Community

1.12.0 Breaking Changes

NodeBB Development

Suggested Topics

  • barisB

    NodeBB 2.8.1 Security Update

    Moved NodeBB Development
    3 Votes
    4 Posts
    286 Views
    barisB

    It is basically the same vulnerability exploited with a different socket call. The initial fix in 2.6.1 only prevented a specific case, the fix in 2.8.1 should cover all cases.
    You can either upgrade to 2.8.1 or only get the changes from the specific commit.

  • barisB

    1.13.0 Breaking Changes

    NodeBB Development
    6 Votes
    5 Posts
    905 Views
    D

    Apparently the Calendar Plugin:

    nodebb-plugin-calendar
    Calendar and events for NodeBB

    Installed 1.0.0-alpha.50 | Latest 1.0.0-alpha.50

    Does not work with 1.13.0

    Can someone please update it?

  • barisB

    1.10.0 Breaking Changes

    NodeBB Development
    1 Votes
    3 Posts
    2374 Views
    attisA

    Hi,
    I think I have discovered another breaking change that you didn't mention, though it is probably super-niche.

    This commit: https://github.com/NodeBB/NodeBB/commit/ec91ef1c644044bba44198b031913655e784b4bb
    broke our custom SSO plugin. The result was that after successfully logging in our external identity provider and being redirected to our Forum's callback endpoint, I was ending up not logged in (the button in the header still said "Log in") and stuck on /register/complete roadblock. It looked like our Passport strategy verify callback, that parses output from the identity provider and fetches user data via OAuth2 was not invoked at all.

    It turns out that the changes in this commit don't play well together with passport-oauth2 (https://github.com/jaredhanson/passport-oauth2) internal ability to protect against CSRF (which we were using). This strategy was already using state parameter to pass its own CSRF token. I don't have more time to investigate but I suspect things shipwrecked when NodeBB overwrote the state parameter with its own CSRF token.

    Turning off passport-oauth2 internal CSRF protection (by removing state: true from its options) fixed the issue.

  • E

    NodeBB v1.6.0 has been released!

    Moved NodeBB Development
    9 Votes
    10 Posts
    5520 Views
    attisA

    @pitaj said in NodeBB v1.6.0 has been released!:

    I suggest you try it. It has been tested with Gmail, but we haven't been able to test other providers there.

    The switch offers no explanation and seems not to do anything.

    The switch enables that configuration, but it only applies if an emailer plugin isn't activated.

    OK, thanks for the explanation.

    I think I will stick to the external SES plugin since, as far as I understand, this whole section is about using SMTP for sending e-mails which requires storing credentials in database. We use IAM roles to grant implicit permissions to use SES on instances that run our Forums - and nodebb-plugin-emailer-ses is able to pick that up.

  • barisB

    timestamp change

    NodeBB Development
    0 Votes
    3 Posts
    1956 Views
    NicolasN

    But... It's a breaking change.
    You should not do such stuff when you have now 1.0

Copyright © 2023 NodeBB | Contributors