[ticket/11483] Generate user act key if database entry is empty
* github.com:phpbb/phpbb:
[ticket/11483] Add tests for generating user act key on force reactivate
[ticket/11483] Generate user act key if database entry is empty
The force reactivation action in the ACP will no longer overwrite the
generated activation key in case the key stored in the database is empty.
It will also save the generated key back to the database to actually allow
the activation by the user.
PHPBB3-11483
[ticket/14802] Empty/blank lines should not be additional poll options
* dsinn/ticket/14802:
[ticket/14802] Add test for empty/blank lines in poll options
[ticket/14802] Empty/blank lines should not be additional poll options
* 3.1.x:
[ticket/14789] Remove obsolete check_form_key() and add missing hashes
[ticket/14789] Move form key checks to where they actually do something
* prep-release-3.1.10:
[ticket/14789] Remove obsolete check_form_key() and add missing hashes
[ticket/14789] Move form key checks to where they actually do something
This will further harden the ACP security by adding link hashes to links and
form tokens to forms that did not have these yet and result in modified
settings or write action on the filesystem or database. These few links and
forms were still relying on the global ACP protection, mainly due to them
not posing further risks of compromising data. After this change these will
now also be properly protected against tampering.
PHPBB3-14789
phpBB already had limited support for partial downloads, but only for
resuming downloads, disregarding any range ending before EOF.
WebKit on iOS and OS X uses partial downloads when fetching media
files. Previously, only MP3 attachments could play directly in the
browser, reported as a live stream, but with this change, all
supported media formats should render as expected.
Tested using cURL by verifying that partial downloads give exactly the
same results compared to Apache.
PHPBB3-14774
All browser engines that descend from WebKit declare themselves as
Safari in the user agent, including Chrome. Currently, the code
assumes that any Safari-like browser cannot handle the RFC-compliant
filename syntax. At least for recent versions of Safari, this is no
longer the case, and the legacy syntax results in URI-quoted
filenames. Using the standard syntax works as expected in both Safari
9 and Chrome 45.
The ticket reporting this issue is from January 2014, so we can safely
ignore compatibility: any browser still relying on the previous
behaviour is unlikely to receive security updates.
PHPBB3-12133
