phpBB Group announces the release of phpBB 2.0.15, the "summer needs to be hot" release. This release addresses some bugfixes and addressing some security issues, one being serious. With this release the admin re-authentication security feature from phpBB Olympus has been backported to the 2.0.x branch too.
What has changed in this release?
The changelog (contained within this release) is as follows:
Fixed moderator status removal in groupcp.php
Removed newlines after ?> on some files - Thoul
Added admin re-authentication (admin needs to login seperatly to access the ACP) - backported from Olympus
Fixed vulnerability in url/bbcode handling functions - PapaDos and Paul/Zhen-Xjell from CastleCops
Fixed issue in admin/admin_forums.php
Suppressed warning message for fsockopen in /includes/smtp.php - Thoul
Fixed bug in admin/admin_smilies.php (admin is able to add empty smilies) - Exy
Adjusted documents to reflect the urgent need to update the files too (not only running the database update script)
Updated the readme file
Added one new language variable
Added general error if accessing profile for a non-existent user
Changed session id generation to be more unique - Henno Joosep
Fixed bug in highlight code to escape characters correctly
Reversed the 2.0.14 fix for postgresql because it produced more problems than it solves.
Added reference to article written by R45 about case-sensitivity in postgreSQL to the readme file
Fixed bypassing of validate_username on registration - Yen
Empty url/img bbcodes no longer get parsed
Source