Bug 20951

Summary: Upgrade forums.mageia.org to phpBB 3.3
Product: Websites Reporter: Frédéric "LpSolit" Buclin <LpSolit>
Component: forums.mageia.orgAssignee: Sysadmin Team <sysadmin-bugs>
Status: NEW --- QA Contact:
Severity: major    
Priority: High CC: doktor5000, filip.komar, forums-bugs, maat-ml, mageia, marja11, steve, tmb
Version: trunk   
Target Milestone: ---   
Hardware: All   
OS: Linux   
URL: https://www.phpbb.com/downloads/
Whiteboard:
Source RPM: CVE:
Status comment:

Description Frédéric "LpSolit" Buclin 2017-05-27 01:43:15 CEST
Per https://www.phpbb.com/about/release/, phpBB 3.0.x reached EOL 18 months ago. So forums.mageia.org (which is currently running 3.0.14) should be upgraded to phpBB 3.2.0 to avoid potential security vulnerabilities.
Comment 1 Marja Van Waes 2017-06-01 17:52:13 CEST
(In reply to Frédéric Buclin from comment #0)
> Per https://www.phpbb.com/about/release/, phpBB 3.0.x reached EOL 18 months
> ago. So forums.mageia.org (which is currently running 3.0.14) should be
> upgraded to phpBB 3.2.0 to avoid potential security vulnerabilities.

Reassigning to sysadmin team, because no one reading the forums-bugs ml has the needed rights to take care of this.

CC: (none) => forums-bugs, marja11
Priority: Normal => High
Assignee: forums-bugs => sysadmin-bugs
Severity: normal => major

Comment 2 Thomas Backlund 2017-06-01 19:16:33 CEST
I know, and it's scheduled for upgrade.

And it did go as EOL 18 months ago, and End of Support (I har read this as EOL earlier :/) was January 1st, 2017.
https://theadminzone.com/threads/end-of-support-for-phpbb-3-0-x.140560/


I upgraded to 3.0.14 to close down currently known security issues, and since no new know security issues so far is reported agains phpbb I decided to push that online so endusers would get their beloved forums back.


Then as planned let it spin for ~1 week online to expose any bugs/issues related to the new vm and hosting setup before adding another possible source of issues/regressions by doing a rebase to 3.2...


as for others doing forum upgrades... atleast maat could at any time pushed updates to forum git and scheduled a forum upgrade with any of current sysadmins...


but he had left it stuck at 3.0.12 too so...


Anyway I'll do some more infra work this weekend and get this out of the way...

Of course if any of the forum maintainers want to do the rebase:
http://gitweb.mageia.org/web/forums/

CC: (none) => tmb

Comment 3 Marja Van Waes 2017-06-03 19:32:37 CEST
(In reply to Thomas Backlund from comment #2)

> 
> 
> Anyway I'll do some more infra work this weekend and get this out of the
> way...
> 
> Of course if any of the forum maintainers want to do the rebase:
> http://gitweb.mageia.org/web/forums/

Maat, doktor5000 or, since you offered your help for with the forums years ago, yoshi alias st3ve:

tmb has the wiki and many other things to look after, too, so if one of you has time to give a hand, please don't hesitate to say so!

CC: (none) => doktor5000, maat-ml, steve

Comment 4 Filip Komar 2017-06-04 18:22:06 CEST
I tested files upgrade locally. Here's what I did so far:

$ git remote -v
$ git remote add upstream  https://github.com/phpbb/phpbb.git
$ git remote -v # to check if upstream is added
$ git fetch upstream
$ git checkout master
$ git merge upstream/3.2.x
$ git mergetool

All files other then those listed bellow merge automatically:

Auto-merging phpBB/styles/prosilver/template/overall_header.html
CONFLICT (content): Merge conflict in phpBB/styles/prosilver/template/overall_header.html
Auto-merging phpBB/styles/prosilver/template/overall_footer.html
CONFLICT (content): Merge conflict in phpBB/styles/prosilver/template/overall_footer.html
Auto-merging phpBB/search.php
CONFLICT (content): Merge conflict in phpBB/search.php
Auto-merging phpBB/mcp.php
CONFLICT (content): Merge conflict in phpBB/mcp.php
Auto-merging phpBB/includes/functions_user.php
CONFLICT (content): Merge conflict in phpBB/includes/functions_user.php
Removing phpBB/includes/captcha/captcha_factory.php
CONFLICT (modify/delete): phpBB/includes/auth/auth_ldap.php deleted in upstream/3.2.x and modified in HEAD. Version HEAD of phpBB/includes/auth/auth_ldap.php left in tree.

This last one seems a bit nasty due to upstream removal in 3.1:
https://github.com/phpbb/phpbb/commit/09372d765d5adbca743063a7410b97abf4536015

I didn't investigated conflicts in detail yet as I have to stop for today.

HTH anyway.

CC: (none) => filip.komar

Comment 5 Filip Komar 2017-06-04 18:31:02 CEST
BTW I should merge tag instead of a branch:
$ git merge upstream/3.2.x # should use tag instead

But I don't know yet how. Any tip/help appreciated.
Comment 6 Aurelien Oudelet 2020-09-19 18:09:14 CEST
Hi,
This is High priority bug for a good reason.

Making Mageia even better than ever is best direction.
In order to do right thing, this bug should be examined and fixed as soon as possible.

Packagers, please make the status to Assigned when you are working on this.
Feel free to reassign the bug if bad-triaged. Also, if bug is old, please close it.

On October 1st 2020, we will drop priority to normal.
Comment 7 Frédéric "LpSolit" Buclin 2020-10-19 11:52:57 CEST
phpBB 3.3 has support for PHP 7.3 and 7.4.


It looks like 3.3 is in http://gitweb.mageia.org/web/forums/, but has not been pushed to production. Is that right?

Summary: Upgrade forums.mageia.org to phpBB 3.2 => Upgrade forums.mageia.org to phpBB 3.3
URL: https://www.phpbb.com/about/release/ => https://www.phpbb.com/downloads/

Comment 8 Florian Hubold 2020-10-21 23:00:07 CEST
(In reply to Frédéric "LpSolit" Buclin from comment #7)

> It looks like 3.3 is in http://gitweb.mageia.org/web/forums/, but has not
> been pushed to production. Is that right?

AFAICT it doesn't matter what's in gitweb because that's not used to actually deploy the forum, or at least not for updates. Those happened in-place directly on the server. I've asked several times for forum-related topics because we had issues where actual settings deviated from what we had in gitweb, but never got a response from sysadmins for that.

See e.g. https://bugs.mageia.org/show_bug.cgi?id=21035#c7

Either Maat or one of the other sysadmins would need to look into the upgrade, AFAIR Nicolas helped with the most recent update.

CC: (none) => mageia