MyBB 1.4.5 is now available on the MyBB website and is a general maintenance and security release.

This release fixes over 100 reported issues with version released since 1.4.4 causing some incorrect functionality of MyBB. These bugs have been fixed to provide a more stable version of MyBB for public use.

What's added/changed in this version?
One Low XSS Vulnerability fixed in the ACP - This is tagged as low because it requires administrator permissions. This vulnerability was discovered and reported by ketto93.
Several Low CSRF vulnerabilities fixed in the ACP - These are all low priority because they require extremely rare circumstances and cannot compromise any information. They are only useful in assisting a DDOS attack. These vulnerability were found and fixed internally.
A minor weakness in an algorithm we use for generating a post key was fixed - This is low priority because it requires extensive computing power to even be a problem. This weakness was discovered and reported by frostschutz.
Commas have not been allowed in usernames since MyBB 1.4. They are forcefully removed during the upgrade procedure for MyBB 1.4.5 to ensure compliance and to fix a reported issue. Please inform your users with commas in their usernames of this change.
Lots of speed and stability improvements previously affecting large forums.
... Lots of other bug fixes


This release has been tested by our new Software Quality Assurance group and through a private beta test performed by members of the community. We thank you for making this a fine and stable release.

Information on upgrading, template changes and language changes can be found in the posts below.

Please note, that you need to run the upgrade script for this version.
This is so the templates may be updated.
There are database schema changes in this version.

Reporting MyBB security vulnerabilities
If you think you've found a vulnerability in MyBB, we advise you not to publicly post it on these forums or publicly release information about it elsewhere until we've had time to prepare and release a patch.

As always, you can send through security related messages on the MyBB website from the Contact Us page.

Posted on Sat, 18 Apr 2009 23:38:03 -0500 at http://community.mybboard.net/thread-48484.html