Forum Pro

v1.0.11

1 day ago

1. • database.persistent (off by default): keeps the MySQL/MariaDB or PostgreSQL connection open in the PHP-FPM worker between requests instead of opening a new one every time. No effect on SQLite or on a named connection; see the setting's help text for the max_connections budget and the PHP-FPM restart it needs after a database settings change. grav-db-kit 1.0.3
2. • Topic pages failed on MySQL and MariaDB. The query that finds reply links named a column before, a reserved word on both, so every topic view there hit a syntax error. SQLite and PostgreSQL were unaffected
   • Member directory search and the @mention lookup failed on MySQL and MariaDB. Both escaped LIKE wildcards with ESCAPE '\', which MySQL reads as an unterminated string because a backslash is also a string escape there. They use ! as the escape character now, as the XenForo importer already did
   • The attachment link backfill links a post's files in the order the post mentions them on every engine, instead of the order the database happened to return them (MariaDB returned them sorted by hash)

v1.0.10

1 week ago

1. • The database layer, migrator, job queue, KV store, rate limiter and unsubscribe signer now come from grav-db-kit, the shared database package KahunaCart and Helpdesk Pro already use, bundled under Forum Pro's own namespace so it never clashes with another plugin's copy. Existing forums keep their tables and data. The first request after updating runs one migration (0027), which adds any unflushed topic view counts to their topics, rebuilds forum_rate_limits in the kit's layout and adds the kit's columns to forum_jobs. Rate-limit counters start fresh, and unsubscribe links already sent keep working

v1.0.9

1 week ago

1. • Forum admin and moderator rights granted through a Grav group now count on the forum itself. The forum read admin.forum-pro.admin and admin.forum-pro.moderate only from the account's own access settings, while the API checks groups too, so a moderator made one through a group could use the moderation API but got no staff tools on the forum pages and was treated as a regular member. Both now resolve permissions the same way, and the member stats count group-granted admins

v1.0.8

1 week ago

1. • Attachments now follow the access rules of the posts that use them. A file in a members-only, group or staff forum answers 404 to anyone who can't read that post, and the same goes for files on posts that are pending, deleted or hidden, message attachments for anyone outside the conversation, and draft uploads for anyone but the uploader. Before, anyone with the link could download it, including guests on a private forum. Files a guest could see still cache forever and go through the CDN; restricted ones are sent with a private cache and always go through the forum, even with storage.s3.public_url set. Avatars stay public, and a file that isn't tied to any post or message follows the forum as a whole (public on an open forum, members-only on a private one)
   • New bin/plugin forum-pro link-files command. Files brought in by the Discourse importer were never tied to the posts and messages that use them, so the new access check couldn't apply to them. The command scans posts and private messages for file references and adds the missing links. Run it once on a forum imported before this release (--dry-run shows the counts first); it's safe to repeat. The importer's --download-files pass now does this on its own

v1.0.7

2 weeks ago

1. • Sign-up blocklists. auth.blocked_email_domains refuses registrations and email changes at listed domains (example.com, or *.example.com for every subdomain too), and auth.blocked_username_patterns refuses usernames matching simple patterns (1win*, *melbet*). A refused sign-up gets a plain "Registration is not available for these details" that doesn't say which rule tripped, creates no account and sends no email. Each refusal is logged at info level with the rule, domain and IP, never the full address
   • Sign-ups at a domain with no MX and no A record are refused with "That email address can't receive mail" instead of sending a verification email that can only bounce (auth.check_email_domain, on by default). A failed DNS lookup never blocks anyone, and answers are cached per domain for a day
   • Accounts that never verified their email and never did anything (no posts, topics, messages, uploads, reactions or votes) are deleted once they're a week old, by a daily scheduler job (auth.prune_unverified_days, 0 turns it off). Imported and Grav-linked accounts are never touched. The new bin/plugin forum-pro prune-unverified command runs it by hand with --days, --domain and --dry-run
2. • The invisible captcha now works when the login or register page is reached by clicking through the forum. In-forum navigation swaps in the page without its script tags, so the Cap check never ran and every login or sign-up from those pages failed with "captcha failed" until the page was reloaded

v1.0.6

3 weeks ago

1. • Deleting a category from the Structure tab always failed with "No route matches 'DELETE /forum-pro/categorys/…'": the admin built the URL by adding an "s" to the word category. Sections were unaffected

v1.0.5

3 weeks ago

1. • Group-based access. A category's Read, Reply and New topics settings take a new groups audience alongside public, members and staff: pick one or more member groups in the category editor and only their members (plus staff) get in. Subcategories inherit it like any other setting, so a paid "Pro" group can open a whole branch of the forum that free accounts and guests never see
   • Sign-in panel for members-only forums. When every forum is closed to a guest, the index shows a panel with Log in and Create account buttons instead of "No forums have been set up yet", and a link into a members-only category or topic (a notification email opened while logged out, a shared link) shows the same panel instead of a 404. Logging in from it returns to the page that was asked for. Signed-in members whose groups open nothing get their own message. Both messages take Markdown under the new gate settings on the Members tab. Staff-only and hidden forums stay a 404
   • On an index where some forums are public, guests get a one-line hint saying how many more forums open up after logging in (gate.teaser)
   • Private forum (gate.private). Guests see only the sign-in panel, on every forum page: no categories, topics, member directory, profiles, who's online, stats, search, tags or announcements. Logging in, registering, password resets and the unsubscribe links in forum emails keep working, the forum's public API routes need a login, and article comments on site pages are hidden from guests
   • Forum groups can follow a Grav user group. Name one from user/config/groups.yaml on the group and its membership comes from the Grav accounts: a member is added or removed on their next visit, and straight away when their account is saved in Admin2 or the admin (with flex accounts, on any save). Groups without a link keep their hand-managed members. Paired with a groups audience, a purchase that puts someone in a Grav "premium" group opens the paid forums, and a lapsed membership closes them
   • A new bin/plugin forum-pro sync-groups command brings every Grav-linked member's groups up to date at once, for use right after linking a group
2. • The structure tab shows who can read each category that isn't public, with group names for a groups audience
   • Deleting a group that controls access to a category is refused with the names of the categories involved, instead of quietly locking its members out
3. • Reply and New topics permissions now also require read access. A member could post a new topic into a category they couldn't read (a staff-only or members-only one left at the default "members" New topics setting) by sending the form directly
   • The login return path now rejects backslashes and paths that don't start with /, which a root-mounted forum let through
   • Article comments on site pages ignored the comments category's read access, so a members-only comments category still showed its comments to guests. Comments and comment counts now follow the category's audience

v1.0.4

3 weeks ago

1. • XenForo migration. A new bin/plugin forum-pro import-xenforo command imports a XenForo 2.2 MySQL dump directly, no MySQL server needed: members with working passwords (XenForo 2 bcrypt hashes verify as-is, XenForo 1 sha256 hashes upgrade to bcrypt on first login), staff as moderator grants, custom groups, bans, the node tree as sections and categories, threads, posts converted from BBCode to Markdown, edit history, reactions, tags and thread prefixes, watches, bookmarks, polls, Q&A solutions, conversations and trophies. Attachments and avatars adopt straight from a copy of XenForo's internal_data/attachments and data/avatars folders into blob storage. Every row keeps its XenForo id, so an interrupted import resumes without duplicating anything
   • Legacy redirects now support more than one source platform. A frontend.legacy_redirects.xenforo block 301s old XenForo URLs (/threads/slug.123/, /posts/456/, /forums/slug.7/, /members/name.45/, /tags/x/, plus the index.php?threads/... form and subfolder installs via base_path) to their Forum Pro equivalents. Unlike the Discourse source it does not catch unmapped paths unless catch_all: true, because a XenForo site usually keeps its hostname
   • A new onForumProRenderBody Grav event lets other plugins take part in rendering. It fires for every body the forum renders — posts, private messages, signatures, announcements, email excerpts — after the Markdown parse and before the sanitizer, with the source, the parsed HTML to replace, and a context saying what is being rendered and which post, topic, category or member it belongs to. The sanitizer still runs on what a listener returns. See "Extending post rendering" in the README
2. • Legacy redirect lookups on sections, categories, topics and posts are now indexed on external_id
   • XenForo [SPOILER] blocks import as a headed quote, since the renderer never emits raw HTML
   • XenForo [MEDIA] embeds from Twitter/X, Instagram, TikTok, Imgur, Reddit, Facebook, Dailymotion, SoundCloud, Giphy, Flickr, Pinterest and Spotify now import as links to the original post, rebuilt from the id XenForo stores. Only YouTube and Vimeo did before; everything else was dropped, and a post that was nothing but a tweet came through as raw BBCode
   • XenForo reactions now map onto whatever reaction types the forum configures. A reaction whose title names a configured type keeps its identity, with Love read as heart and Haha as laugh, so a forum that adds wow, sad and angry to reactions.types gets XenForo's six back one for one; a reaction the forum has no type for falls back to like. Previously Wow, Sad and Angry all became confused
   • The XenForo import spool is now keyed on what it keeps, not just the dump, so widening the importer no longer replays an older, narrower spool from a previous run
   • A bare [word] with no closing tag now survives the XenForo import as text. Changelog-style posts label their entries [GUI], [Bug], [Wallet], and the unknown-tag sweep used to eat them; XenForo itself shows them verbatim
3. • A category whose slug matched one of the forum's own routes (announcements, members, tag, queue, history and others) was unreachable: the route won and the topic page bounced to the index. The reserved-slug list now covers every frontend route, both importers apply it, and such a category gets the -forum suffix the admin already used for login, search and friends
   • A XenForo dump whose CREATE TABLE carried a quote inside a column comment — stock xf_user does, on the gravatar column — lost the name of every column after it, so user_state, is_moderator and is_admin imported as null and the forum arrived with no staff. The dump reader now re-escapes what it reads back, and refuses a row it cannot name rather than spooling it
   • Long XenForo quotes (a 13 KB proposal quoted in full, a couple of hundred tags inside) exhausted the PCRE JIT stack, so the whole post kept its raw BBCode. The quote, spoiler, list and inline-tag patterns now match a bracket at a time instead of a byte at a time
   • Bold or italic inside a XenForo [URL] label came through as literal \[B\] text; inline tags are now converted before links are built
   • Slugs built from titles in scripts that use combining marks (Devanagari, Thai, Arabic diacritics) dropped the marks and split the word: "India इंडिया" became india-इ-ड-य. Slugs keep them now, for imported and admin-created categories, sections, topics and tags alike
   • A forum mounted at the site root (frontend.route: '', the forum page as Grav's home) redirected / to itself forever: Grav reports the home request under its alias route, which is also the mount page's slug the plugin canonicalizes to /. The request line now decides what was asked for
   • Legacy redirects no longer 301 a request to the page it is already on. A XenForo forum that keeps its hostname and mounts at the root maps the old index onto the new one, which was a redirect loop
   • A forum mounted at the site root had no way back to its index: the "Forum" breadcrumb was plain text and the post-action redirects pointed at an empty route, because the base route is empty there. Index links and redirects now resolve to /. The "Forum" eyebrow on a category page and the category eyebrow on a topic page are links now, on every mount
   • bin/plugin forum-pro rerender unlinked every @mention on the site: posts get their mention links after the Markdown pass, and the command re-rendered without that step. It also built its own bare renderer, so nothing it did went through onForumProRenderBody. It now uses the forum's renderer and relinks mentions, which makes it the way to apply a new render listener to existing posts
   • A category or topic whose slug is not ASCII — 한국어-korean, español-spanish — answered 404 on the frontend: Grav hands the plugin the percent-encoded route, and the slug lookup compared it against the stored, decoded slug. The route is decoded once on the way in

v1.0.3

1 month ago

1. • Category, section and group icons can now be any icon in the Lucide set — all 2,049 of them — instead of the 78 the plugin happened to have inlined. Names like store, shopping-cart and credit-card that previously fell through to a generic chat bubble now render the icon you asked for. An emoji still works in the icon field too
2. • The Icon field in the admin now autocompletes from the full icon list and tells you when a name isn't an icon, as you type. Previously an unrecognised name saved without complaint and only showed up as a chat bubble on the forum, which read as a bug rather than a typo
   • Icons have been refreshed to current Lucide artwork. Most are visually identical; a few are slightly redrawn where Lucide has refined them
   • Eight icon aliases that were standing in front of real Lucide icons of the same name — pen, edit, medal, delete, unlock, help-circle, check-circle and bar-chart — have been dropped, so those names now give you the genuine Lucide icon. No forum used any of them. The remaining aliases (chat, fire, gear, poll and friends) are all names Lucide doesn't define, so they still resolve as before

v1.0.2

1 month ago

1. • Inline code in posts and comments now renders on a tinted background with a soft border, so a bin/grav clearcache mid-sentence reads as code instead of blending into the text around it. Code backgrounds are tinted from the theme's accent colour, and can be retargeted with the --forum-code-bg, --forum-code-block-bg and --forum-code-border variables
   • Article comments now style code the same way posts do. Both bodies run through the same Markdown pipeline but only the post body was styled, so a fenced block in a comment came out unformatted
2. • On phones the forum's quick links (New Posts, Unanswered, Tags, Members, Unread, My Topics, Bookmarks) are now visible as a scrollable row instead of being hidden behind the Search button, where there was nothing to suggest they were there. Search still collapses to its icon
   • Category descriptions on the forum index now use the full width of the card on phones instead of wrapping inside a narrow column beside the icon
   • On phones a category's name now sits centred against its icon instead of being pinned to the top of the row, so short titles no longer float above the tile beside them