XMB Forum Bugs - Issues

0000908: XMB 1.10.05 throws Fatal error: Uncaught TypeError

Sun, 14 Jun 2026 21:42:44 -0700

Hello,

I was in the process of manual installation of XMB 1.10.05 on PHP 8.2, MYSQL 5.7, Apache 2.4.

However post entering database details and administrator details , clicking on 'Proceed to installation' throws following error i.e

Fatal error: Uncaught TypeError: XMB\Password::__construct(): Argument # 1 ($features) must be of type XMB\Features, XMB\SQL given, called in install/WizFunctions.php on line 253 and defined in include/Password.php:43 Stack trace:
# 0 install/WizFunctions.php(253): XMB\Password->__construct(Object(XMB\SQL))
# 1 install/wizard.php(402): XMB\installer_factory(Object(XMB\MySQLiDatabase), Object(XMB\SiteData), Object(XMB\HttpOutput), Object(XMB\Variables))
# 2 install/web-header.php(54): require('...')
# 3 install/index.php(31): include('...')
# 4 {main} thrown in include/Password.php on line 43

What could be the cause of the issue?. Could you please check and replicate?.

0000907: Too Much Whitespace After BBCode Blocks

Thu, 11 Jun 2026 05:22:17 -0700

XMB always adds a crazy amount of whitespace after bbcode, and sometimes before too. This needs to be tightened up for ease of use.

Likely to have backward compatibility issues with existing content.

0000722: How to Mitigate TLS Inspection

Wed, 10 Jun 2026 17:44:17 -0700

TLS Inspection is a potential threat to all web servers and to any client not administered by the end user. For example, the user of a computer at work or at a library might not realize the client's root trust list has been compromised.

The result of a TLS Inspection deployment is that the TLS channel cannot be trusted at either end, and is effectively not confidential. This exposes passwords, session cookies, and all other data on the wire. Unfortunately, this is almost entirely beyond the control of the end user, and next to impossible to detect at the server.

At the scripting level, almost nothing can be done short of redundantly implementing full asymmetric cryptography for both the client and server. If the inspection threat is sufficiently malicious, then scripting solutions are moot because script itself can be compromised to defeat any form of trust.

At the transport level, the obvious remedy is something like Apache's `SSLVerifyClient require` directive. But this means a full PKI deployment to end users, just to protect confidentiality at the server level. It also implies end users would be tied to their own devices or risk trying to use personal certificates on foreign clients. To further complicate matters, the certificates would have to be tied to each user's account so that one user couldn't proxy traffic for another.

This is a systemic risk to the whole Internet, but I am interested in any practical mitigation.

0000906: Default Theme Data are Duplicated in images, cinst.php, and upgrade.lib.php

Sat, 30 May 2026 15:07:13 -0700

It might be easier in the long run to import the theme file during install and upgrade, rather than duplicating the whole thing as SQL commands.

0000905: Google Requires Pinned Certificate Change Before June 15

Sat, 30 May 2026 14:49:27 -0700

Many services, including googleapis.com, will shift to using the Google Trust Services WE1 intermediate and ECDSA based TLS certificates.

Potential impact:
If your client applications are not configured correctly, they may be unable to connect to Google services after this change. Connection failures are most likely to occur in the following two scenarios:

Certificate pinning: We do not recommend pinning intermediate or leaf certificates. This practice will cause your application to break during routine certificate rotations.
Custom trust stores: If you use a custom trust store, you must ensure it includes all of Google Trust Services (GTS) Root CAs to prevent outages.
For most customers, no action is required as a result of this change. However, if you run a custom trust store or pin CAs, you may need to take action. We’ve provided additional information to guide you through this change.

What you need to do
Action advised before June 15, 2026:

Ensure you trust all Google Trust Services Root CAs as detailed in this Google Trust Services Certificates documentation.
Pinning is discouraged. If you choose to pin, ensure that all Google Trust Services Roots and, if applicable, intermediates are in your pin list.
Timeline:
Services will shift to new intermediates throughout late Q2 2026.

Impacted customers/accounts:
Any cloud project using a limited set of trusted roots or pinning certificates may experience issues.

We’re here to help
Please review the Google Trust Services announcement for guidance on ensuring reliable connections to Google services.

If you have any questions or require assistance, please contact Google Cloud Support.

Thanks for choosing Google Cloud.

— The Google Cloud Team

0000899: Replace HTTP Status Headers with Native Calls

Mon, 25 May 2026 09:02:51 -0700

Since PHP v5.4, the native function http_response_code() is provided for building status headers. XMB 1.9.11 was the last version to support PHP less than 5.4, but this still hasn't been modernized since then.

0000898: Make it easier to bootup for non-upgrade CLI scripting

Thu, 21 May 2026 13:48:18 -0700

Trying to debug with custom code files from the command line is tricky without invoking the upgrade flag constant.

0000876: PHP 8.6 Compatibility

Thu, 21 May 2026 03:21:40 -0700

Items expected to affect XMB compatibility with PHP 8.6:

Type casting a string that contains alphanumeric data will cause an error. No more (int) '56 stuff' allowed.

0000894: Subject Columns Should be Same Type

Tue, 12 May 2026 06:01:27 -0700

A problem was introduced with v1.9.1 where the posts.subject type changed to TINYTEXT with no corresponding increase in the threads table.

https://github.com/miqrogroove/xmb/blob/d7b35218d68421ee7b9edc0c8ffdf5fe3a893855/Files/install/cinst.php#L327

0000569: Reported Posts: add note to the post

Tue, 05 May 2026 23:59:19 -0700

Reported Posts:
- add an Admin setting that allows text along the lines of 'post has been reported' to the actual post or add a new post to the topic/thread [that can be removed later] so that members can see it's already been reported and so hopefully multiple members don't report the same post.

0000890: Allow Caching of Search Results

Mon, 27 Apr 2026 03:32:52 -0700

It's a little annoying that I can't use the browser's Back button to return to my search results in XMB. The caching policy should allow at least temporary reuse of these pages.

0000889: Increase PHP Requirement to v8.4

Wed, 22 Apr 2026 17:35:31 -0700

We are already seeing dependencies like Symfony Mailer that no longer support PHP 8.2. An increase of the PHP version should be considered.

0000877: Update Symfony Mailer to v8

Wed, 22 Apr 2026 17:35:31 -0700

Symfony 8.0 is available and should be updated for testing.

0000882: Subject Schema is Different for Posts and Threads

Sat, 31 Jan 2026 08:05:36 -0800

The subject field length and type needs to be unified because there's no advantage to having them work differently in 2 tables.

0000878: Don't Use the Error Template on 404 Pages

Thu, 08 Jan 2026 15:54:52 -0800

XMB has long used the error template when items are not found.

With v1.9.11, the 404 status code was added to these pages.

Now, we need to stop displaying the error template when items are not found.

0000875: Allow Relocation of config.php

Sun, 28 Dec 2025 07:02:05 -0800

For an extra layer of security, it needs to be possible to change the location of the config.php file without breaking everything.

0000873: Session Token Encryption

Mon, 22 Dec 2025 10:47:06 -0800

v1.9.12 brought us session tokenization and v1.10 brought us good improvements for password hashing.

Now we need to go a step further and protect session token storage so that any kind of database exposure would not facilitate authentication by a 3rd party.

0000872: Asynchronous Mail Delivery

Sun, 21 Dec 2025 09:08:22 -0800

The Symfony mailer causes significant page load delays when using SMTP. Need to add asynchronous delivery for most situations.

0000870: Attachment Search for Orphaned Files

Fri, 19 Dec 2025 06:22:41 -0800

The attachment search feature does a reasonable job of representing orphaned objects (files that have no associated post in the forums). However, there is no option to specifically find orphaned attachments only.

0000807: UTF-8 Schema

Mon, 22 Sep 2025 10:28:36 -0700

The diverse string formats in the schema are one of the last things still driving me crazy in terms of maintaining this code base. This is the path forward:

Convert all "double-slashed" strings to unslashed strings, no exceptions.

Start brainstorming tools and procedures for conversion to UTF-8 encoding.

If helpful, add schema columns that would aid the encoding conversion.

Update page headers and templates with the new charset.

Start addressing PHP charset use and any security implications.

Create new translation files.

Determine if non UTF-8 encodings will be supported or dropped completely.

0000421: LIMIT start, ppp Does Not Scale Well

Sat, 20 Sep 2025 06:43:37 -0700

During optimization testing on Exhale, I found that the LIMIT command runs about 10 times faster using an index instead of the table data. Thus, we now have two queries instead of one when we need to query paged information.

The remaining problem is that this wont be helpful for a forum that grows 10 times larger than Exhale. If a forum had on the order of 10^6 threads or if a thread had 10^6 replies, then even the index scan would become rather onerous for the sake of locating page boundaries.

It may be worth researching alternative strategies for paging information with greater magnitude. It may not be compatible with XMB 1.9.11, but it would be nice to know what direction these optimizations will take in the future. Partitioning? Stats tables? Views?

0000858: Input Font Should Be Configurable

Thu, 11 Sep 2025 08:28:02 -0700

In the theme editor, we have only one font setting, whereas the CSS template uses hard-coded font-family for input elements to avoid using weird theme fonts for input. This needs to be easier to configure.

0000857: Move Text Color to CSS

Thu, 11 Sep 2025 07:37:22 -0700

Text color has been specified in HTML since XMB v1.1. This is confusing, inconsistent, and we're not sure if anyone distinguishes the body color from the table color. This needs to be moved to CSS and/or combined with the table text color setting.

0000841: Whosonline Queries Can Be Less Frequent

Wed, 10 Sep 2025 06:49:01 -0700

Sending a DELETE query for every hit is not necessary and can be easily improved upon.

Also, the thread SELECT queries can be consolidated for faster loading of misc.php?action=online

0000856: Header 'pluglinks' Should Have a Default / Themeable Icon Setting

Wed, 10 Sep 2025 06:10:04 -0700

Using a fixed filename in config.php makes the pluglink icons somewhat incompatible with the theme system.