Conversation
supportHi, I love this plugin and I’ve been using it for a long time, it helped me a lot. However, I have some concerns. All of my sites where this plugin is installed have been attacked at least once, including a File Manager plugin installed, etc. I’ve removed all of them. However, I’m not sure if this plugin is the problem. I use very few plugins. I haven’t had any problems since connecting to Cloudflare. Does this plugin contain a security breach? Is it vulnerable to SQL injection? Will I be safe now and in the future? I use this plugin for user integration, showing unread notifications and pm counts, and recent topics. I get this error log many times: [01-Aug-2025 20:23:40 UTC] PHP Warning: Attempt to read property "user_unread_privmsg" on string in /home/x/public_html/wp-content/themes/xtheme/header.php on line 72 [01-Aug-2025 20:23:40 UTC] PHP Warning: Attempt to read property "user_unread_privmsg" on string in /home/x/public_html/wp-content/themes/xtheme/header.php on line 267 The code I used is: <a href="https://x.com/forums/pm" aria-label="PM" class="mmpm" tooltip="Messages" flow="down"><?php global $w3all_phpbb_usession; if ($w3all_phpbb_usession->user_unread_privmsg > 0) { echo '<span class="pmcount' . ($w3all_phpbb_usession->user_unread_privmsg > 9 ? ' digits' : '') . ($w3all_phpbb_usession->user_unread_privmsg > 99 ? ' plus' : '') . '">' . $w3all_phpbb_usession->user_unread_privmsg . '</span>'; } ?> svg </a> <a href="https://x.com/forums/ucp.php?i=ucp_notifications" aria-label="notifications" class="mmbell" tooltip="Notifications" flow="down"><?php global $w3all_phpbb_unotifications; if (!empty($w3all_phpbb_unotifications) && $w3all_phpbb_unotifications > 0) { echo '<span class="noticescount' . ($w3all_phpbb_unotifications > 9 ? ' digits' : '') . ($w3all_phpbb_unotifications > 99 ? ' plus' : '') . '">' . $w3all_phpbb_unotifications . '</span>'; } ?> svg </a> I use(x2) it in a different place for mobile view. I’m concerned about the security measures. I read some bad reviews on phpbb.com and I’m upset. Is the plugin making too many unnecessary SQL queries? Is it necessary for the database passwords to appear there every time after I enter them once? Likewise for the phpBB extension. When I asked the AI about it, it said there were too many security breaches and that I shouldn’t use it. I know it’s a bit silly, but it made me suspicious. I love this extension and want it to be at its best. I appreciate your work. Best.
Hello Halil. The security of the plugin is now ok. The unique security bug that affected the plugin have come out due to (i don’t hide) my misunderstand about add_filter( 'authenticate', 'wp_w3all_login_existent_phpbb_fix', 5, 3 ); added to fix something for an external plugin and which opened a security breach. What i can say is that it will not anymore happen because i will not proceed with rush and while doing something else. For the same purpose the plugin has been added to a security check program, but i am quite sure that nothing more from now on will come out about security. The plugin code check now in the correct way all login flows, that are 3 when a login is done in WP. There is now way to break into. Said that, also the security of the mysql connection is very ok: it has never been a security problem. If you wish to not archive mysql credentials you can use the custom config file inclusion . I will add the how to about this today. I will reply again here adding notes to this post within today or tomorrow while updating again the code about something i noted wrong (it’s not about security but very important to be fixed) and checking for your issues and testing the code all over as more i can. The plugin version 3.0.2 will be released possibly today. All the new code i did for phpBB about vertical views and the Posts slider example will be released as free also very soon into github. See you later, thank you for your appreciations and kind. About security for your site, what i did for mine: said that the bug reporter acted like a stupid idiot and just to despise (if it is allowed me to say that) because the guy published here into this public forum the bug, and not sent a private email to notice me and it would be patched in minutes (as it has been as soon i seen the report). Anyway he have not come into my site to deface it or something else (for what it result to me) but maybe have come into your (who know), he or some other “fantastic stupid”. So what i can suggest is: Change the db passwords and update WP files: WP admin -> WordPress Updates -> You have the latest version of WordPress. -> click on re-install this will clean up any eventual problem on WP core files Update the template file and all plugins code if possible. Eliminate all themes your are not using from the template WP folder. This what i did so to cut off any possibility that something malicious have been maybe deployed. I also replaced all phpBB files overwriting any existent, even if the attacker had no possibility to try to connect via ftp in any way into my site due to the fact it is protected for this by a different login. See you later.
The custom phpBB config.php file inclusion was already there but not documented, it has been added now: https://www.axew3.com/w3/2025/08/custom-phpbb-config-php-file-inclusion/ It will be also soon improved under the aspect of the phpBB URL addition into same file so without having to setup the phpBB URL by the way into the plugin admin when using this way (custom config file), as explained into the help added page. This reply was modified 9 months, 2 weeks ago by axew3 .
Thank you Alessio. I am grateful. I changed the WP files, but some sites have custom themes that I created, and when I checked, it seemed to be fine. We were talking a while ago about integrating WordPress post/comment with phpBB topic/post. You said you’ve started that. What do you have to say about that?
That i will release also that code on github! ps I hope smart guys will be able to make it better and so good to be used. and… This reply was modified 9 months, 2 weeks ago by axew3 .
I finished it (posts replies) thinking that the result would be good NOT adding to topic’s posts, the posts that are replies of posts, but adding that replies into the topic only as replies to be showed below the post and attached on fly when required onclick into Show Replies like into the online example ( Show Replies /Reply text buttons are on the bottom/left of each post) https://www.axew3.com/www/dev/viewtopic.php?t=6 But i am not sure that Discourse do the same. I did not well understand: Discourse, display Posts Replies that belong to a posts, also into the normal topic’s flow beside when onclick it is requested and so showed under the post? Do you know? This reply was modified 9 months, 2 weeks ago by axew3 .
Even though I’ve seen many sites that use Discourse, I’ve never used it. Honestly, I love that you did this, I was going to use it but I put it off until later because I needed to customize it for my style, maybe. WP Post = phpBB Topic First Post and WP Comments = phpBB Posts in the Topic, it seem like this: https://www.macrumors.com/2025/08/12/iphone-17-air-a19-pro-chip-reduced-gpu-cores/ (Only featured comments/posts are visible here, but I want all of them and realy to be there.) When I publish a WordPress post, a new topic with the same content is automatically created in phpBB. Any replies in that phpBB topic appear as comments under the WordPress post, and any comments posted in WordPress are also added as replies to the same phpBB topic (with the original comment author preserved, post comment only members). Is implementing such a system too complicated or tedious? Is it better to have comments/posts added to both databases, or just one way? Is it better to have them in both and work synchronously? This way, I can use the phpBB notification system, likes, etc. I know I’ve talked about this before, but now I’m replaying it in my head. I want to use it in a new project. I want it to be as simple and effective as possible. This reply was modified 9 months, 2 weeks ago by Halil . This reply was modified 9 months, 2 weeks ago by Halil .
Hello, it is clear why it is giving you error the last version. I am ready to release 3.0.2 that is all fixed, but i cannot commit the plugin code! I will try to contact someone here, and i will try again later to commit. If not i will momentary put the plugin 3.0.2 code available at axew3.com
Until tomorrow the WordPress repository is down: https://wordpress.org/support/topic/cannot-commit-the-plugin-code/ You can download the all fixed 3.0.2 here in the while (3.0.1 is not properly working! Download 3.0.2 and Read the post): https://www.axew3.com/w3/forums/viewtopic.php?t=2050
Thank you.
Hello Halil. The security of the plugin is now ok. The unique security bug that affected the plugin have come out due to (i don’t hide) my misunderstand about add_filter( 'authenticate', 'wp_w3all_login_existent_phpbb_fix', 5, 3 ); added to fix something for an external plugin and which opened a security breach. What i can say is that it will not anymore happen because i will not proceed with rush and while doing something else. For the same purpose the plugin has been added to a security check program, but i am quite sure that nothing more from now on will come out about security. The plugin code check now in the correct way all login flows, that are 3 when a login is done in WP. There is now way to break into. Said that, also the security of the mysql connection is very ok: it has never been a security problem. If you wish to not archive mysql credentials you can use the custom config file inclusion . I will add the how to about this today. I will reply again here adding notes to this post within today or tomorrow while updating again the code about something i noted wrong (it’s not about security but very important to be fixed) and checking for your issues and testing the code all over as more i can. The plugin version 3.0.2 will be released possibly today. All the new code i did for phpBB about vertical views and the Posts slider example will be released as free also very soon into github. See you later, thank you for your appreciations and kind. About security for your site, what i did for mine: said that the bug reporter acted like a stupid idiot and just to despise (if it is allowed me to say that) because the guy published here into this public forum the bug, and not sent a private email to notice me and it would be patched in minutes (as it has been as soon i seen the report). Anyway he have not come into my site to deface it or something else (for what it result to me) but maybe have come into your (who know), he or some other “fantastic stupid”. So what i can suggest is: Change the db passwords and update WP files: WP admin -> WordPress Updates -> You have the latest version of WordPress. -> click on re-install this will clean up any eventual problem on WP core files Update the template file and all plugins code if possible. Eliminate all themes your are not using from the template WP folder. This what i did so to cut off any possibility that something malicious have been maybe deployed. I also replaced all phpBB files overwriting any existent, even if the attacker had no possibility to try to connect via ftp in any way into my site due to the fact it is protected for this by a different login. See you later.
The custom phpBB config.php file inclusion was already there but not documented, it has been added now: https://www.axew3.com/w3/2025/08/custom-phpbb-config-php-file-inclusion/ It will be also soon improved under the aspect of the phpBB URL addition into same file so without having to setup the phpBB URL by the way into the plugin admin when using this way (custom config file), as explained into the help added page. This reply was modified 9 months, 2 weeks ago by axew3 .
Thank you Alessio. I am grateful. I changed the WP files, but some sites have custom themes that I created, and when I checked, it seemed to be fine. We were talking a while ago about integrating WordPress post/comment with phpBB topic/post. You said you’ve started that. What do you have to say about that?
That i will release also that code on github! ps I hope smart guys will be able to make it better and so good to be used. and… This reply was modified 9 months, 2 weeks ago by axew3 .
I finished it (posts replies) thinking that the result would be good NOT adding to topic’s posts, the posts that are replies of posts, but adding that replies into the topic only as replies to be showed below the post and attached on fly when required onclick into Show Replies like into the online example ( Show Replies /Reply text buttons are on the bottom/left of each post) https://www.axew3.com/www/dev/viewtopic.php?t=6 But i am not sure that Discourse do the same. I did not well understand: Discourse, display Posts Replies that belong to a posts, also into the normal topic’s flow beside when onclick it is requested and so showed under the post? Do you know? This reply was modified 9 months, 2 weeks ago by axew3 .
Even though I’ve seen many sites that use Discourse, I’ve never used it. Honestly, I love that you did this, I was going to use it but I put it off until later because I needed to customize it for my style, maybe. WP Post = phpBB Topic First Post and WP Comments = phpBB Posts in the Topic, it seem like this: https://www.macrumors.com/2025/08/12/iphone-17-air-a19-pro-chip-reduced-gpu-cores/ (Only featured comments/posts are visible here, but I want all of them and realy to be there.) When I publish a WordPress post, a new topic with the same content is automatically created in phpBB. Any replies in that phpBB topic appear as comments under the WordPress post, and any comments posted in WordPress are also added as replies to the same phpBB topic (with the original comment author preserved, post comment only members). Is implementing such a system too complicated or tedious? Is it better to have comments/posts added to both databases, or just one way? Is it better to have them in both and work synchronously? This way, I can use the phpBB notification system, likes, etc. I know I’ve talked about this before, but now I’m replaying it in my head. I want to use it in a new project. I want it to be as simple and effective as possible. This reply was modified 9 months, 2 weeks ago by Halil . This reply was modified 9 months, 2 weeks ago by Halil .
Hello, it is clear why it is giving you error the last version. I am ready to release 3.0.2 that is all fixed, but i cannot commit the plugin code! I will try to contact someone here, and i will try again later to commit. If not i will momentary put the plugin 3.0.2 code available at axew3.com
Until tomorrow the WordPress repository is down: https://wordpress.org/support/topic/cannot-commit-the-plugin-code/ You can download the all fixed 3.0.2 here in the while (3.0.1 is not properly working! Download 3.0.2 and Read the post): https://www.axew3.com/w3/forums/viewtopic.php?t=2050
Thank you.