Test of release 3.7.0 - RCs

[michield]

Things we need to check on the new 3.7.0 release.

• #1082 - avoid HEAD requests processing anything #1086 avoid unsubscribes with jo=1 and HEAD requests
• Update plugins #1085 Update to the latest Common and CKEditor plugins #1081 ckeditor4 plugin
• Update plugins #1085 updater plugin (may be tricky to test)
• Detect ip6 with admin login #1084 login check on IPv6
• ISSUE-340: add ckeditor5 #1071 ckeditor5
• ISSUE-338: saml login #1064 saml login
• ISSUE-341: add imap2 plugin #1063 bounce processing with imap
• REST API

[phpListDockerBot]

This issue has been mentioned on phpList Discuss. There might be relevant details there:

https://discuss.phplist.org/t/3-7-0-release-candidate-ready-to-test/10292/1

[michield]

#1088 ckeditor updated to the latest
769209a580c069958f0399e468992966a71c01b2 saml2 plugin added

[michield]

• TESTING ISSUE-341: add imap2 plugin #1063 bounce processing with imap plugin

• configured a bounce mailbox

• ran "phplist -pprocessbounces"

• it fetched the mails from the bounce mailbox

• removed php-imap from the docker container (apt remove php-imap)

• sent another test mail to the bounce address

• ran "phplist -pprocessbounces"

• it still managed to fetch the mails from the mailbox

I consider that a PASS.

[michield]

TESTING #1085 updater plugin (may be tricky to test)

• Edit vi /var/www/phpList3/public_html/lists/admin/init.php
• change define("VERSION","whatever it is"); to define("VERSION","3.6.15");
• enabled updater plugin
• run update of code
• it updated to 3.6.16

I consider that a PASS

[michield]

While on 3.6.16 (from the previous test)

TESTING #1082 avoid unsubscribes with jo=1 and HEAD requests

• add a subscriber test1082@phplist.com
• run curl request for HEAD of this user (using their uniqid)

curl -I http://localhost/lists/?p=unsubscribe\&uid=4288f42934903f5000f08dfe738aea11\&jo=1
HTTP/1.1 200 OK
Date: Thu, 26 Jun 2025 21:56:47 GMT
Server: Apache/2.4.62
Set-Cookie: phpListSession=b4011670t6n7bplb8dtt71jol4; path=/; HttpOnly; SameSite=Strict
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: http://localhost
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=UTF-8

• notice the user is marked blacklisted and unsubscribed (proof of the issue)
• update to the original version (restart the docker stack)
• create subscriber test1082@phplist.com again
• run curl request HEAD for this user

curl -I http://localhost/lists/?p=unsubscribe\&uid=2aac365be7a628aac7b83acac1a8094a\&jo=1
HTTP/1.1 200 OK
Date: Thu, 26 Jun 2025 22:03:23 GMT
Server: Apache/2.4.62
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=UTF-8

• notice the user is not unsubscribed (issue fixed).
• notice it is not logged anywhere (opportunity for improvement)

I consider this a PASS

[michield]

• ckeditor5 needs at least the "source" button added
• ckeditor5 on my local system adds a /s/ to the URL of an image that is uploaded

FAIL

[michield]

• saml plugin wasn't included

FAIL

[michield]

• Common plugin reports version https://github.com/bramley/phplist-plugin-common/releases/tag/3.34.2
• CKeditor plugin reports version https://github.com/bramley/phplist-plugin-ckeditor/releases/tag/2.8.2

PASS

[gregoa]

(Sorry for the late reply, I didn't use phplist again until today.)

TESTING #1082

I reverted index.php to the original version (i.e. dropped my local workaround) and then applied #1086. And then I sent out a new newsletter and crossed my fingers 🤞

Result: no unsubscriptions so far after ~150 emails (among them lots of microsoft-handled ones). I guess that counts as a PASS.

Thanks for fixing this problem!

[TatevikGr]

TESTING #1084

Injected X-Forwarded-For via Apache

ProxyPreserveHost On
RequestHeader set X-Forwarded-Proto "http"
RequestHeader set X-Forwarded-For "%{REMOTE_ADDR}s"

Baseline (without PR)

1. X-Forwarded-For = %{REMOTE_ADDR}s

• Login OK
• Navigation OK, no logout
  ✅ Works

2. Hard-coded IPv6 in X-Forwarded-For 2001:0db8:85a3:0000:0000:8a2e:0370:7334

• Login succeeds
• Logged out on every new page
  ❌ Fails

With PR #1084 applied

1. %{REMOTE_ADDR}s

• Login OK
• Navigation OK, no logout
  ✅ Works

2. Hard-coded IPv6 in X-Forwarded-For 2001:0db8:85a3:0000:0000:8a2e:0370:7334

• Login OK
• Navigation OK, no logout
• IPv6 stored in remote_ip6 correctly
  ✅ Works

3. Hard-coded mixed header chain IPv6, IPv4 in X-Forwarded-For 2001:0db8:85a3:0000:0000:8a2e:0370:7334,127.0.0.1

• Login OK
• Navigation OK, no logout
• first IP stored in correct column
  ✅ Works