iBulletin 1.0.1
Maintenance, Security & Reliability Release

iBulletin 1.0.1 is the first major maintenance update following the 1.0 Final release.

This release focuses heavily on security, data integrity, backups and recovery, moderation reliability, upgrade safety, plugin compatibility, installer improvements, and performance.

Because several fixes protect against account compromise or potential data loss, upgrading from iBulletin 1.0 Final is strongly recommended.


Security & Account Protection

• Improved session security after password changes and resets.
  [list]
  
• Logged-in sessions are now tied to a fingerprint of the user's current password hash.
  
• Other active sessions are automatically invalidated after the password changes.
  
• Remember-me tokens continue to be revoked.
  
• The browser performing the password change remains logged in.
  
• The active PHP session ID is regenerated during a password change.
  

[*]Hardened email address changes.

• Members must now enter their current password before changing their email address.
  
• Email ban filters are checked against the new address.
  
• The old address receives a security notification when an email change is requested.
  
• The old address receives another notification when the change completes.
  

[*]Hardened backup deletion against path traversal.

• Backup IDs must match iBulletin's generated backup-ID format.
  
• Invalid paths such as

  .

  and

  ..

  are rejected.
  
• Recursive deletion verifies that targets remain inside the backup directory.
  
• Symlink and malformed-path handling has been tightened.
  

[*]Hardened BBCode and URL formatting.

• Generated links and images are isolated while later formatting passes run.
  
• Prevents BBCode or smilie expansion from corrupting generated HTML attributes.
  

[*]Installer takeover protection.

• The installer refuses to run if either

  config.php

  or

  storage/installed.lock

  already exists.
  
• Losing only the installed lock file can no longer reopen an existing board for installation.
  

[/list]


Forum & Content Data Integrity

• Fixed forum deletion potentially destroying hidden content.
  [list]
  
• Forum deletion no longer relies on the cached topic counter.
  
• The actual topics table is checked before deletion.
  
• Pending topics block forum deletion.
  
• Soft-deleted topics block forum deletion.
  
• Move-redirect topics block forum deletion.
  

[*]Added post revision storage.

• The previous post body is retained when content is edited.
  
• The previous approval state is recorded.
  
• The editor and edit timestamp are recorded.
  

[*]Moderated edits now respect approval requirements.

• Approved posts edited in moderated forums can be returned to the moderation queue.
  
• Topic, forum, and member counters are rebuilt where necessary.
  

[*]Staff edits are now auditable.

• Staff edits to another member's post are recorded in the Moderator Log.
  

[/list]


Backup & Restore System

iBulletin 1.0.1 substantially expands the backup system.

• Added Backup Verification.
  [list]
  
• Backup schema and data files are checked against their SHA-256 hashes.
  
• JSONL backup data is parsed and validated.
  
• Stored row counts are compared against the actual backup contents.
  
• Storage totals are checked.
  
• SQLite snapshot integrity is verified where applicable.
  

[*]Added a CLI backup restore utility.

• Backups are verified before restoration begins.
  
• Maintenance mode is enabled during restore.
  
• Restore and upgrade locks prevent conflicting operations.
  
• A safety backup is created before restoration by default.
  
• Database tables are recreated and logical backup rows imported.
  
• Database sequences are reset where required.
  
• Storage files are restored using staged replacement.
  

[*]Fixed restore failures caused by installer seed data.

• Default installer rows are cleared before backed-up rows are imported.
  
• This prevents duplicate primary-key failures involving smilies, usergroups, report reasons, warning types, and other seeded content.
  

[*]Improved PostgreSQL backup metadata.

• New PostgreSQL backups retain information needed to reconstruct plugin-owned tables.
  
• Constraints and standalone indexes are retained.
  
• Sequence reset supports serial and identity columns.
  

[*]Improved backup listing and deletion.

• Backup ZIPs no longer appear as false "Incomplete backup set" entries.
  
• True orphaned ZIP files can be identified and removed safely.
  
• Incomplete backup directories can be managed safely.
  

[/list]

Note: Cross-database restores are intentionally not supported in 1.0.1. Restore using the same database backend and table prefix as the original installation.


Core Upgrade System

• Added exclusive upgrade locking.
  [list]
  
• Prevents two administrators or a double submission from running the same upgrade simultaneously.
  
• Uses an exclusive lock under

  storage/upgrade.run.lock

  .
  

[*]Improved transactional upgrade handling.

• SQLite and PostgreSQL migrations and core-state changes are transactional where supported.
  
• MySQL/MariaDB accounts for non-transactional DDL while grouping later state changes safely.
  

[*]Plugin compatibility changes are now applied only after the core migration succeeds.

[*]Failed upgrades are now recorded.

• Upgrade history can record failed status.
  
• The failure phase and error message are retained.
  

[*]Expanded upgrade preflight integrity checking.
[/list]


Plugin Compatibility

• Fixed 1.0.1 incorrectly disabling compatible plugins.
  [list]
  
• Additive internal maintenance changes are no longer treated as breaking plugin contracts.
  
• Plugins using unchanged core services are no longer unnecessarily disabled.
  

[*]Updated the bundled Shoutbox for 1.0.1.

• The Shoutbox declares compatibility through iBulletin 1.0.1.
  
• Existing enabled Shoutbox installations remain enabled during upgrade.
  
• Fresh 1.0.1 installations can install the bundled Shoutbox normally.
  

[*]Plugin API generations remain unchanged.
[*]Existing plugin package rollback protections remain intact.
[/list]


Moderation Improvements

• Warning and restriction creation is now transactional.
  
• The warning, restriction, and moderator log entry commit together.
  
• Restriction reason limits are validated before anything is inserted.
  
• Related discipline actions use the same safer transaction handling.
  
• Moderation queues now paginate directly in SQL instead of loading the entire queue into PHP.
  

Performance Improvements

• Reduced repeated forum permission queries.
  
• Primary usergroup lookups are reused during a request.
  
• Permission maps are reused.
  
• Visible forum ID results are cached.
  
• Board-access checks are cached.
  
• Active-ban results are cached during the request.
  
• Forum row filtering resolves visible forums once rather than repeatedly.
  

Search Improvements

• Search input now escapes SQL LIKE wildcard characters.
  

• %

  is treated as a literal percentage sign.
  

• _

  is treated as a literal underscore.
  
• Applied to forum search, member search, and staff-log search.
  

Installer Improvements

• Validation errors return users to the appropriate setup step.
  
• Improved non-JavaScript fallback behavior.
  
• Unavailable PDO database drivers can no longer be selected.
  
• Database connection testing now submits only database-related fields and the CSRF token.
  
• Autofilled administrator credentials are no longer submitted during connection tests.
  
• Added PHP runtime security notices and outdated-version guidance.
  

Admin Control Panel

• PHP runtime security status is available from Maintenance.
  
• Backup verification is available from backup administration.
  
• Incomplete and orphaned backup sets are handled more safely.
  
• Failed upgrades now appear in upgrade history.
  

Template & Internal Cleanup

• Consolidated duplicated template service-variable handling.
  
• Full-page and included/plugin templates use the same template context.
  
• Core services cannot be overwritten by template-supplied values.
  
• Removed duplicate Admin CP language definitions.
  
• Continued source formatting and release-integrity cleanup.
  

PHP Security Awareness

iBulletin 1.0.1 includes administrator-facing warnings for the October 2026 PHP security updates.

The upstream patched releases include:

• PHP 8.2.35
  
• PHP 8.3.36
  
• PHP 8.4.27
  
• PHP 8.5.12
  

These checks are informational and do not block installation because operating-system vendors may backport security fixes without changing the visible PHP version.

Updating PHP itself remains the responsibility of the server administrator.


Database Changes

iBulletin 1.0.1 adds the new

post_revisions

table to all supported databases:

• MySQL / MariaDB
  
• PostgreSQL
  
• SQLite
  

The table is created automatically when upgrading from iBulletin 1.0 Final.


Supported Databases

iBulletin 1.0.1 continues to support:

• MySQL / MariaDB
  
• PostgreSQL
  
• SQLite
  

Upgrade Notes

The supported upgrade path for this package is:

iBulletin 1.0 Final → iBulletin 1.0.1

Before upgrading:

• Create a complete backup of your board.
  
• Verify the backup where possible.
  
• Upload the iBulletin 1.0.1 files.
  
• Visit your board and follow the Core Upgrade process.
  
• Allow the upgrader to complete the database migration.
  
• Review your installed plugins after the upgrade.
  
• Test posting, moderation, private messages, attachments, and the Admin CP.
  

Because this release contains multiple security and data-integrity fixes, all iBulletin 1.0 Final administrators are strongly encouraged to upgrade.


iBulletin 1.0.1

Security. Reliability. Recovery. Stability.

Thank you to everyone testing iBulletin, reporting issues, and helping improve the first public release.

Here is the upgrade for current 1.0 Final installations