XMB Forum Bugs - Issues

0000924: Make Names Read-Only in Admin Forum List

Wed, 12 Aug 2026 07:02:54 -0700

Switching the forum name textboxes to simple link text in the admin forum list solves three problems:

1. We no longer need a separate "More Options..." link for every forum.

2. The forum list is too busy and mass editing of names was never necessary.

3. The forum list is too busy and the mass delete feature was never needed nor labeled anyway.

0000923: Implicit Type Casting in Admin Forums Panel

Wed, 12 Aug 2026 06:51:23 -0700

I'm seeing an array key type mismatch here:

https://github.com/miqrogroove/xmb/blob/b1898487318785d25e28264a9a258fab58d48ded/admin/forums.php#L79

PHP always performs an implicit type cast in this situation, but I don't want to rely on that behavior.

0000922: Translate the Template Output Comments

Tue, 11 Aug 2026 10:57:04 -0700

When tagging template boundaries in class Template, the comment text should be in the forum's default language rather than always English.

0000921: Provide Default Unit "px" For Theme Values

Mon, 10 Aug 2026 10:37:27 -0700

The deprecated HTML table attributes, such as cellpadding, used integer values without units, and are also compatible with string values including units. CSS properties, on the other hand, are intolerant of missing units. This makes the existing theme variables impossible to use in CSS if the theme developer never provided a unit with any numeric values.

XMB needs to provide a valid default unit of "px" when the theme contains only a numeric value.

0000916: Refactor All HTML Tables

Mon, 10 Aug 2026 07:13:56 -0700

All of the layout tables need to be replaced by CSS styles.

This could become a component of a full refactor, but the tables represent a highly repetitive problem and it's a good starting place.

0000920: Unclosed Element in Admin Search Results

Sun, 09 Aug 2026 18:49:31 -0700

The HTML strings generated by admin/search.php are missing the closing tags of some elements.

0000919: Translate Remaining Installer Text

Sat, 08 Aug 2026 16:09:00 -0700

The cinst.php file has several areas of untranslated English text that need to be migrated.

0000918: Wrong Link in Welcome Text

Sat, 08 Aug 2026 16:09:00 -0700

There is still a reference to cp.php hiding somewhere...

I couldn't find it in the source code. I believe this is an upgrade issue. Previous versions wrote a setting named 'tickercontents' and v1.10 fails to upgrade that value to match the new URL structure.

0000876: PHP 8.6 Compatibility

Wed, 05 Aug 2026 08:39:14 -0700

Items expected to affect XMB compatibility with PHP 8.6:

Type casting a string that contains alphanumeric data will cause an error. No more (int) '56 stuff' allowed. (still under discussion)

Function is_integer() will be deprecated (confirmed).

0000833: "Your Personal Features" bar Should be Optional or Removed

Wed, 05 Aug 2026 08:35:28 -0700

The "Your Personal Features" bar really clutters up the front page and isn't very useful.

0000917: WEBP file with JPG extension gets no thumbnail.

Wed, 29 Jul 2026 20:15:20 -0700

I uploaded a WEBP successfully with a .jpg extension in the filename, and it generated no errors and no thumbnail.

Past versions of XMB never checked whether an image type recognized by GD was included in the filename extension filter, which caused some inconsistent behavior with newer type such as WEBP.

0000915: Move Template Start/End Comment Setting to Admin Panel

Mon, 27 Jul 2026 16:20:20 -0700

There is no reason to have the template "$comment_output" setting hidden in the config file. Let's move it to the admin panel.

0000912: "5 latest topics" on the stats page actually shows the last replies to the board

Mon, 27 Jul 2026 07:39:57 -0700

The heading implicates that it should be the last five threads that were created.

However, it shows the last five threads in order of which they were replied to instead.

This could be resolved via either adding the relevant SQL query and keeping the old one with a new heading, renaming the old one, or changing the query.

(Making the stats page more useful would be quite nice, to be fair. There's probably some things I could think of.)

0000722: How to Mitigate TLS Inspection

Mon, 27 Jul 2026 06:55:31 -0700

TLS Inspection is a potential threat to all web servers and to any client not administered by the end user. For example, the user of a computer at work or at a library might not realize the client's root trust list has been compromised.

The result of a TLS Inspection deployment is that the TLS channel cannot be trusted at either end, and is effectively not confidential. This exposes passwords, session cookies, and all other data on the wire. Unfortunately, this is almost entirely beyond the control of the end user, and next to impossible to detect at the server.

At the scripting level, almost nothing can be done short of redundantly implementing full asymmetric cryptography for both the client and server. If the inspection threat is sufficiently malicious, then scripting solutions are moot because script itself can be compromised to defeat any form of trust.

At the transport level, the obvious remedy is something like Apache's `SSLVerifyClient require` directive. But this means a full PKI deployment to end users, just to protect confidentiality at the server level. It also implies end users would be tied to their own devices or risk trying to use personal certificates on foreign clients. To further complicate matters, the certificates would have to be tied to each user's account so that one user couldn't proxy traffic for another.

This is a systemic risk to the whole Internet, but I am interested in any practical mitigation.

0000914: Session System Improvement

Mon, 27 Jul 2026 06:54:46 -0700

The XMB session subsystem has been expanded to allow easier extension beyond the default implementation.
- The session Mechanisms are now registered during XMB bootup, rather than hard coded inside the Session files.
- Login links are displayed only when a compatible Mechanism is registered.
- Logout links are displayed only when the current session has that capability.
- A proof of concept for an alternative Mechanism is provided in Certificates.php, which is not registered by default.
- BootupLoader::setVisit() moved to Login::setVisit() for consistent dependency structure.
- Core::getLoginLink() moved to Login::getLoginLink() for consistent dependency structure.

0000889: Increase PHP Requirement to v8.4

Wed, 15 Jul 2026 13:04:34 -0700

We are already seeing dependencies like Symfony Mailer that no longer support PHP 8.2. An increase of the PHP version should be considered.

0000877: Update Symfony Mailer to v8

Wed, 15 Jul 2026 13:04:34 -0700

Symfony 8.0 is available and should be updated for testing.

0000858: Input Font Should Be Configurable

Mon, 22 Jun 2026 06:07:09 -0700

In the theme editor, we have only one font setting, whereas the CSS template uses hard-coded font-family for input elements to avoid using weird theme fonts for input. This needs to be easier to configure.

0000911: CSS for Printable Pages Should Merge With Primary CSS

Mon, 22 Jun 2026 06:06:39 -0700

There are at least 2 or 3 separate stylesheets in use in different areas of XMB. Some of the ideas for improvement:

- Merge styles into the main stylesheet.
- Add new HTML class names for context, because there is currently no semantic indication of which pages are printable.
- If the HTML can be improved, we should move in the direction of having CSS-only media definitions instead of separate URLs for printing.

0000910: Fallback Fonts in Themes

Mon, 22 Jun 2026 06:00:07 -0700

If we look at default font settings since 1.9.8 SP2, we see the following:

Engage: 'Verdana, Arial, Helvetica'
Oxygen: 'Verdana, Arial, Helvetica'
Davis: 'Tahoma, Arial, Helvetica, Verdana'

None of these have a generic fallback, which can be problematic for some clients.

0000909: Can the DB class be renamed to mysqli?

Thu, 18 Jun 2026 06:44:00 -0700

I'd like to have the DB implementation class name match its filename for easier factory logic. Perhaps XMB\mysqli ? Or what happens if someone wants to use a different namespace?

0000907: Too Much Whitespace After BBCode Blocks

Thu, 11 Jun 2026 05:22:17 -0700

XMB always adds a crazy amount of whitespace after bbcode, and sometimes before too. This needs to be tightened up for ease of use.

Likely to have backward compatibility issues with existing content.

0000906: Default Theme Data are Duplicated in images, cinst.php, and upgrade.lib.php

Sat, 30 May 2026 15:07:13 -0700

It might be easier in the long run to import the theme file during install and upgrade, rather than duplicating the whole thing as SQL commands.

0000905: Google Requires Pinned Certificate Change Before June 15

Sat, 30 May 2026 14:49:27 -0700

Many services, including googleapis.com, will shift to using the Google Trust Services WE1 intermediate and ECDSA based TLS certificates.

Potential impact:
If your client applications are not configured correctly, they may be unable to connect to Google services after this change. Connection failures are most likely to occur in the following two scenarios:

Certificate pinning: We do not recommend pinning intermediate or leaf certificates. This practice will cause your application to break during routine certificate rotations.
Custom trust stores: If you use a custom trust store, you must ensure it includes all of Google Trust Services (GTS) Root CAs to prevent outages.
For most customers, no action is required as a result of this change. However, if you run a custom trust store or pin CAs, you may need to take action. We’ve provided additional information to guide you through this change.

What you need to do
Action advised before June 15, 2026:

Ensure you trust all Google Trust Services Root CAs as detailed in this Google Trust Services Certificates documentation.
Pinning is discouraged. If you choose to pin, ensure that all Google Trust Services Roots and, if applicable, intermediates are in your pin list.
Timeline:
Services will shift to new intermediates throughout late Q2 2026.

Impacted customers/accounts:
Any cloud project using a limited set of trusted roots or pinning certificates may experience issues.

We’re here to help
Please review the Google Trust Services announcement for guidance on ensuring reliable connections to Google services.

If you have any questions or require assistance, please contact Google Cloud Support.

Thanks for choosing Google Cloud.

— The Google Cloud Team

0000899: Replace HTTP Status Headers with Native Calls

Mon, 25 May 2026 09:02:51 -0700

Since PHP v5.4, the native function http_response_code() is provided for building status headers. XMB 1.9.11 was the last version to support PHP less than 5.4, but this still hasn't been modernized since then.