vBulletin 3.7.1 PL1 & 3.6.10 PL1 Released

**Yogesh Sarkar** · 06-09-2008, 07:40 AM

vBulletin 3.7.1 PL1 / vBulletin 3.6.10 PL1

The recent discovery of an obscure method in which to expose a cross-site scripting (XSS) error in vBulletin when using specific browser software means that it is necessary to release Patch Level (PL) versions of both 3.7.1 and 3.6.10.

Although it is difficult to exploit the XSS flaw, and the potential for exposure and damage is limited, we nonetheless recommend that customers upgrade to protect themselves.

Upgrading from 3.7.1 or 3.6.10

If you are already running 3.7.1 or 3.6.10, the process you will be required to follow to make your board immune to the XSS problem is very simple. Visit the Patches section of the vBulletin Members' Area and download either the patch for 3.7.1, or the patch for 3.6.10, according to the version you are currently running, then extract the files from the archive you downloaded, then upload the files to your board via FTP etc., overwriting the existing files. This will update your version to the PL1 release.

There is no need to run an upgrade script if you are already running 3.7.1 or 3.6.10.

Upgrading from Versions Earlier than 3.7.1 or 3.6.10

If you are not already running 3.7.1 or 3.6.10, you should download the most latest version from the Members' Area and perform an upgrade as normal.

Full instructions for upgrading vBulletin are available here.

PHP and MySQL Requirements

Please note that vBulletin 3.7.x requires at least PHP 4.3.3 and MySQL 4.0.16 or later.

However, we recommend that vBulletin 3.7.x is run on PHP 5.2.6 with APC (or a similar opcode cache) and MySQL 5.0.51 for best performance and stability.

End of Life for PHP 4

The PHP group has announced the end of life for PHP 4. We strongly recommend that customers update their servers to PHP 5.2.6 if they are still running PHP 4. vBulletin 3.7.1 supports PHP 5 and MySQL 5 fully, though you may need to disable strict mode for MySQL, see here on how to enable 'force_sql_mode'.

Note: We will continue to support PHP 4 in the vBulletin 3 series.

Download vBulletin 3.7.1 PL1 or 3.6.10 PL1

As usual, both versions released today are available for all customers with valid, active licenses to download from the vBulletin Members' Area.

vBulletin Members Area

**Brandon Sheley** · 06-09-2008, 01:22 PM

wtf.. pl1 ?..

**Cerberus** · 06-09-2008, 01:46 PM

Hey they added patches LOL...Thank You

**snakeair** · 06-09-2008, 02:15 PM

Get ready for another patch in 7 day's. We should start taking bet's.

What's the odds? lol

**bdude** · 06-09-2008, 05:12 PM

Thank God this is a patch release - I just upgraded to 3.7.1 and if this was a full upgrade I would be so pissed off, can't the idiots at Jelsoft get a release right? that would be a refreshing change than this parade of inability to check their releases for bugs throughly BEFORE releasing them.

**Yogesh Sarkar** · 06-09-2008, 07:18 PM

Only three files need to be uploaded for 3.6.10, I suspect the same is also true for 3.7.1.

**Curio** · 06-09-2008, 08:22 PM

Quote:

Originally Posted by bdude

[b] can't the idiots at Jelsoft get a release right? that would be a refreshing change than this parade of inability to check their releases for bugs throughly BEFORE releasing them.

Quote:

expose a cross-site scripting (XSS) error in vBulletin when using specific browser software

Is Jelsoft really to blame over the browser vendor?

The upgrade wasn't too bad using just the patch files; always annoys me when they change functions.php though as I then have to go through and reapply edits.

**Brandon Sheley** · 06-09-2008, 08:28 PM

I don't know why they didn't just call it 3.7.2

**Michael Biddle** · 06-09-2008, 08:31 PM

.2 will be the next 2 month release. they stated security fixes will go pl

**Yogesh Sarkar** · 06-09-2008, 11:12 PM

Quote:

Originally Posted by Brandon

I don't know why they didn't just call it 3.7.2

Because its just a patch to address one vulnerability, revision number only change when lots of changes are made.

**ArnyVee** · 06-10-2008, 05:17 AM

Boy, am I happy that I didn't upgrade when I was going to originally.

This keeps me 'up to date' until the next update in about 4 hours.

**1kether1** · 06-10-2008, 08:28 AM

It was a painless upgrade. I was 3.7.1 and just FTP-ed the new files up to my server and that was that. Much easier than a normal upgrade. (Those take forever because of the template edits that I do.)

Cheers,
Bruce

**Caddyman** · 06-10-2008, 08:40 AM

ahh, another night of upgrading....YAYYAYAAY

**SticKer** · 06-10-2008, 02:00 PM

I was going to upgrade to 3.7.1 from 3.7.0 version today but good i took a look at vbulletin and i found a new update.

Just completed the upgrade to 3.7.1 PL1 without any problems.

**Brandon Sheley** · 06-10-2008, 06:22 PM

I ran the update last night, so we are good to go for now

**ArnyVee** · 06-11-2008, 12:10 PM

Alright peeps....since I just leapfrogged from 3.6.8 P2 allllll the way to 3.7.1 P1 today....where do I find a nice article/manual on the 'new features' and more importantly....how to make them work?

I looked at the 'first look' type of postings at vBulletin and there were quite a few things that I want to make sure that I'm taking advantage of (albums, public messaging, thread prefixes, etc) that I don't know how to 'turn on' or make sure that I set them up correctly.

Now, keep in mind that I'm dizzy from the work that I did (with Chase's help) and I can't think straight. So, don't destroy me if there's an easy way to find this information and it seems like I'm just being lazy.

**Brandon Sheley** · 06-11-2008, 12:51 PM

vbulletin.com/docs

**Caddyman** · 06-11-2008, 01:38 PM

i posted this on a clients forum

http://www.turboflatsix.com/new-turbo-flat-t143.html

its from vb somewhere, is a good overview with pics (people like pics)

**ArnyVee** · 06-12-2008, 07:58 AM

Thanks Brandon!

I had never actually known about these docs. I know....I've been hiding under some rocks or something.

**snakeair** · 06-12-2008, 01:55 PM

I've upgraded so many times, i got the "upgrade" instructions memorized. lol

I can't remember what i did 2 days ago but i can remember how to upgrade software for vbulletin.