Flarum v1.8.0 Released

CDLStudy

someone hacked this website demo page where is the admin

luceos

CDLStudy yeah I got multiple reports. It's not hacked mind you, but defaced. Which is very easy to do with the admin permissions we openly share. It seems we cannot trust the internet and will need to lock down the admin (further).

lhy

I just installed Flarum today, using version 8.2 of PHP. Without making any modifications, I conducted a simple test and encountered errors when registering and uploading files. There are also many outdated writing methods. What is the situation? Will there be a normal version for us to use? Thank you. 
Deprecated: Callables of the form ["Swift_SmtpTransport", "Swift_Transport_EsmtpTransport::construct"] are deprecated in /var/www/flarum/vendor/swiftmailer/swiftmailer/lib/classes/Swift/SmtpTransport.php on line 36 
 
Deprecated: Callables of the form ["Swift_Message", "Swift_Mime_SimpleMessage::construct"] are deprecated in /var/www/flarum/vendor/swiftmailer/swiftmailer/lib/classes/Swift/Message.php on line 46 
 
Fatal error: Uncaught Laminas\HttpHandlerRunner\Exception\EmitterException: Unable to emit response; headers already sent in /var/www/flarum/vendor/swiftmailer/swiftmailer/lib/classes/Swift/SmtpTransport.php:36 in /var/www/flarum/vendor/laminas/laminas-httphandlerrunner/src/Exception/EmitterException.php:15
Stack trace:
#0 /var/www/flarum/vendor/laminas/laminas-httphandlerrunner/src/Emitter/SapiEmitterTrait.php(38): Laminas\HttpHandlerRunner\Exception\EmitterException::forHeadersSent('/var/www/flarum...', 36)
#1 /var/www/flarum/vendor/laminas/laminas-httphandlerrunner/src/Emitter/SapiEmitter.php(21): Laminas\HttpHandlerRunner\Emitter\SapiEmitter->assertNoPreviousOutput()
#2 /var/www/flarum/vendor/laminas/laminas-httphandlerrunner/src/RequestHandlerRunner.php(75): Laminas\HttpHandlerRunner\Emitter\SapiEmitter->emit(Object(Flarum\Api\JsonApiResponse))
#3 /var/www/flarum/vendor/flarum/core/src/Http/Server.php(45): Laminas\HttpHandlerRunner\RequestHandlerRunner->run()
#4 /var/www/flarum/index.php(26): Flarum\Http\Server->listen()
#5 {main}
thrown in /var/www/flarum/vendor/laminas/laminas-httphandlerrunner/src/Exception/EmitterException.php on line 15

luceos

lhy see this: https://discuss.flarum.org/d/36404-stopping-deprecation-warnings

lhy

luceos Thank you very much for your reply. It's not just a reminder issue. There are many errors when uploading files after installation, and the writing style is outdated. The constraints after PHP 8.0 require a lot of code modification. Shouldn't the latest installation package meet the latest requirements? Thank you.

clarkwinkelmann

lhy the Flarum 1.x codebase is written to be compatible with PHP 7.3 and higher. The upcoming Flarum 2.x has bumped this requirement and you will see some more "modern" code. Using new PHP 8 syntaxes usually doesn't bring any benefit to the end user though, only some developers might prefer the new ways code can be written.

Some extension developers have already made their Flarum 1.x extensions PHP 8+ only to get access to these new PHP features, and that's usually not an issue as all forums should be running an actively supported PHP version. The minimum requirements for Flarum core 1.x will likely not be raised, as no more feature upgrades are planned and bumping the system requirements during the security maintenance phase would make no sense.

If you still encounter errors, please follow the troubleshooting guide https://docs.flarum.org/troubleshoot and create a new discussion underSupport with your findings so we can help you resolve it.

IanM

⚠️ New 1.8.10 Core and Tags release ⚠️

Today we announce the release of Flarum 1.8.10, which primarily addresses a security vulnerability in session handling. We strongly recommend upgrading at your earliest convenience.

See CVE-2025-27794 for further information.

Upgrade Instructions

Run the following commands to update:

composer update --prefer-dist --no-plugins --no-dev -a --with-all-dependencies
php flarum migrate
php flarum cache:clear

This release also includes some general improvements, bringing the Flarum 1.x branch one step closer to its final version.

Fixes

change starting position of aria-posinset flarum/framework4192
sanitize page param in Tag flarum/framework4170

Changes

make search debounce time extensible flarum/framework4171
change length of email field flarum/framework4117

Versions

Today's release bumps the versions of flarum/core and flarum/tags, see below:

flarum/core - 1.8.10
flarum/tags - 1.8.4

A big thanks to @glowingblue for collaborating with us to resolve this security issue!

Silvestrus

It seems that login doesn't work properly after update.

Application.tsx:522
 
 POST https://audiofil.org/login 400 (Bad Request)
(anonymous) @ request.js:173
(anonymous) @ request.js:23
(anonymous) @ request.js:22
e.request @ Application.tsx:522
e.login @ Session.ts:38
n.onsubmit @ LogInModal.tsx:170
(anonymous) @ extendAuthModals.tsx:80
Ci.forEach.t.<computed> @ extend.ts:86
O.handleEvent @ render.js:888

IanM

Silvestrus there does indeed seem to be an issue with this on your site. Other sites I've tried seem to be functioning fine..

So we can debug this issue, can you please look for any relevant entries in the flarum logs? These are usually found on your server under {FLARUM_DIR}/storage/logs

Silvestrus

IanM the last log is from yesterday and there is no log for today's date unfortunately. Only composer log, but that is not relevant I think.

Google login works fine so I haven't noticed the issue until I got informed by users who use email for login.

IanM

Silvestrus Ok, understood.

Just a hunch, could you try disabling fof/recaptcha for a moment, and try again?

Silvestrus

Disabled fof/recaptcha
Cleared Flarum cache
Cleared browser cache
Deleted local and session storage

Still same result.

Silvestrus

Flarum core: 1.8.10
PHP version: 8.2.27
MySQL version: 10.6.21-MariaDB-cll-lve-log
Loaded extensions: Core, date, libxml, openssl, pcre, sqlite3, zlib, bz2, calendar, ctype, curl, hash, filter, ftp, gettext, json, iconv, SPL, pcntl, random, readline, Reflection, session, standard, mbstring, shmop, SimpleXML, tokenizer, xml, bcmath, brotli, dom, fileinfo, gd, gmp, igbinary, imagick, imap, intl, exif, mcrypt, memcached, PDO, mysqlnd, mysqli, pdo_mysql, pdo_pgsql, pdo_sqlite, pgsql, Phar, soap, tidy, xmlreader, xmlrpc, xmlwriter, xsl, zip, Zend OPcache
+-------------------------------------+------------+------------------------------------------+
| Flarum Extensions | | |
+-------------------------------------+------------+------------------------------------------+
| ID | Version | Commit |
+-------------------------------------+------------+------------------------------------------+
| flarum-flags | v1.8.2 | |
| flarum-approval | v1.8.2 | |
| flarum-tags | v1.8.4 | |
| flarum-suspend | v1.8.4 | |
| flarum-sticky | v1.8.2 | |
| afrux-forum-widgets-core | v0.1.7 | |
| flarum-nicknames | v1.8.2 | |
| fof-byobu | 1.4.1 | |
| flarum-mentions | v1.8.5 | |
| flarum-subscriptions | v1.8.1 | |
| walsgit-external-links-in-new-tab | 1.1.1 | |
| v17development-seo | v2.0.6 | |
| the-turk-stickiest | 3.0.1 | |
| justoverclock-last-users-posts | 0.3.0 | |
| justoverclock-last-registered-users | 0.1.5 | |
| justoverclock-custom-html-widget | 0.1.4 | |
| justoverclock-auto-post-count-badge | 1.0.0 | |
| ianm-syndication | 1.3.4 | |
| ianm-online-guests | 1.0.0 | |
| fof-username-request | 1.2.4 | |
| fof-user-directory | 1.4.0 | |
| fof-user-bio | 1.4.2 | |
| fof-upload | 1.8.1 | |
| fof-split | 1.1.1 | |
| fof-socialprofile | 1.1.6 | |
| fof-sitemap | 2.2.1 | |
| fof-share-social | 1.2.0 | |
| fof-reactions | 1.4.1 | |
| fof-polls | 2.2.12 | |
| fof-oauth | 1.6.16 | |
| fof-nightmode | 1.6.0 | |
| fof-moderator-notes | 1.3.0 | |
| fof-merge-discussions | 1.4.1 | |
| fof-links | 1.3.0 | |
| fof-linguist | 1.1.5 | |
| fof-ignore-users | 1.2.1 | |
| fof-formatting | 1.0.3 | |
| fof-follow-tags | 1.2.9 | |
| fof-cookie-consent | 1.1.3 | |
| fof-analytics | 1.1.0 | |
| flarumite-simple-discussion-views | 1.2.4 | |
| flarum-statistics | v1.8.1 | |
| flarum-pusher | v1.8.1 | |
| flarum-markdown | v1.8.1 | |
| flarum-lock | v1.8.2 | |
| flarum-likes | v1.8.1 | |
| flarum-lang-english | v1.8.0 | |
| flarum-lang-croatian | dev-master | 095ea4191bdf2ad6dba3bcef81c37cfd19504e21 |
| flarum-extension-manager | v1.0.7 | |
| flarum-emoji | v1.8.1 | |
| flarum-bbcode | v1.8.0 | |
| ecnu-im-sticky-sidenav | v1.1.0 | |
| dem13n-topic-starter-label | 0.1.8 | |
| darkle-fancybox | 2.1.0 | |
| clarkwinkelmann-emojionearea | 1.0.0 | |
| blomstra-fontawesome | 0.1.5 | |
| askvortsov-pwa | v3.4.1 | |
| askvortsov-moderator-warnings | v0.6.3 | |
| afrux-online-users-widget | v0.1.9 | |
| afrux-forum-stats-widget | v0.1.1 | |
| acpl-mobile-tab | 1.4.5 | |
+-------------------------------------+------------+------------------------------------------+
Base URL: https://audiofil.org
Installation path: /home/audiofilorg/public_html
Queue driver: sync
Session driver: file
Scheduler status: Aktivan
Mail driver: smtp
Debug mode: off

IanM

Silvestrus thanks for the info.

I'll try and replicate your setup locally and see if I can pinpoint the issue

Silvestrus

IanM thank you! I really appreciate your support. If you need anything from my side, please let me know. I will be here until we fix this. Is there a way to downgrade to older version and to verify if everything works fine?

Silvestrus

@IanM , problem solved.

I had acpl/flarum-lscache installed. I removed it because I had some other performance issues. I just installed it again and login works fine.

Silvestrus

@IanM I apologize if I wasted your time on this one. I'm new to Flarum and still trying to figure out some things, but it gives me great feeling to see how quick someone reacts over here. I really appreciate your support and assistance.

IanM

Silvestrus that's great to hear, glad it's working again for you 🙂

Don't hesitate to reach out if you experience any other issues with this latest update. Welcome to Flarum!

Dr_Sommer

Flarum
1.8.5PHP
8.1.31MySQL
10.5.26-MariaDB-0+deb11u2

Hi, tried to install 1.8.10, with this Instructions , but getting this error:

Flarum encountered a boot error. Details have been logged to the Flarum log file.

and this multiple times in the Log file:

[2025-03-17 22:22:37] flarum.ERROR: Error: Class "Doctrine\Deprecations\Deprecation" not found in /var/www/clients/xxxxxx/flarum/vendor/doctrine/dbal/lib/Doctrine/DBAL/Driver/PDOMySql/Driver.php:77

Has somebody a solution for that error? Not sure how to address this...

ThX in advance 👍️

« Previous Page