused a high cpu load for a long time on bigger boards; only the posts posted or edited since the last update are indexed now
• [FIXED] Background tasks (search index update, digest send, forum delete, prune topics) ignored their start delay and ran immediately, the search index update and digest task ran in the first page request after the start instead of 30 seconds later
• [FIXED] Docker (SQL Server): the database volume was mounted to a wrong path (/var/lib/mssqlql/data instead of /var/opt/mssql), the forum database was not stored in the volume and was lost when the container was recreated
• [FIXED] Docker compose files: the empty mail settings (MailConfiguration__Host / __Port) overrode the defaults with empty values, they are now commented-out examples (with UserName and Password); the setting MailConfiguration__Mail was removed, it doesn't exist
• [FIXED] Docker (SQLite): the database file was stored inside the container and was lost when the container was recreated (e.g. on an update), it is now stored in the volume sqlite-data
• [FIXED] Behind a reverse proxy that terminates https (nginx, Caddy, Traefik, a Do...

YetAnotherForum.NET v3.2.18

• [FIXED] Search index update task: the nightly update indexed every post of each forum with new posts again (and loaded them all into memory at once), which caused a high cpu load for a long time on bigger boards; only the posts posted or edited since the last update are indexed now
• [FIXED] Search: the search keyword was not highlighted in the text of the results, the mark tags were html encoded and shown as text (the title was highlighted correctly)
• [FIXED] Search: the similar topics parsed the topic title as query syntax, so a title with special characters (e.g. the colon of a time) threw a ParseException on every topic view; the query is now built from the analyzed title without the QueryParser (no internal "read past eof" IOException either)
• Bug fixes

YetAnotherForum.NET v4.0.10

• [NEW] Extended unit test suite including repository tests against an in-memory SQLite database
• [NEW] UI tests for changing the e-mail address, two-factor authentication, deleting the own account, the login of not approved accounts, password reset links, editing posts of other users and the history of deleted posts
• [NEW] Form UI tests: save the edit forms of the admin pages, the user editor and the profile without changes (the values must stay the same, no error, and the stored values must be accepted by the fields), and with changed text fields (the changes must be saved)
• [NEW] Crawl UI test: follows the links of the forum as admin, member, guest, forum moderator (no admin) and a member with an other language and time zone (with polls, albums, moved posts, tags, bb codes with scripts in their values, display names and new forums, categories, groups, ranks, medals and profile fields), calls every kind of page with invalid ids, and checks for server errors, error pages, errors in the event log and script of user input (html with a script in names, titles, tags and profile fields) running on any page
• [CHANGES] The client address behind a reverse proxy is taken from X-Forwarded-For / X-Real-IP only for requests of trusted proxies (ASP.NET Core forwarded headers middleware). Proxies in loopback and private networks (same host, LAN, docker) are trusted by default; a proxy or CDN with public addresses (e.g. Cloudflare) has to be added to the new setting BoardConfiguration:TrustedProxies (addresses or CIDR networks), otherwise its address is used as the client address
• [CHANGES] The BBCode rule engine is now async: IReplaceRule.ReplaceAsync, IProcessReplaceRules.ProcessAsync, IBBCodeService.MakeHtmlAsync and ConvertHtmlToBBCodeForEditAsync replace the synchronous methods (breaking change for custom rules that implement IReplaceRule directly, rules based on BaseReplaceRule keep working)
• [CHANGES] Html.LocalizedText with BBCode is now Html.LocalizedTextAsync
• [CHANGES] TopicRepository Prune is now PruneAsync(boardId, forumId, days, permDelete) and deletes the topics
• [CHANGES] Missing translations are shown as [PAGE.TAG] and logged to the event log
• [CHANGES] The unread private messages popup is shown only once per new message (like the pending friends popup), not on every page
• [CHANGES] The web service requests (StopForumSpam, BotScout, AbuseIPDB, IP locator, latest version check) use the IHttpClientFactory (registered with AddHttpClient) instead of a new HttpClient for every request
• [CHANGES] The login cookie contains the security stamp of the user now, after the update all users have to log in again once
• [CHANGES] Changing the own e-mail address needs the current password and is only done after the new address is confirmed with the link of the confirmation e-mail; suspending or deleting the own account needs the current password (accounts of external logins without a password are not asked)
• [CHANGES] "Email this topic" only lets the user choose the recipient (one address), the subject (topic name) and the text (link to the topic) are fixed, and a user can send at most 5 such emails per hour, so the forum can not be used to send spam
• [FIXED] Security: Admin > Languages / Edit Language are host admin pages now: the language files are used by all boards and their texts are html, the admin of one board could put script into the pages of all boards (also for the host admin); the pages can not be granted to board admins anymore
• [FIXED] Security: The test data generator (Admin > Test Data) was only hidden in release builds, its "create" handler still worked for admins with the page access and created boards, users, categories and private messages in any board; all handlers are refused in release builds now and the page is host admin only (also in debug builds)
• [FIXED] Security: Admin > Edit Board had no host admin check and could be granted to the admins of a board (unlike the list of the boards), they could create boards and rename any board; it is host admin only now
• [FIXED] Security: The select lists with icons (category and parent forum of Admin > Edit Forum, the forums of the moderators on the team page, the image, medal, avatar and country lists) showed the texts of the options as html, a forum or category name with html ran script for every user opening the page (on Edit Forum also for the host admin), a quote in a name broke the list; the texts are encoded now
• [FIXED] Security: The forum jump and the other forum selects (search, move topic/message, moderation, prune, delete forum) showed the names of the categories as html, a category name with html ran script on these pages for every user (the forum names were already encoded)
• [FIXED] Security: The tags of a topic were shown as html in the tags field (edit post, tag search of the post forms), a tag with an unclosed html tag (not removed when the topic is saved) ran script for the moderators editing the post and for the users finding the tag
• [FIXED] Security: The admin pages showed the names and descriptions of groups, ranks, access masks, medals (also the category and the messages of the awards) and profile fields, the styles of groups and ranks and the reasons of banned ips as html (also the group names on Edit Forum and Edit Medal), the admin of a board could run script in the pages of the host admin; they are encoded now
• [FIXED] Security: The name of the board was shown as html in the header of every page, in the login notice for guests, in the cookie notice and as the title of the notifications, the admin of a board could run script for all users (also the host admin)
• [FIXED] Security: The simple select lists (e.g. the rank and group filter of the members page, the groups of Admin > Mail, the access masks of Admin > Settings) showed the texts of the options as html
• [FIXED] Security: The names of the custom profile fields (set by the admin of the board) were shown as html in the messages of invalid or missing values (register page, edit profile, admin edit user), the user name of Admin > Register User, the file type of an album upload and the error of a failed attachment upload were shown as html in the notifications
• [FIXED] Security: With display names turned on, the display name of the last poster was shown as html in the topic lists ("by ..."), and the display name of the user in the header of the e-mail and albums pages, a member could run script for everybody viewing the topic list (display names can contain any character)
• [FIXED] Security: The style of a topic title (set by moderators) was written as html into the last topic link of the forum list, it could add attributes like event handlers (script for every visitor, also admins); it is encoded now and only used with "styled topic titles" enabled
• [FIXED] Security: The search index contained the hidden content of posts (hide, hide-reply, hide-thanks, group-hide, hide-posts): every user could find posts by words of hidden content and see them in the highlighted part of the result. Hidden content is not indexed anymore; run Admin > ReIndex to remove it from an existing index
• [FIXED] Security: The html part of the notification e-mails (topic and forum watch mails, reported posts, approval, medals, welcome...) contained the values of users as html and bb code: a topic name, a display name or the reason of a report could add links, images or forms (also disguised [url] links and html in [code] blocks) to the mails other users and the moderators get. The values are text in the html mail now (html encoded, their brackets are no bb codes), only the template text itself is formatted
• [FIXED] Security: Removing a thanks returned the users who thanked a message (names and avatars) for any message id, also of forums the user can't read
• [FIXED] Security: The page load took the forum (and so the access rights) from the forum and category ids of the address when both were set, a topic or message id of another forum was not checked against them; e.g. the print page showed a topic of a hidden forum with the ids of a readable forum in the address (PrintTopic/{hidden topic}?f={readable forum}&c={category}). The forum is now always the forum of the topic/message
• [FIXED] Security: The api of the admin dialogs (banned ips, e-mails, names, user agents and countries, bb code, spam word and replace word import, medals, profile definitions, user import, group access masks, the user statistics) only checked that the user is an admin, an admin of the board without the access to the admin page (Admin > Page Access) could use it anyway; "Grant all" of the page access could grant the pages of the host admin with a manipulated form
• [FIXED] Moderation pages (forum, unapproved posts, reported posts) failed with a server error for a forum that does not exist (e.g. /Moderate/Forums/0); the admin pages Edit BB Code, Rank, Access Mask, Category, Group and Medal failed for a negative id (it was not checked like the other ids)
• [FIXED] Active users (page and admin dashboard): the page failed when a visitor was at the albums of a user (/Albums/{id}, the name was expected in the address) or at an album that does not exist (anymore); the album link had no address (the user id was missing) and its title was shown the other way round (the id when a title is set); the name of a profile or albums location was the text of the address (any text could be shown), it is the name of the user now
• [FIXED] Profile: the birthday was converted like a point in time (from the time zone of the user into the time zone of the viewer), viewers west of the user saw the day before; it is shown as a date now (new IDateTimeService.FormatCalendarDate)
• [FIXED] RSS/Atom feeds: the times of the posts were wrong by the time zone of the user (the time of the user was marked with the time zone of the server); the feeds contain utc times now, the fee...

YetAnotherForum.NET v3.2.17

• [NEW] Extended unit test suite (YAF.Tests, renamed from YAF.Tests.CoreTests) including repository tests against an in-memory SQLite database
• [NEW] UI tests (YAF.Tests.UITests, Playwright): the forum is installed with the install wizard into a LocalDB database and run with IIS Express (no Docker); login, registration, topics, posts, private messages, profile, every page for guests, members and admins, and access checks
• [CHANGES] The client address is taken from X-Forwarded-For / X-Real-IP only for requests of trusted proxies. Proxies in loopback and private networks are trusted by default; a proxy or CDN with public addresses has to be added to the new web.config setting YAF.TrustedProxies (addresses or CIDR networks, separated by comma), otherwise its address is used as the client address
• [FIXED] IP bans could be bypassed: any client could send an X-Forwarded-For header with another address, and the header of several proxies was always read at its first address
• [FIXED] IP bans: a ban matched every address that contained it (e.g. the ban 10.0.0.1 also banned 110.0.0.15 and 10.0.0.12), an invalid mask caused an error; masks are compared exactly, a * matches one part of an ipv4 address
• [FIXED] Login of migrated legacy membership passwords: clear text passwords were compared ignoring the case, base64 hashes were compared ignoring the case, hashes of the ASP.NET membership (salt + password) did not match, a clear text password with a "|" could not be used, unknown formats were compared as clear text
• [FIXED] Deleting an avatar could delete any file of the forum (e.g. /Content/... or a path with ..); only files in the uploads folder are deleted
• [FIXED] Ladder ranks: users were never promoted to the next rank by their number of posts
• [FIXED] User styles: an old style (e.g. of a group the user was removed from or a removed group or rank style) was never removed, the style was not updated when the rank changed, and deleting a group with a style didn't update the styles of its members
• [FIXED] Topic list: the "show topics of the last ..." filter used the wrong period (e.g. "Last Day" showed two days, "Last Six Months" a year) and "Last Year" was missing
• [FIXED] Active users: the crawlers were taken from the wrong flag (members excluded from captchas were shown as crawlers, real crawlers were missing), with guests but without crawlers the crawlers were shown anyway
• [FIXED] Prune topics: 0 or a negative number of days removed all topics, already deleted topics were deleted and counted again, pruning all forums failed with an error when the topics were deleted for good
• [FIXED] Deleting a topic didn't count the posts of its authors again
• [FIXED] Moving posts: the post counts of the topics were wrong when deleted posts were moved, a moved answer stayed the answer of the old topic, and the search index kept the old topic and forum (a post moved to a forum the user can't read was still found)
• [FIXED] Moving a topic: the search index kept the old forum, an invalid number of days for the link of the moved topic caused an error
• [FIXED] Editing a post removed the tags of the topic from the search index
• [FIXED] Tags: a tag entered twice (also with spaces around it) was added twice and the post could not be saved; a tag longer than its column (MySQL) failed
• [FIXED] Admin edit forum: a forum with sub forums could not get a parent; the parent can't be the forum itself or one of its sub forums
• [FIXED] Message history: the comparison of two versions failed with an error for most texts
• [FIXED] Album titles, image captions and the reasons of edited and deleted posts are stored html encoded, saving failed when the encoded text was longer than its column; a changed album title was encoded twice
• [FIXED] Text avatars: a name with "&" created an invalid image, names with several spaces, empty names or names of emoji only failed, a provider key that is no color created an invalid color
• [FIXED] Ignored users: ignoring or removing a user was not shown on the same page, a user could ignore themselves
• [FIXED] Host settings: "Allow private message attachments" could not be saved (the setting was stored under another name)
• [FIXED] Language list: a language file with missing pages or texts caused an error
• [FIXED] Generated passwords could contain three identical characters in a row
• [FIXED] Topic names with " & " became "AandB" in the url instead of "A-and-B"
• [FIXED] Paging: a huge page number in the url caused an error (negative offset)
• [FIXED] Admin -> Database: "Change recovery mode" re-indexed the database instead of changing the recovery mode
• [FIXED] SQLite: the table and column checks used by the database migrations never found existing tables and columns
• [FIXED] MySQL: the current time of the queries was the date only (midnight), e.g. the active users of the day were never removed
• [FIXED] PostgreSQL: the difference of two times in minutes was only the minutes part (2:05 hours were 5 minutes)
• [FIXED] Deleting all rows of a table reported no success when exactly one row was deleted
• [FIXED] Editing a post never approved it (also in forums that are not moderated, or by a moderator), the flags were changed on a copy; the search index kept the old flags
• [FIXED] Editing a post twice in the same second failed on MySQL (the versions of the history have a key of the post and the time)
• [FIXED] Erasing the answer of a topic left the link to the answer (an error), marking a new answer after that failed
• [FIXED] Topic page: the link to a post opened the wrong page when deleted or not approved posts were before it; posts of the same second (MySQL) were listed in a random order
• [FIXED] Deleting a user failed when the user had medals or was ignored by other users (SQL Server, MySQL, PostgreSQL)
• [FIXED] Group e-mails were also sent to disabled and not approved users and users without e-mail address
• [FIXED] Disabled and not approved moderators were listed on the team page and got moderator notifications
• [FIXED] Most active users: the users were not taken by their number of posts
• [FIXED] Signature: the BB codes of the rank were not allowed when the groups allowed none
• [FIXED] Notifications: the number of quotes was the number of received thanks
• [FIXED] Edit settings: the page size (sent by the client) was not checked, it is 1 - 100 now
• [FIXED] Active users of a forum or topic: users that hide their online status were shown, guests were shown as members, members excluded from the captcha as crawlers
• [FIXED] My Topics (watched topics): topics of forums the user can't read anymore were listed, the number of topics for the pager was the number of all topics
• [FIXED] Admin edit forum: the sub forums were not moved with the forum to another category
• [FIXED] Forum statistics: the counts of the parent forum were not updated with a change in a sub forum
• [FIXED] Deleting a forum and moving its topics: the links of moved topics to topics of the new forum stayed, a user with an own access mask in both forums made the delete fail
• [FIXED] Admin medals: saving a medal of another board, saving a medal without a message failed
• [FIXED] Forum jump: the names of the categories were not encoded (html of a category name was shown as html)
• [FIXED] Team page: the names of the moderated forums were shown double encoded in the forum select ("Tom & Jerry")
• [FIXED] Categories were not listed in their sort order
• [FIXED] Admin -> Event log / Spam log: "Delete all" deleted the entries of all boards (the spam log also all other entries), a single entry of another board could be deleted
• [FIXED] Reported posts: the first report of a user was counted as 0 reports
• [FIXED] Message history: the history of a post that was never edited, or of a post that doesn't exist, showed an error
• [FIXED] Event log: the log was never trimmed to the maximum number of entries (only 100 entries were checked)
• [FIXED] Admin -> Private messages: pruning deleted the messages of all boards, 0 days deleted all messages
• [FIXED] A new group created for a role (e.g. of an imported or external user) got the guest access to all forums (also staff forums) instead of the access of the start groups
• [FIXED] Friends: "Approve all" and "Deny all" did nothing (the received requests were never found)
• [FIXED] Thanks: posts of forums the user can't read (and the own posts) could be thanked and their thanks listed, the name of the author was not encoded in the box after removing a thanks, removing a thanks didn't remove its notifications
• [FIXED] Notifications: replies in watched topics and forums didn't update the notification counter of the user until its cache expired
• [FIXED] Multiple boards: an admin could change (and move to the own board) the spam and replace words, access masks, BB codes, categories, ranks and groups of another board with their id
• [FIXED] Admin -> Boards: creating a board changed the culture and language of all boards
• [FIXED] Board statistics: deleted posts, the posts of deleted topics and deleted topics were counted
• [FIXED] Admin -> Boards: deleting a board failed when it had tags, banned user agents or custom profile fields (SQL Server, MySQL, PostgreSQL)
• [FIXED] Registration and e-mail verification: the verification key (an identity token) could be longer than its column (255 characters) and the registration failed on SQL Server, MySQL and PostgreSQL; only a hash of the key is stored now (links sent before the update still work), "resend the verification mail" (login and admin dashboard) sends a new link, on the admin dashboard it could send the mail of another user whose name contains the name of the not approved user
• [FIXED] Watch mails: watchers who can't read the forum (anymore) got the mail with the post, the hidden content of a post ([hide], [hide-reply], [hide-thanks], ...) was ...

YetAnotherForum.NET v4.0.9

• [NEW] added context menu to category and forum on the main
• [FIXED #1769] paging for attachments on admin edit user page
• [FIXED] geoipservice can now correctly handle IPV6 Addresses
• [CHANGES] tweaked the ui to make it more consistend
• Replaced ImageSharp with SkiaSharp

Full Changelog: v4.0.8...v4.0.9

YetAnotherForum.NET v3.2.16

• bug fixes

Full Changelog: v3.2.15...v3.2.16

YetAnotherForum.NET v4.0.8

• [GHSA-phc5-m6cm-5c9f] security fix

YetAnotherForum.NET v3.2.15

• [GHSA-phc5-m6cm-5c9f] security fix

• [NEW] Setting to enable/disable show similiar topics when creating a new topic
• [NEW] full editor button in quick reply (resolves #1728)
• [FIXED #1724] Language Editor
• [FIXED] install/update bbcode extensions on linux
• [FIXED] Login accepted any password for accounts still using legacy Clear/Encrypted password formats
• [FIXED] Any logged-in user could move or split another user's post via the Move Message page
• [FIXED] Any logged-in user could restore/undelete an arbitrary deleted post
• [FIXED] BBCode [url=...] allowed javascript:/data: links to bypass the URL scheme filter
• [FIXED] X-Forwarded-For parsing could not resolve a client IP behind multiple proxy hops, allowing IP bans to be bypassed
• [FIXED] Reputation/Friends/Ignored User actions were vulnerable to CSRF via simple GET links
• [FIXED] Poll controller allowed unauthenticated access and could throw on invalid poll/topic/forum ids
• [FIXED] Forum delete/cleanup background tasks could report as finished while still running, allowing overlapping runs
• [FIXED] Chat hub connection tracking was not thread-safe, causing intermittent errors under concurrent use
• [FIXED] "Hide my online status" user flag had no effect on SQLite installs
• [FIXED] Active/message/private message cleanup queries never deleted anything on MySQL/PostgreSQL
• [FIXED] Half/quarter-hour timezone offsets (e.g. India, Iran, Nepal) were truncated to whole hours
• [FIXED] Reporting a message for the first time could throw an error under concurrent reports
• [FIXED] A transient database error during posting could silently disable the anti-flood delay
• [FIXED] Navigating away from the install wizard mid-setup returned a blank page instead of redirecting
• bug fixes

What's Changed

• Bump autoprefixer from 10.5.1 to 10.5.2 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1713
• Bump webpack from 5.107.2 to 5.108.0 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1714
• Bump Microsoft.Data.SqlClient from 7.0.1 to 7.0.2 by @dependabot[bot] in #1715
• Bump webpack from 5.108.0 to 5.108.3 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1719
• Bump postcss from 8.5.15 to 8.5.16 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1716
• Bump webpack-cli from 7.0.3 to 7.1.0 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1717
• Bump SonarAnalyzer.CSharp from 10.27.0.140913 to 10.28.0.143324 by @dependabot[bot] in #1721
• Bump Microsoft.CodeAnalysis.Analyzers from 5.3.0 to 5.6.0 by @dependabot[bot] in #1720
• Bump webpack from 5.108.3 to 5.108.4 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1725
• Bump @codemirror/state from 6.7.0 to 6.7.1 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1726
• Bump webpack-cli from 7.1.0 to 7.2.1 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1727
• Bump ws from 7.5.10 to 7.5.12 in /yafsrc/YAFNET.UI/YAFNET.UI.Chat by @dependabot[bot] in #1744
• Bump fast-uri from 3.1.0 to 3.1.3 in /yafsrc/YAFNET.UI/YAFNET.UI.Chat by @dependabot[bot] in #1745
• Bump autoprefixer from 10.5.3 to 10.5.4 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1746
• Bump AwesomeAssertions from 9.4.0 to 9.5.0 by @dependabot[bot] in #1748
• Bump postcss from 8.5.19 to 8.5.20 in /yafsrc/YetAnotherForum.NET by @dependabot[bot] in #1749
• Bump axios from 1.17.0 to 1.18.1 in /yafsrc/YAFNET.UI/YAFNET.RazorPages by @dependabot[bot] in #1750
• Bump axios from 1.17.0 to 1.18.1 in /yafsrc/YAFNET.UI/YAFNET.RazorPages by @dependabot[bot] in #1756

Full Changelog: v4.0.6...v4.0.7

• [FIXED] Legacy "Clear" password format lets you log in as anyone with any password
• [FIXED] Account lockout is recorded but never enforced
• [FIXED] Stored XSS via attachment filename
• [FIXED] Stored XSS via [url=...] javascript: scheme bypass using an embedded tab
• [FIXED] Private-message replies leak across users in broadcast threads
• [FIXED] IDOR on attachments
• [FIXED] Private message leak
• [FIXED] PM delete IDOR — no ownership check before deleting a UserPMessage by ID.
• [FIXED] Stored XSS via scheme bypass in bbcode url
• bug fixes

Full Changelog: v3.2.13...v3.2.14