[bonelifer]

A maintenance pass over the extension: organization conventions, the problems a full validation found, form labels from an accessibility check, and refreshed screenshots.

Security fixes

• ACP category management read the category id as a string and put it into SQL, ran move up, move down and sync from plain links, and added, edited and deleted categories without checking a form token. A forged link or page could make an administrator run SQL or delete a category with its articles. The id is now an integer, the links carry a link hash and the forms are checked.
• Moving an article in the ACP and saving Knowledge Base permissions now check the form token.
• The approve page showed the title, description and pending revision text of unapproved articles to any registered member, whatever their Knowledge Base access. Only moderators and members of the team the article is assigned to can open it now.
• Smaller: three attachment modes in attachments_info.php now ask for the same permission as the installed modules, and the minimum-version message uses positional placeholders.

Accessibility

An axe-core run (WCAG 2.2 A and AA, desktop and phone widths, keyboard focus) found form controls with no accessible name: the category dropdown, the copy-link boxes on an article, the article text box and custom-field dropdowns on the posting form, the queue's team and action menus, and in the ACP the category picker, the new-category box and the file-size unit menu. Each is now labelled from a language string; the queue's action menu uses the new KB_QUEUE_ACTION. The Teams block on the ACP configuration page now uses valid definition-list markup.

Conventions

• composer.json description matches the GitHub description and the README's first line.
• The minimum-version message uses the KB_NOT_ENABLEABLE key.
• New lint.yml: php -l and composer validate on PHP 8.1 and 8.5.
• .editorconfig is left out of release archives.
• README: Tests and Lint badges, a Features list (taking in the loose author-transfer and status paragraphs), Requirements and Contributing; the out-of-date Automated testing section is gone.

Screenshots

07-acp-configuration.png shows the new introduction setting, and 17-index-introduction.png and 18-acp-introduction.png show the introduction on the index and its ACP settings. docs/update/2026-11-12/ holds two shots for the update post.

Testing

Claude ran:

• Fresh seed-forum boards with the full fixtures for phpBB 3.3.19 and 4.0.0-a3-dev on SQLite, MySQL 8.4, MariaDB, PostgreSQL 16 and MSSQL (ten boards). On each, tests/browser/kb_page_sweep.js loaded 26 of 26 pages, including two new refusal checks; the new phpbb-release-tools feature check passed 14 of 14, including its disable, purge and enable round trip; and a second disable, purge and enable left nothing behind and finished all 43 migrations.
• An upgrade from the current development build's code (313eac3, 40 migrations) on SQLite and MySQL boards: migrated to 43 and passed the sweep and the feature check.
• The PHPUnit suite on phpBB 3.3.x and master with the MySQL and PostgreSQL fixtures: 578 tests, none skipped. New tests for the article move and permission saves fail on the code before the fix.
• EPV and phpcs on both branches: clean.

Not changed: the inactive tabs' colour contrast, which comes from prosilver's tab colours and differs per style, and small touch targets in the article lists and queue rows.

The feature check is in phpbbmodders/phpbb-release-tools#72.

---

Investigated and written by Claude on behalf of William Jacoby (bonelifer).

🤖 Generated with Claude Code