XMB Forum Bugs - Issues

0000881: post.php edit truncation issue - probably all xmb versions

Sat, 31 Jan 2026 08:11:02 -0800

xmb_posts.subject is TINYTEXT (can exceed 128 chars, up to 255?)
xmb_threads.subject is VARCHAR(128)

When editing the FIRST post in a thread, XMB updates BOTH tables.
If subject exceeds threads.subject length, MySQL throws:
"Data too long for column 'subject' (errno 1406)"

New-topic posting already truncates correctly, but the EDIT path did not.
To preserve full subject in posts while keeping threads safe:
- Clone the already-escaped subject
- Truncate ONLY the copy used for xmb_threads
- Never modify $dbsubject (used by xmb_posts)

This prevents edit-time errors without changing schema or behaviour.
clone subject for threads
// $dbsubject is already escaped at this point, so replace:

if ((int) $isfirstpost['pid'] == $pid) {
$db->query("UPDATE ".X_PREFIX."threads SET icon='$sql_posticon', subject='$dbsubject' WHERE tid=$tid");
}

with

if ((int) $isfirstpost['pid'] == $pid) {

$dbtsubject = $dbsubject;

// enforce threads.subject length
$query = $db->query("SELECT subject FROM ".X_PREFIX."threads WHERE 1=0");
$tsubmax = $db->field_len($query, 0);
$db->free_result($query);

if (strlen($dbtsubject) > $tsubmax) {
$dbtsubject = substr($dbtsubject, 0, $tsubmax);
}

$db->query("UPDATE ".X_PREFIX."threads SET icon='$posticon', subject='$dbtsubject' WHERE tid=$tid");
}
OR the DB schema could be changed :)

0000882: Subject Schema is Different for Posts and Threads

Sat, 31 Jan 2026 08:05:36 -0800

The subject field length and type needs to be unified because there's no advantage to having them work differently in 2 tables.

0000880: Quarantine Panel: Post Links are Broken

Sun, 18 Jan 2026 07:07:15 -0800

Instead of linking to the public post address for each quarantined post, which is invalid, the quarantine panel should simply link to the public thread page.

0000878: Don't Use the Error Template on 404 Pages

Thu, 08 Jan 2026 15:54:52 -0800

XMB has long used the error template when items are not found.

With v1.9.11, the 404 status code was added to these pages.

Now, we need to stop displaying the error template when items are not found.

0000875: Allow Relocation of config.php

Sun, 28 Dec 2025 07:02:05 -0800

For an extra layer of security, it needs to be possible to change the location of the config.php file without breaking everything.

0000877: Update Symfony Mailer to v8

Wed, 24 Dec 2025 12:57:50 -0800

Symfony 8.0 is available and should be updated for testing.

0000864: PHP 8.5 Backports

Wed, 24 Dec 2025 12:41:21 -0800

Compatibility improvements on the master branch will need to be backported for branch 1.9.12.

0000876: PHP 8.6 Compatibility

Wed, 24 Dec 2025 12:05:27 -0800

Items expected to affect XMB compatibility with PHP 8.6:

Type casting a string that contains alphanumeric data will cause an error. No more (int) '56 stuff' allowed.

0000873: Session Token Encryption

Mon, 22 Dec 2025 10:47:06 -0800

v1.9.12 brought us session tokenization and v1.10 brought us good improvements for password hashing.

Now we need to go a step further and protect session token storage so that any kind of database exposure would not facilitate authentication by a 3rd party.

0000872: Asynchronous Mail Delivery

Sun, 21 Dec 2025 09:08:22 -0800

The Symfony mailer causes significant page load delays when using SMTP. Need to add asynchronous delivery for most situations.

0000870: Attachment Search for Orphaned Files

Fri, 19 Dec 2025 06:22:41 -0800

The attachment search feature does a reasonable job of representing orphaned objects (files that have no associated post in the forums). However, there is no option to specifically find orphaned attachments only.

0000867: Relative paths not working in imagefttext()

Thu, 18 Dec 2025 20:13:18 -0800

I've been unable to verify if this is a PHP issue or a host configuration issue, but switching between PHP 8.4 and 8.5 causes these errors to show up:

[18-Dec-2025 19:15:32 America/Los_Angeles] PHP Warning: imagefttext(): Could not find/open font in include/attach.inc.php

0000865: Function imagedestroy() is deprecated

Thu, 18 Dec 2025 19:33:52 -0800

[18-Dec-2025 19:07:44 America/Los_Angeles] PHP Deprecated: Function imagedestroy() is deprecated since 8.5, as it has no effect since PHP 8.0

0000807: UTF-8 Schema

Mon, 22 Sep 2025 10:28:36 -0700

The diverse string formats in the schema are one of the last things still driving me crazy in terms of maintaining this code base. This is the path forward:

Convert all "double-slashed" strings to unslashed strings, no exceptions.

Start brainstorming tools and procedures for conversion to UTF-8 encoding.

If helpful, add schema columns that would aid the encoding conversion.

Update page headers and templates with the new charset.

Start addressing PHP charset use and any security implications.

Create new translation files.

Determine if non UTF-8 encodings will be supported or dropped completely.

0000421: LIMIT start, ppp Does Not Scale Well

Sat, 20 Sep 2025 06:43:37 -0700

During optimization testing on Exhale, I found that the LIMIT command runs about 10 times faster using an index instead of the table data. Thus, we now have two queries instead of one when we need to query paged information.

The remaining problem is that this wont be helpful for a forum that grows 10 times larger than Exhale. If a forum had on the order of 10^6 threads or if a thread had 10^6 replies, then even the index scan would become rather onerous for the sake of locating page boundaries.

It may be worth researching alternative strategies for paging information with greater magnitude. It may not be compatible with XMB 1.9.11, but it would be nice to know what direction these optimizations will take in the future. Partitioning? Stats tables? Views?

0000858: Input Font Should Be Configurable

Thu, 11 Sep 2025 08:28:02 -0700

In the theme editor, we have only one font setting, whereas the CSS template uses hard-coded font-family for input elements to avoid using weird theme fonts for input. This needs to be easier to configure.

0000857: Move Text Color to CSS

Thu, 11 Sep 2025 07:37:22 -0700

Text color has been specified in HTML since XMB v1.1. This is confusing, inconsistent, and we're not sure if anyone distinguishes the body color from the table color. This needs to be moved to CSS and/or combined with the table text color setting.

0000841: Whosonline Queries Can Be Less Frequent

Wed, 10 Sep 2025 06:49:01 -0700

Sending a DELETE query for every hit is not necessary and can be easily improved upon.

Also, the thread SELECT queries can be consolidated for faster loading of misc.php?action=online

0000856: Header 'pluglinks' Should Have a Default / Themeable Icon Setting

Wed, 10 Sep 2025 06:10:04 -0700

Using a fixed filename in config.php makes the pluglink icons somewhat incompatible with the theme system.

0000850: Improve the search functionality

Mon, 08 Sep 2025 08:25:10 -0700

Right now all it does is take the input and look for anything matching it. Searching "the", for instance, will return every instance of the string "the", including sub-words.

It'd be nice to be able to do more conditional searching and whatnot. Perhaps even something more exciting could be integrated - I'm not sure what's available, but maybe there's some sort of more "intelligent" search library we could be using.

Writing our own is probably going to be difficult to get right.

0000849: member profile fields can't contain emoji

Mon, 08 Sep 2025 08:24:07 -0700

This not only breaks fringe cases like emoji URLs but also possibly breaks things like passwords too.
Worth checking with non-emoji non-latin1 chars too for sanity's sake too because this could be more major then we realise.

http://�.to is an example of a emoji URL

0000832: Why Does the 'Use Signature' Option Even Exist?

Fri, 05 Sep 2025 22:07:11 -0700

With the update of all posts occurring by default... for which we have a setting:

Should "use signature" in existing posts be automatically reset when the signature is removed and/or readded?

Then what is even the purpose of having a "Use Signature" option?

If a user deletes their signature with the admin setting enabled, then all of the "Use Signature" values are removed, making them meaningless.

If a user deletes their signature with the admin setting disabled, then all of the "Use Signature" values are meaningless because there is no signature to use.

0000833: "Your Personal Features" bar Should be Optional or Removed

Mon, 28 Jul 2025 11:19:28 -0700

The "Your Personal Features" bar really clutters up the front page and isn't very useful.

0000821: Change Table Width to Body Width

Sun, 20 Jul 2025 15:16:03 -0700

The use of identical width attributes on every child of the page body is really pointless. All we need to do is make this a few line items of CSS and then mass remove this variable from all the other templates.

Testing in Firefox shows we can use this:

body {
width:
margin-left: auto;
margin-right: auto;
}

0000665: u2u subject is truncated where it exceeds the u2u table subject column setting

Sat, 19 Jul 2025 11:19:36 -0700

u2u table, subject column

If subject exceeds table subject setting when sending a u2u,

MySQL generates a warning [when debug is on]:
'Message' => 'Data truncated for column \'subject\' at row 1',

Perhaps the code from post.php for handling where subject is > table subject setting field length could be repurposed/recycled into u2u code.