XMB Forum Bugs - Issues

0000931: Implement TOTP for 2FA

Tue, 25 Aug 2026 18:42:37 -0700

The 2FA security standards are slowly gaining popularity. Here are some ideas for XMB integration:

- Allow each user to enable or disable 2FA for login.
- Require at least two enrolled devices or a backup code.
- Improve the user lockout experience by offering to unlock via 2FA.
- Give Super Admins the most strict lockout policy.
- Figure out how all of this will interface with existing features.

0000930: Renaming a User Shouldn't Log Out the Admin

Fri, 21 Aug 2026 06:58:30 -0700

The Session API changed for user logout, and the new argument isn't supplied here:

https://github.com/miqrogroove/xmb/blob/b1898487318785d25e28264a9a258fab58d48ded/include/admin.inc.php#L90

0000929: Admin Restrictions Manager has Hard-Coded Text

Thu, 20 Aug 2026 19:33:50 -0700

See the admin_restrictions_start.php and admin_restrictions_end.php templates for untranslated English text.

0000928: Implement the NoDiscard Attribute

Thu, 20 Aug 2026 15:08:04 -0700

PHP 8.5 introduced a "NoDiscard" attribute that can emit warnings if a function or method's return value is never used. Some limited instances of this might be good in the long run.

0000876: PHP 8.6 Compatibility

Thu, 20 Aug 2026 08:32:09 -0700

Items expected to affect XMB compatibility with PHP 8.6:

Type casting a string that contains alphanumeric data will cause an error. No more (int) '56 stuff' allowed. (still under discussion)

Function is_integer() will be deprecated (confirmed).

0000817: Site Health Panel

Mon, 17 Aug 2026 19:47:04 -0700

Would like ability to view phpinfo() output, as well as stats with feedback about overall operation.

Desired features:
- Status of needed PHP extensions.
- Status of the opcache capacity.

0000919: Translate Remaining Installer Text

Mon, 17 Aug 2026 19:36:00 -0700

The cinst.php file has several areas of untranslated English text that need to be migrated.

0000922: Translate the Template Output Comments

Mon, 17 Aug 2026 19:35:24 -0700

When tagging template boundaries in class Template, the comment text should be in the forum's default language rather than always English.

0000927: Posting Ban Option in Profile Editor

Mon, 17 Aug 2026 19:33:59 -0700

It doesn't make sense that the U2U/Posting ban option is only found in the Admin Member search page. This needs to be easier to find in the profile editor.

0000926: Incorrect Column Count for IP Banning Element

Sun, 16 Aug 2026 05:30:55 -0700

When the host name lookup was removed from IP Banning for v1.9.11, the corresponding column count wasn't adjusted.

0000925: Undefined variable $curgroup

Sat, 15 Aug 2026 20:15:17 -0700

The $curgroup variable is not correctly initialized in template admin_forums_list_grouped_subs.php. Previous versions used a sloppy code path to create this variable, which was not considered when the template was migrated to the new processing system.

0000924: Make Names Read-Only in Admin Forum List

Wed, 12 Aug 2026 07:02:54 -0700

Switching the forum name textboxes to simple link text in the admin forum list solves three problems:

1. We no longer need a separate "More Options..." link for every forum.

2. The forum list is too busy and mass editing of names was never necessary.

3. The forum list is too busy and the mass delete feature was never needed nor labeled anyway.

0000923: Implicit Type Casting in Admin Forums Panel

Wed, 12 Aug 2026 06:51:23 -0700

I'm seeing an array key type mismatch here:

https://github.com/miqrogroove/xmb/blob/b1898487318785d25e28264a9a258fab58d48ded/admin/forums.php#L79

PHP always performs an implicit type cast in this situation, but I don't want to rely on that behavior.

0000921: Provide Default Unit "px" For Theme Values

Mon, 10 Aug 2026 10:37:27 -0700

The deprecated HTML table attributes, such as cellpadding, used integer values without units, and are also compatible with string values including units. CSS properties, on the other hand, are intolerant of missing units. This makes the existing theme variables impossible to use in CSS if the theme developer never provided a unit with any numeric values.

XMB needs to provide a valid default unit of "px" when the theme contains only a numeric value.

0000916: Refactor All HTML Tables

Mon, 10 Aug 2026 07:13:56 -0700

All of the layout tables need to be replaced by CSS styles.

This could become a component of a full refactor, but the tables represent a highly repetitive problem and it's a good starting place.

0000920: Unclosed Element in Admin Search Results

Sun, 09 Aug 2026 18:49:31 -0700

The HTML strings generated by admin/search.php are missing the closing tags of some elements.

0000918: Wrong Link in Welcome Text

Sat, 08 Aug 2026 16:09:00 -0700

There is still a reference to cp.php hiding somewhere...

I couldn't find it in the source code. I believe this is an upgrade issue. Previous versions wrote a setting named 'tickercontents' and v1.10 fails to upgrade that value to match the new URL structure.

0000833: "Your Personal Features" bar Should be Optional or Removed

Wed, 05 Aug 2026 08:35:28 -0700

The "Your Personal Features" bar really clutters up the front page and isn't very useful.

0000917: WEBP file with JPG extension gets no thumbnail.

Wed, 29 Jul 2026 20:15:20 -0700

I uploaded a WEBP successfully with a .jpg extension in the filename, and it generated no errors and no thumbnail.

Past versions of XMB never checked whether an image type recognized by GD was included in the filename extension filter, which caused some inconsistent behavior with newer type such as WEBP.

0000915: Move Template Start/End Comment Setting to Admin Panel

Mon, 27 Jul 2026 16:20:20 -0700

There is no reason to have the template "$comment_output" setting hidden in the config file. Let's move it to the admin panel.

0000912: "5 latest topics" on the stats page actually shows the last replies to the board

Mon, 27 Jul 2026 07:39:57 -0700

The heading implicates that it should be the last five threads that were created.

However, it shows the last five threads in order of which they were replied to instead.

This could be resolved via either adding the relevant SQL query and keeping the old one with a new heading, renaming the old one, or changing the query.

(Making the stats page more useful would be quite nice, to be fair. There's probably some things I could think of.)

0000722: How to Mitigate TLS Inspection

Mon, 27 Jul 2026 06:55:31 -0700

TLS Inspection is a potential threat to all web servers and to any client not administered by the end user. For example, the user of a computer at work or at a library might not realize the client's root trust list has been compromised.

The result of a TLS Inspection deployment is that the TLS channel cannot be trusted at either end, and is effectively not confidential. This exposes passwords, session cookies, and all other data on the wire. Unfortunately, this is almost entirely beyond the control of the end user, and next to impossible to detect at the server.

At the scripting level, almost nothing can be done short of redundantly implementing full asymmetric cryptography for both the client and server. If the inspection threat is sufficiently malicious, then scripting solutions are moot because script itself can be compromised to defeat any form of trust.

At the transport level, the obvious remedy is something like Apache's `SSLVerifyClient require` directive. But this means a full PKI deployment to end users, just to protect confidentiality at the server level. It also implies end users would be tied to their own devices or risk trying to use personal certificates on foreign clients. To further complicate matters, the certificates would have to be tied to each user's account so that one user couldn't proxy traffic for another.

This is a systemic risk to the whole Internet, but I am interested in any practical mitigation.

0000914: Session System Improvement

Mon, 27 Jul 2026 06:54:46 -0700

The XMB session subsystem has been expanded to allow easier extension beyond the default implementation.
- The session Mechanisms are now registered during XMB bootup, rather than hard coded inside the Session files.
- Login links are displayed only when a compatible Mechanism is registered.
- Logout links are displayed only when the current session has that capability.
- A proof of concept for an alternative Mechanism is provided in Certificates.php, which is not registered by default.
- BootupLoader::setVisit() moved to Login::setVisit() for consistent dependency structure.
- Core::getLoginLink() moved to Login::getLoginLink() for consistent dependency structure.

0000889: Increase PHP Requirement to v8.4

Wed, 15 Jul 2026 13:04:34 -0700

We are already seeing dependencies like Symfony Mailer that no longer support PHP 8.2. An increase of the PHP version should be considered.

0000877: Update Symfony Mailer to v8

Wed, 15 Jul 2026 13:04:34 -0700

Symfony 8.0 is available and should be updated for testing.