It was about time to do a check and update all the code, instead of waiting for reports every single time for a code that had been running unchanged since 2016. In the upcoming versions, the plugin will drop support for phpBB version 3.2 and will only cater to the current 3.3> and the future 4.0 (which will be released who knows when).
At the same time, it's time to move the plugin code to GitHub as well, so maybe anyone who wants to can participate more easily in fixing issues or adding features. This will happen before Christmas.
Given the changes applied, before every release I test the possible configurations of the most important options and features, but it's impossible for me to test each of the 1001+ potential configurations every single time. Please, if you spot any error, warning, or bug, report it immediately here or on the WordPress forums. The same goes if you have any suggestions for improvements or new features! Thank you.
Code: Select all
== Changelog ==
= 3.1.0 =
* Fix: User profile update error caused by missing variable assignment.
* Security: Implemented rigid database query parameterization via `$wpdb->prepare()` across all primary user lookups, authentication hooks, and cookie processing routines to eliminate potential SQL Injection (SQLi) attack vectors.
* Security: Neutralized Reflected Cross-Site Scripting (XSS) risks by wrapping dynamic system notifications and database connection error warnings (`$dberror`) in explicit `esc_html()` sanitization filters.
* Fix: Fully refactored the bulk-row user group assignment logic inside the `w3all_phpbb_USER_groupSwitch` loop to leverage safe, matrix-bound parameter arrays instead of unsafe string concatenations.
* Fix: Patched a legacy missing-comma SQL query syntax bug within multi-attribute database update chains that could trigger fatal processing failures under strict MySQL/MariaDB server configurations.
* Fix: Cleaned up shortcode attribute processing to prevent HTML/CSS layout manipulation or attribute breakout from user-defined style fields.
* Architectural Optimization: Session destruction routines inside the logout pipeline to use typed integer-and-string bindings, ensuring rigorous alignment with PHP 8.2+ and modern WordPress Core development guidelines.
* Note: I tested the major options, but not on all the possible configurations and the latest updates might affect something (some more var missing ?). Please report any bugs on the axew3.com or wp.org forums.
Enjoy, lovely people, I have given it my absolute best!
And I can confidently say, yes, that way We are safe now.
https://www.axew3.com/w3/w3mypq/
https://wordpress.org/plugins/w3mypq/
https://www.axew3.com/w3/bennypq/