[DBTech] DragonByte Security 5.3.0

Update highlights​

This version adds the option to require a minimum password strength when changing the password, as well as fixing an issue where the checkmark icon would not appear even when the new password satisfied the rules.

Complete Change Log​

Feature: New option to set a minimum password strength, shown alongside the other password rules
Fix: The checkmark icon no longer disappears when a password rule is satisfied

Update highlights​

!!! This version requires PHP 8.2 !!!

There are no changes from Beta 2, this is just a version bump to signal the addon is out of Beta.

Complete Change Log​

Version bump

Update highlights​

!!! This version requires PHP 8.2 !!!

This version adds an important security update to one of the security features in the Security addon. I heard you like security in your security... That's still a current reference, right?

Anyway, for Bad Behaviour's "Reverse Proxy" feature, you can now enter trusted reverse proxy addresses.

Speaking of Bad Behaviour, this update includes a patch for an issue in its detection class that would cause server errors if (when) bots attempted malformed URLs, such as example.com//%2f. These server errors were harmless but annoying.

Lastly, the uninstall process has been refactored to avoid the "miscellaneous cleanup" step to rely on already removed data to remove IP bans on uninstall.

Complete Change Log​

Feature: Input trusted reverse proxies for Bad Behaviour
Change: Upgrade the IPDeny URL to HTTPS
Fix: Fix uninstall process
Fix: Malformed URL attempts by bots could cause a server error in the new Bad Behaviour package

Update highlights​

!!! This version requires PHP 8.2 !!!

This version features multiple big new features and changes, all requested by you. I hope you enjoy

The biggest new addition is Cloudflare integration. You can now optionally use Cloudflare to block countries - either in addition to, or instead of, the regular XenForo IP banning feature. Furthermore, banning an IP address via Cloudflare is now a possible security watcher action, just like on-site IP banning. It's also possible to configure Cloudflare's "Under Attack" mode once server load reaches a configured threshold. When server load drops, the previous threat mode is restored.

A returning feature is Bad Behaviour, which has been updated to a maintained fork. If you previously disabled the setting, or your PHP version made it impossible to activate, you can turn it back on via the same setting as before.

Lastly, it's now also possible to require login for all guests when your server load reaches a configurable threshold. Guests will see a login page and a message explaining why they need to login.

In terms of changes, a defunct option and 430 defunct phrases have been removed. I'm reasonably certain all of them were defunct, anyway...

Last but by no means least, a couple of bugs have been fixed.

Complete Change Log​

Feature: Rewrote Bad Behaviour support on top of the maintained badbehaviour/badbehaviour package
Feature: Update FingerprintJS to the latest version
Feature: Optionally block country IP addresses via CloudFlare
Feature: Toggle Cloudflare's "Under attack" mode based on server load
Feature: Toggle guest access based on server load
Change: Raised the minimum PHP requirement to 8.2
Change: Dropped the obsolete "Disable EU Cookie Exemption" option and the PHP-version gate on the Bad Behaviour option
Change: Rename some phrases to make their purpose more clear
Change: Cleaned up 430 defunct phrases
Fix: Work around a bug with Tapatalk
Fix: The "exempt registered members" bypass now compares the account age correctly
Fix: Don't attempt to run fingerprinting if the FingerprintJS object isn't found

This add-on has been hotfixed to address an issue affecting all front-end pages while this add-on is enabled. This issue was caused by additional security measures introduced in XenForo 2.3.13.

The latest version has been patched, and can be downloaded at no additional cost. If you are running an older version and you are unable to upgrade for whatever reason, please let me know the exact version you are running and I will apply the hotfix accordingly.

Update highlights​

This version attempts to make further improvements to fix a reported deadlock with updating session records.

Furthermore, an issue with the TOR Exit Node cron job potentially erroring due to temporary connection failures has been addressed.

Complete Change Log​

Fix: Attempt to fix deadlocks on session update
Fix: Handle additional exceptions when fetching TOR exit nodes

Update highlights​

This version improves the search feature in the various log pages by doing a better job carrying over any criteria, making it easier to refine your searches.

Furthermore, a fix has been added to prevent server errors that could break the login flow if the HaveIBeenPwned API returned unexpected data.

Complete Change Log​

Change: Criteria are now carried over when clicking the Search button in log pages
Fix: Fix cache generator potentially causing edits appearing as if they did not save
Fix: When checking HIBP, skip breach entries with missing date stamps

Update highlights​

This version improves compatibility with future versions of XenForo by moving certain code calls out of templates. This update is recommended to avoid compatibility issues with the upcoming XenForo v2.3.8 & newer.

Furthermore, a new "Maintenance" page has been added, providing easy access to the various rebuild tasks available in this addon.

Lastly, a template error that could occur when viewing the "your logged in sessions" list has been fixed.

Complete Change Log​

Feature: Created a new "Maintenance" page for easy access to the "Rebuild caches" options available in this addon
Change: Move database query calls from templates to PHP files
Fix: Fix template error with session tracking

Update highlights​

This version contains internal changes to be compatible with the upcoming XenForo v2.3.8.

Complete Change Log​

Change: XenForo 2.3.8 compatibility

Update highlights​

This version fixes a regression from v5.0.x causing active forums to receive a MySQL error message saying "lock wait timeout exceeded".

Additionally, further optimisations have been made to the session update code to improve performance.

Complete Change Log​

Fix: The isExpired check now uses the new settings
Fix: Fix regression causing MySQL errors