but 0.9.0.7 appears to simply be a copy of the final 0.9 branch

browse http://bbpress.trac.wordpress.org/browser/branches/0.9

zip http://bbpress.trac.wordpress.org/changeset/3730/branches/0.9?old_path=%2F&format=zip

svn co http://svn.automattic.com/bbpress/branches/0.9/

From what I can tell, JJJ just copied the branch over to make "0.9.0.7"

http://bbpress.trac.wordpress.org/changeset/3517
http://bbpress.trac.wordpress.org/changeset/3535
http://bbpress.trac.wordpress.org/log/tags/0.9.0.7/bb-includes?rev=3535

That's all he did, there were no other changes, improvements or fixes.

But there really are some fixes in the final 0.9 branch over 0.9.0.6

There were 12 files changed from 0.9.0.6 to 0.9.0.7 (aka 0.9 branch)

http://bbpress.trac.wordpress.org/changeset?old_path=%2Ftags%2F0.9.0.6&old=2338+&new_path=%2Ftags%2F0.9.0.7&new=3715

bb-includes/default-filters.php (1 diff)
bb-includes/wp-functions.php (2 diffs)
bb-includes/pluggable.php (1 diff)
bb-includes/functions.php (3 diffs)
bb-includes/registration-functions.php (1 diff)
bb-includes/template-functions.php (3 diffs)
bb-includes/compat.php (1 diff)
search.php (1 diff)
bb-plugins/akismet.php (4 diffs)
bb-admin/bb-do-counts.php (3 diffs)
bb-admin/admin.php (1 diff)
bb-admin/admin-functions.php (2 diffs)

It's hard to be 100% positive but I am pretty sure they addressed the base64 decoding bug.

Those with 0.9.0.6 can replace just these files to upgrade to 0.9.0.7
http://bbpress.trac.wordpress.org/changeset?format=zip&new=3715&old=2338&new_path=%2Ftags%2F0.9.0.7&old_path=%2Ftags%2F0.9.0.6
(those running versions before 0.9.0.6 will need more files from a fuller upgrade, do not use just the above files as it will break your install)

Everyone should still use my mini-plugin to protect bbpress and wordpress for yet-unidentified security issues. It's better than nothing. You can even remove the header and just copy the one IF block to your bb-config.php and wp-config.php

If 256 characters turns out to be too short of a URL restriction, some may need to raise it as high as 1024, for example in WordPress where it stupidly uses GET now to mass delete posts, which was a dumbfounding move on their part.

<?php
/*
Plugin Name: Block Long/Bad Queries (for bbPress and WordPress)
*/

if (strlen($_SERVER['REQUEST_URI'])>1024 ||
preg_match('@(eval|base64|unescape)[^a-zA-Z0-9]@si',$_SERVER['REQUEST_URI']))
{
	header('HTTP/1.1 414 Request-URI Too Long');
	header('Status: 414 Request-URI Too Long');
	header('Connection: Close');
	exit;
}

I have 0.9.0.7 installed.

I just saw _ck_'s post here about a security patch plugin: http://bbpress.org/forums/topic/bbpress-103-released#post-84690

Ten months ago, _ck_ wrote,

"bbPress 0.9 users should install my unofficial "block-long-queries" mini-plugin to avoid the security bug that 1.0.3 fixes and similar unknown attacks in the future.
(it also works in 1.0 and WordPress)"

Since it seems like 0.9.0.7 came out five months later, I am wondering if this new release covers the patch or if it is still needed.

Note that I searched extensively for a post about the 0.9.0.7 release and the changes it represented, but I can't see anything like that.

Also, I can't ask in the original thread because it was closed.

Thanks!

I hope to find an answer here. I write to WordPress, to bluehost, everywhere and anybody answer to me. I explain my problem:

I must re-install all my website, and it's impossible to have on-site
registration box, on the right column in the begin. I try all since for
days. Only invitations run. But I want register members who want to take
part on this platform.
The page of BP Compability, this sentence is:
"Navigation Links
"You may want to add new navigation tabs or links to your theme to link to
BuddyPress directory pages. The default set of links are:
Register: http://www.faicmfsf.org/register/ (registration must be
enabled)"
But I look at for this file, I don't find it. I made a special page for
regster too, but it didn't run. For all other files for register, they are
all active, it's ok. Just one on "BuddyPress / pb-core / pb-core-
signup.php (inactive)" What I must to do.
I want to put widgets for register, but anyone run. Sorry for my bad
english.
Gene

Next time it happens, try copying the link and putting a random query after it, ie. http://bbpress.org/legacy.tar.gz?12345 and see if that makes a difference (or not).

The issue happens more often than it usually would for me, b/c the plugins install uses 0.8.3 and isn't signin integrated with the main forum (which uses the latest version).

At least, I think that signing in will fix the downloads! It could just be random chance that ever time I've signed in before, the downloads have started working again! :-)

I've found a rather sporadic bug when trying to download bbPress 0.9 from teh downloads page. Specifically rather than going to the .zip file, it led me to a blank page instead.

2 computer, 4 browsers, same issue.

Been like this since at least this morning (GMT).

I'm presuming it's a hic-up, but just thought i'd point it out :)

Closing this topic.

@_ck_ Be serene , I'm a white hat and infosecwriter . I'm here with my personal data , ua , ip , server and corporation. Really do u see bad intentions? Yes , I need to study 0.9.x sources to confirm a vulnerability and write an exploit ( if possible , code is really good ) , however I'm for full disclosure only after vendors report and fix.
So , don't be nervous , and thank you for attention and support .
Regards.

It's currently very difficult to find and download old releases. We're hoping the powers that be create a release archive for old versions linked from the bbPress download page...

http://bbshowcase.org/plugins/freshly-baked-cookies.zip

Don't forget to copy over your settings at the top of the plugin and remember to set the AUTH_COOKIE_VERSION to 2 for WP 2.8

I have a hard time believing it's that simple to fix for WP 2.8 vs 2.7 but here's hoping.

Any changes you make to your templates to use it will remain compatible when upgrading to 1.0, users will only have to deactivate the plugin after upgrading.

(this is also a demonstration of how Voices should have been a plugin rather than in the core)

Put this into a regular plugin and I suggest naming it _functions.php with a leading underscore so you don't even have to activate it. Install it and then when a functions.php is found inside the currently active theme, it will be loaded with the regular plugins. Since it's so tiny, if you have a collection of mini-plugins you can just put it in there instead.

<?php
/*
Plugin Name: functions.php
*/
$template_functions_include = bb_get_active_theme_directory() . 'functions.php';
if ( file_exists( $template_functions_include ) ) { require_once( $template_functions_include ); }
?>

In theory you might even be able to put that code into the header.php inside of the templates if you are making a theme you want to distribute for 0.9

Sam, can 0.9 be restored as an easily available option? It can be played down if you'd like - even something low key like the WordPress release archives would be great:
http://wordpress.org/download/

It's always available via trac too:
http://trac.bbpress.org/changeset//tags/0.9.0.5?old_path=%2F&format=zip

or the branch might have a few fixes someday in the future
http://trac.bbpress.org/changeset//branches/0.9?old_path=%2F&format=zip

because 1.0 and some of my needed PlugIns are not working together I want to download the latest Version 0.9.
Where can I find this one? Do i have to browse svn for that?

Greetings Alex

I also agree with _ck_'s points about core vs. plugins. From what I can gather, the original idea was to have a fast, secure, and plugin extensible system. Even as a user rather than a developer that makes a lot of sense to me. It means the core quickly becomes more and more stable, and anyone is free to develop whatever they want to hook into it. Brilliant. But putting various functions into the core means that any changes have to be redone by Sam et. al. and re-uploaded, hacked in the core by users, or redeveloped by hooking in a plugin to change the functionality. As everyone has differing needs and opinions, plugins for anything but basic core functions leave open far more options. Anything which is not essential to all users is not a core function. Gravatars, for example, are not required or even wanted by many users.

As to people remembering old versions with fondness, but having moved on with each bleeding edge version, I'd suggest that it's only those who keep moving on who voice their opinions most in these forums. There are huge numbers of users who've built forums with very old packages of all kinds, and when they build new ones they use the old software too. I think it's important that those who love bleeding edge, along with the challenges and time consuming re-uploading and fiddling around, don't forget that many people are perfectly happy with what works and see no need to keep reinventing the wheel. After all, how much better really, do all these new ideas and functions appearing all over the web make life? This is probably a point for a philosophical forum, but worth mentioning I think. We seem to spend so much time redoing and redoing, that often purpose is lost in the background noise of being so busy changing everything. We live in a, "Yippee, it's new!" culture, where anything which doesn't titillate the mind is ditched for whatever's next.

New functionality is great if it's genuinely useful, but I'm glad 0.9.0.5 exists and works so well, and the occasional security update will do fine. Incidentally, I'd quite like to see a separate 0.9 forum. It would save 0.9 users having to wade through all the 1.0 questions and allow us to quickly see what's relevant.

If it wasn't against the grain to open up a .9 legacy forum here specifically for supporting it, I'd say just do that and see who falls into it.

A majority of the audience of bbPress are people that want to be on the bleeding edge of WordPress development, and be part of a growing and maturing community. As such, people will remember .9 of bbPress as much as they remember .9 of WordPress (b2evo anyone?)

I personally think anything officially past the end of 2009 is a stretch, and is a very generous offer from Sam to not leave the early adopters on their own without patches and support.

Respectfully to all, just because the ABILITY to use a new feature is built into bbPress DOES NOT force one to use it. It's still totally up YOU. No one HAS to incorporate Gravatars or Voices into their site, but it is very cool for newbies to simply turn a core feature on or off rather than needing to download a plugin that is probably months or even a year old...praying it will work with the latest version.

Am I saying Sam should build an NES Emulator and a Weatherbug Widget into bbPress 1.2? HECK NO.

(Sam, start with the Atari emulator instead)

But things like Gravatars, (which Automattic owns) have tremendous potential use (goodbye individual avatar uploading for every single forum, hello universality). And the ABILITY to display voices makes sense to add in (being able to show the number of different people contributing to a topic certainly enhances bbPress).

Perhaps I am in the minority here, but I am hoping future versions of bbPress will continue to add these sorts of new features that make the bbPress experience more enjoyable for all users.

(I had written a whole thing here but I accidentally closed the tab and restoring it never brought the text back unfortunately.)

You should never adopt a program based on one person, especially if that person doesn't do it for a living and even more important since that person doesn't work for the company that made the program in the first place ;-)

To be clear I am not abandoning bbPress, at least not until I find something better and I am not actually looking for something else right now and what I have seen over the past year has not impressed me much. Besides, there are other talents around here and they are slowing releasing more and more impressive plugins or porting them from WP. A couple years from now people won't even remember me.

My biggest problem with 1.0 is how bbPress was on a course with 0.9 to correct many of the legacy mistakes that WordPress had made, and suddenly with a whim by Matt, bbPress has turned around 180 degrees and steered itself neck deep back into the muck and mire via BackPress. It's now burdened with many more layers and required compatibility and it will never be any more lightweight than it is now, which is not so fantastic anymore.

Another big problem growing with 1.0 is how instead of taking any feature that is outside of the API functionality and making it external as a plugin, it is being poured directly into the core, setting itself up for more legacy failure, like WordPress. Sam wrote some really great plugins as an independent but now as a core developer he can just slide it right into the core. It's far easier to modified the core to get new features done fast but it should be resisted at all costs. You'll notice that WordPress doesn't have any official plugins outside of akismet and "hello dolly", it's a very clear but invisible company policy - "we don't make plugins, put it into the core". bbPress is now headed down the same path and it's not necessary.

Things like:
gravatars
voices
topic page icons
should not be in the core. Instead any necessary action and filter hooks needed to accomplish such features should be carefully created and then the features should be made as plugins that can be enabled or disabled as desired. bbPress already comes with a "factory" plugin directory, it should be put to good use.

bbPress 0.9's greatest strength was as a lightweight framework.
1.0 is not just a framework anymore, it's starting to tell you how it should look and feel, and that is bad, because there are dozens of other forum programs out there that will do just that.

Reading this does make me more than a little concerned - WP integration is a key feature of bbPress, as can be seen from all the talk about it on these forums. 0.9 integration is almost impossible to get working (I was never able), and the bridge between the two will likely be developed solely with 1.0 in mind from here on (not that it ever worked properly in 0.9).

1.0 seems to the killer app for a WP/BB CMS integration, so for that reason alone it is an appealing upgrade - in my case essential, as I would not have otherwise been able to select bbPress at all. Providing a cohesive user experience is rather more important than worrying about a few CPU cycles in a case like this, as hardware is cheaper than lost page views and users.

However, reading _ck_'s comments here and elsewhere, it is obvious he loathes 1.0 or at least has almost no interest in it.

Since most of the rich functionality which is essential to a rounded forum is provided by _ck_'s superb plugins, it seems that for anyone dependent on them is going to be left waiting for a potentially long time, especially when _ck_ appears to have no interest in taking work, making it a matter of waiting for plugins to catch up - I am sure many users just couldn't upgrade without being able to carry forward their existing features, which rather renders the whole issue of supporting 0.9 moot.

I'd have to say, it would be a situation like this, and not any "heaviness", which would press me into looking at an alternative solution...

I definitely agree that it's not as seamless as it could be...

It should be possible to integrate version 0.9 with just about any version of WordPress

Yeah, but it's a lot easier with 1.0. I always found minor gremlins in the way it worked with 0.9, but with 1.0 it seems to function fairly seamlessly.

I generally help others with their forums, not build them for myself, so I need it to be fairly basic to do the integration. The way 1.0 does it natively is pretty slick IMO.

I never liked the 0.9 line, but it seems I'm not in the majority with that opinion. I guess I'm biased by requiring a working integration with WordPress.