Thread Starter
#1
RaxBoard Core — Core
A new release is now available on the RaxBoard Marketplace.
Version: 1.9.9 (build 20261029)
Compatibility: RaxBoard >=1.0.0
What's new
# RaxBoard 1.9.9 (build 20261029)
RaxBoard 1.9.9 includes security fixes (BB code, license checks, add-on API writes, AI provider keys), fixes view counts with a server cron job and links on sub-folder installs, and adds name-based profile addresses, payments for Azerbaijan and more.
Full release notes, with every change and the upgrade steps: the "RaxBoard 1.9.9 is out" thread in Marketplace Updates, https://community.raxboard.com/forums/marketplace-…
## Who should upgrade now
- **Every board:** a crafted post could make the board spend seconds to minutes displaying or saving it.
- Boards whose **scheduled tasks run from a server cron job** (servers with APCu): thread view counts and profile visits have not been updated since 1.9.8.
- Boards **installed in a sub-folder**: many script-driven links went to the site root.
- Boards that use **AI providers** (keys now stored encrypted), send **Stripe webhooks to `/payment_callback.php`** (every delivery failed) or keep CSS in a **Style Extra CSS** box (a theme update emptied it: update the core first).
## Security
- **Posts and BB code:** processing a post's BB code, mentions and voice messages included, now takes time in proportion to its length; posts look the same.
- **License checks:** a new key is checked before it is saved, and a revoked or invalid license can no longer be lifted by a replayed or unrelated answer. A license record changed outside RaxBoard is flagged on the admin dashboard; the site keeps running.
- **Add-on API writes** made with a member's session need the security token, as core ones do: Special Days 1.2.6 or later is required.
- **AI provider keys** are stored encrypted. The key is in `data/secret_key.php` or `RB_SECRET_KEY`: keep it with your backups, or enter the API keys again after moving the database to another server.
## New
- **Profile addresses:** `/name` besides `/profile/name.123` (Options → SEO → Profile addresses); updated boards keep the numbered addresses until switched, then the old ones redirect. A renamed member's old address redirects for 90 days if the rename is public.
- **Paid upgrades:** Epoint, Payriff and FPAY (Azerbaijan, AZN), checked with the gateway's status API and refundable through it; payments that could not be granted wait under Admin → Upgrades. Epoint awaits sandbox verification: test a payment before enabling it on a live board.
- **Events and Clubs:** switching either off switches the whole feature off (pages, links, feeds, API, reminders, notifications) without deleting anything.
- **Search suggestions** are rebuilt (forums, threads, members, tags): from three characters, on thread titles only.
- **Accounts:** new backup codes on demand; one personal time zone, and guests get theirs if the guest page cache is off; profile visitors are shown only to the owner and staff unless Options → Privacy & GDPR allows more.
- **Pinned alerts** can target guests. New trophy and promotion criteria, also for blog articles, gallery media, stories and resources (with those add-ons' updates).
- **Threads:** a primary Post Reply action in the thread header; one sticky Thread settings panel on the Create thread page.
- **Admin:** Style Properties no longer repeats the Customizer (now light or dark like the admin); dates follow the board language, with Arabic or Persian digits per language; widgets get a Profiles option; contact-form and `TRUSTED_PROXIES` warnings; one Privacy Policy URL; analytics follows the Privacy consent settings.
- **For developers:** hook points in `addon.json` or `_data/hook_points.xml` (`CoreApi::has('addon_hook_points')`, level 10909), optional Anthropic request options, `ProfilePath` for `/name` pages, case-sensitive add-on cleanup.
## Fixes
- Updating a theme no longer empties the Style Extra CSS box; deleting a theme's last style moves the theme to `data/theme_trash/`.
- A changed e-mail address shows once confirmed; a pending change can be resent or cancelled.
- The admin panel no longer loads the front-end stylesheet (no more white-on-white buttons); right-to-left admin pages follow the reading direction.
- Widgets placed on "all pages" no longer appear on error pages, including 403, and error pages show no ads; the ban page uses the member's language.
- Ad impressions count only ads the page shows; the phone ad under the author fits 320×50 and 300×250 units.
- Right-to-left: icons and prefixes stay put next to titles written the other way; editor lines keep their own direction. Clearer field edges; readable Moderation Log names; singular counts in more places; English instead of phrase keys; text wraps at lone no-break spaces.
- Prefix-filtered forums show full pages; moderation dialogs no longer flash; profiles are complete in every style; the Default theme drops 14 outdated template copies and its 1.9.8 page layout; the browser toolbar follows the style's header colour.
- Claude 5 models no longer give empty short replies; a busy marketplace or update server says when to try again.
- From the next update after 1.9.9 on, the updater's pre-migration backup works on MariaDB, a never-edited `.htaccess` gets the new rules and release signatures are checked (only logged: 1.9.9 has no release key yet); `bin/raxboard backup` is fixed now.
## Before you upgrade
- Back up the database and files. MariaDB hosts: the update to 1.9.9 still runs the 1.9.8 updater, whose automatic pre-migration database backup does not work on MariaDB — back up the database with your host tools before you update. Later updates take the backup themselves.
- The in-app updater does not replace your root `.htaccess`; the new rules are in `htaccess.dist` — copying them over is optional.
- Update your themes and add-ons after the core; Special Days must be 1.2.6 or later. Add-ons and the 1.9.9 language packs are published right after the core; until the packs are updated, other languages show the new texts in English.
Get it
View on the Marketplace
— Posted automatically by the RaxBoard Marketplace.
A new release is now available on the RaxBoard Marketplace.
Version: 1.9.9 (build 20261029)
Compatibility: RaxBoard >=1.0.0
What's new
# RaxBoard 1.9.9 (build 20261029)
RaxBoard 1.9.9 includes security fixes (BB code, license checks, add-on API writes, AI provider keys), fixes view counts with a server cron job and links on sub-folder installs, and adds name-based profile addresses, payments for Azerbaijan and more.
Full release notes, with every change and the upgrade steps: the "RaxBoard 1.9.9 is out" thread in Marketplace Updates, https://community.raxboard.com/forums/marketplace-…
## Who should upgrade now
- **Every board:** a crafted post could make the board spend seconds to minutes displaying or saving it.
- Boards whose **scheduled tasks run from a server cron job** (servers with APCu): thread view counts and profile visits have not been updated since 1.9.8.
- Boards **installed in a sub-folder**: many script-driven links went to the site root.
- Boards that use **AI providers** (keys now stored encrypted), send **Stripe webhooks to `/payment_callback.php`** (every delivery failed) or keep CSS in a **Style Extra CSS** box (a theme update emptied it: update the core first).
## Security
- **Posts and BB code:** processing a post's BB code, mentions and voice messages included, now takes time in proportion to its length; posts look the same.
- **License checks:** a new key is checked before it is saved, and a revoked or invalid license can no longer be lifted by a replayed or unrelated answer. A license record changed outside RaxBoard is flagged on the admin dashboard; the site keeps running.
- **Add-on API writes** made with a member's session need the security token, as core ones do: Special Days 1.2.6 or later is required.
- **AI provider keys** are stored encrypted. The key is in `data/secret_key.php` or `RB_SECRET_KEY`: keep it with your backups, or enter the API keys again after moving the database to another server.
## New
- **Profile addresses:** `/name` besides `/profile/name.123` (Options → SEO → Profile addresses); updated boards keep the numbered addresses until switched, then the old ones redirect. A renamed member's old address redirects for 90 days if the rename is public.
- **Paid upgrades:** Epoint, Payriff and FPAY (Azerbaijan, AZN), checked with the gateway's status API and refundable through it; payments that could not be granted wait under Admin → Upgrades. Epoint awaits sandbox verification: test a payment before enabling it on a live board.
- **Events and Clubs:** switching either off switches the whole feature off (pages, links, feeds, API, reminders, notifications) without deleting anything.
- **Search suggestions** are rebuilt (forums, threads, members, tags): from three characters, on thread titles only.
- **Accounts:** new backup codes on demand; one personal time zone, and guests get theirs if the guest page cache is off; profile visitors are shown only to the owner and staff unless Options → Privacy & GDPR allows more.
- **Pinned alerts** can target guests. New trophy and promotion criteria, also for blog articles, gallery media, stories and resources (with those add-ons' updates).
- **Threads:** a primary Post Reply action in the thread header; one sticky Thread settings panel on the Create thread page.
- **Admin:** Style Properties no longer repeats the Customizer (now light or dark like the admin); dates follow the board language, with Arabic or Persian digits per language; widgets get a Profiles option; contact-form and `TRUSTED_PROXIES` warnings; one Privacy Policy URL; analytics follows the Privacy consent settings.
- **For developers:** hook points in `addon.json` or `_data/hook_points.xml` (`CoreApi::has('addon_hook_points')`, level 10909), optional Anthropic request options, `ProfilePath` for `/name` pages, case-sensitive add-on cleanup.
## Fixes
- Updating a theme no longer empties the Style Extra CSS box; deleting a theme's last style moves the theme to `data/theme_trash/`.
- A changed e-mail address shows once confirmed; a pending change can be resent or cancelled.
- The admin panel no longer loads the front-end stylesheet (no more white-on-white buttons); right-to-left admin pages follow the reading direction.
- Widgets placed on "all pages" no longer appear on error pages, including 403, and error pages show no ads; the ban page uses the member's language.
- Ad impressions count only ads the page shows; the phone ad under the author fits 320×50 and 300×250 units.
- Right-to-left: icons and prefixes stay put next to titles written the other way; editor lines keep their own direction. Clearer field edges; readable Moderation Log names; singular counts in more places; English instead of phrase keys; text wraps at lone no-break spaces.
- Prefix-filtered forums show full pages; moderation dialogs no longer flash; profiles are complete in every style; the Default theme drops 14 outdated template copies and its 1.9.8 page layout; the browser toolbar follows the style's header colour.
- Claude 5 models no longer give empty short replies; a busy marketplace or update server says when to try again.
- From the next update after 1.9.9 on, the updater's pre-migration backup works on MariaDB, a never-edited `.htaccess` gets the new rules and release signatures are checked (only logged: 1.9.9 has no release key yet); `bin/raxboard backup` is fixed now.
## Before you upgrade
- Back up the database and files. MariaDB hosts: the update to 1.9.9 still runs the 1.9.8 updater, whose automatic pre-migration database backup does not work on MariaDB — back up the database with your host tools before you update. Later updates take the backup themselves.
- The in-app updater does not replace your root `.htaccess`; the new rules are in `htaccess.dist` — copying them over is optional.
- Update your themes and add-ons after the core; Special Days must be 1.2.6 or later. Add-ons and the 1.9.9 language packs are published right after the core; until the packs are updated, other languages show the new texts in English.
Get it
View on the Marketplace
— Posted automatically by the RaxBoard Marketplace.