phpBB is a high powered, fully scalable, and highly customisable
open-source bulletin board package. phpBB has a user-friendly interface,
simple and straightforward administration panel, and helpful FAQ. Based
on the powerful PHP server language and your choice of MySQL, MS-SQL,
PostgreSQL or Access/ODBC database servers, phpBB is the ideal free
community solution for all web sites.
===> The following configuration options are available for phpbb3-3.3.19:
DOCS=on: Build and/or install documentation
===> Use 'make config' to modify these settings
www/phpbb3: Security update to 3.3.19
Fixes an unauthenticated SMTP command injection through the contact
form, reflected and stored cross-site scripting, a missing CSRF check
when held private messages are released and several moderator permission
bypasses.
The same fixes were announced for 3.3.18, whose downloads did not carry
them.
Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.19/phpBB/docs/CHANGELOG.html
Security: 4784d4b8-d6a9-11f1-8a93-a0369f6e85b8
Sponsored by: Netzkommune GmbH
www/phpbb3: Fix fetch
download.phpbb.com started rejecting requests carrying the libfetch user
agent with HTTP 403. This breaks fetching the distfile everywhere, the
package building cluster included.
The distfile itself is unchanged and its recorded checksum still
matches, and there is no newer upstream release. Work around the block by
passing --user-agent to fetch.
Sponsored by: Netzkommune GmbH
www/phpbb3: update to 3.3.17
3.3.14 is affected by CVE-2026-29199 (CVSS 8.1): with force_server_vars
disabled, phpBB builds the password reset link from the HTTP Host
header,
so an attacker who can control that header makes reset mails point to a
domain of their choice, which may lead to account takeover.
Also fixed since 3.3.14: improper state verification in the OAuth
implementation (SECURITY-293), IDOR when composing private messages
(SECURITY-286), CSRF on report submission (SECURITY-287), cross-user
notification read state manipulation (SECURITY-290) and HTML generation
from page data (SECURITY-283).
Changelog:
https://github.com/phpbb/phpbb/blob/release-3.3.17/phpBB/docs/CHANGELOG.html
Security: CVE-2026-29199
Security: 4d06b948-a323-11f1-a655-3497f65b111b
MFH: 2026Q3
Sponsored by: Netzkommune GmbH
*/*: Remove merged or non-existent USE_PHP directives
- Remove USE_PHP=hash which is available in default php installation of
all versions of php
* security/pear-Horde_Crypt_Blowfish: Remove OPTION MHASH
- Remove USE_PHP=json which is available in default php installation of
all versions of php
* devel/pear-PHPTAL: Remove OPTION JSON
* www/ilias: Remove OPTION SCORM2004
- Remove USE_PHP=mssql which is no longer available in php from php80
and later and has been replaced with sqlsrv module which is Windows
only
* www/codeigniter: Remove OPTION MSSQL
* www/moodle311: Remove OPTION MSSQL
* www/moodle39: Remove OPTION MSSQL
(Only the first 15 lines of the commit message are shown above )
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
- Update to 3.1.5
- don't make all files/directories writable by the web server, only the ones
phpbb3 actually needs to write to
PR: 200770
Approved by: maintainer timeout
Committed from: Essen FreeBSD Hackathon
Use @sample keyword on two ports I thought couldn't use it
Possible due to extreme sleep deprivation, I was confused about the
limitations of the @sample keyword. The two www ports I modified last
night, phpbb3 and autoindex2, both could use @sample with config.php,
so go back and clean up my own mess. No revbump necessary as this is
functionally equivalent to what is there now.
www/phpbb3: Replace @sample keyword
The @sample keyword got used here but it didn't work because the
extension was php.sample instead of conf.sample. Fix it with @unexec
and @exec tricks.
By the way, the previous commit to this port and the one that should
have provided this @sample fix is:
PR: 191456
Stage www/phpbb3 and pass maintainership to submitter
Upgrade version from 3.0.11 => 3.0.12 while here
PR: 189963
Submitted by: Marco Steinbach
Approved by: former maintainer (Bo-Yi Wu)
Lotsa TLC: marino
Remove indefinite articles and trailing periods from COMMENT, plus
minor COMMENT typos and surrounding whitespace fixes. A few Makefiles
where not included as they contain Latin-1 characters that break
the Phabricator workflow. Category W.
CR: D510
Approved by: portmgr (bapt)
