Blog

Archive for September, 2009

Less significant modification team changes

Posted by igorw in Modifications with the tags on September 19th, 2009

As previously stated every team will announce in what way it will be affected by the significant phpBB development changes. This post will explain the effects on the modifications team.

Versioning scheme

Since phpBB will be using a new versioning scheme we will adopt this scheme for all of our tools (AutoMOD, UMIL, etc).

MOD authors will be encouraged to use this new versioning system too. We will however be less strict in enforcing it. In fact, we will allow any versioning that is compatible with version_compare, so versions such as 1.0.0.0 will be allowed. We will still require it to be stable though.

Additionally we will release a new version of MODX to support this and adapt our tools where needed.

phpBB 3.0

Because phpBB 3.0 is not going to change we don’t have to adopt any changes. This will just continue as it has been so far.

phpBB 3.x

Depending on what changes will be made to the modding API we will assist MOD authors in using it and provide documentation. All in all, it will highly depend on how many changes will be made to phpBB itself. There are a lots of improvements we can think of, and we will try and get them implemented where possible.

We will allow submission of modifications for new phpBB branches once they are released. We will support the branches that are supported globally.

phpBB 4.0

The release of phpBB 4.0 is way too far ahead for us to be able to say anything at all about it. It is a fresh start and will possibly bring many new possibilities. We can be pretty sure that the new architecture will have an impact on modding that will change it fundamentally. We will wait and see. And work together with the development team.

The future

We have some great plans waiting for the MOD writing community. These include building more advanced infrastructure and tools, as well as making alterations to the MODX standard. We will work on making the workflows of modification engineering more efficient. More information will follow in due time.

— The Modifications Team

How (not) to use request_var

Posted by igorw in Modifications with the tags , on September 10th, 2009

Note: This post is targeted at MOD authors and contains many technical details.

Introduction

Amongst the great security features that phpBB 3.0 provides is the function used for processing user input, request_var.  This function was designed to make it easy to securely retrieve user inputted data.  It is one of the most important security functions in a system that retrieves external data as it can (with caveats that will be elaborated upon) single-handedly stop XSS and SQL injection attacks dead in their tracks

The reason we have created this blog post is to give more information to modification developers on how to properly explain how this works and why you should use it.

Read the rest of this entry »