I'm running Nodebb in version 4.14.0 When I try to upload a .apkg file (anki cards) there is a notification with "Invalid MIME Type". I tried to debug but found any usefull information on how to get more/debug logs without shutting down nodebb for a while. A few versions ago it was possible to upload .apkg files Any ideas on how to fix this?

Hi everyone. I note that there is a section Federation -> Categorization which allows you to have hashtags go to a category, and you can have a post with certain hashtags go into a queue for review, but I don't see a "Hashtag blacklist" where it outright rejects the post. Is there one that I am not seeing or is that not a thing?

Similar to the v2.0 plugin list, I am creating this topic to keep a list of plugins that are updated for 4.15.0 and up. We will release 4.15.0 in August. I am going to keep a list of plugins here that are compatible already. If you have any plugins that are not in this list let us know and we will try to get them updated within reason. If a plugin is already updated to 3.2.x or 4.x it is usually straightforward to update to 4.15.0. The migration guide is here. ️ - Plugin updated - Plugin not updated - Pull request pending Bundled Plugins ️ nodebb-plugin-2factor": "8.0.3" ️ nodebb-plugin-composer-default": "11.0.5" ️ nodebb-plugin-dbsearch": "7.0.0" ️ nodebb-plugin-emoji": "6.0.15" ️ nodebb-plugin-emoji-android": "4.1.1" ️ nodebb-plugin-link-preview": "2.2.8" ️ nodebb-plugin-markdown": "13.2.7" ️ nodebb-plugin-mentions": "5.0.0" ️ nodebb-plugin-spam-be-gone": "2.3.5" ️ nodebb-plugin-web-push": "0.9.0" ️ nodebb-rewards-essentials": "1.0.3" ️ nodebb-theme-harmony": "3.1.0" ️ nodebb-theme-lavender": "8.1.0" ️ nodebb-theme-peace": "3.1.1" ️ nodebb-theme-persona": "15.1.1" ️ nodebb-widget-essentials": "8.0.2" Other Plugins ️ @nodebb/[email protected] ️ @nodebb/[email protected] ️ @nodebb/[email protected] ️ @nodebb/[email protected] ️ @nodebb/[email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-calendar ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-customize ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-github-embed ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-night-mode nodebb-plugin-ns-embed ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-private-forum ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-twitter nodebb-plugin-two-way-block nodebb-plugin-undelete-users nodebb-plugin-ws-dice

I noticed that my forum notifications have turned into code; they're displaying the HTML code directly instead of. I've set it up so that posting a thread earns one contribution point. I noticed that the notification text is formatted in HTML, and I'm using the latest version of Nodebb.Does anyone know what's going on here? thanks

I've already disabled Federation from ACP on this NodeBB (docker deployed). Register/Login screen no longer have "Manage Open Social Web handles" button. But at topic or category view, click "Log in to reply" or "Log in to Post", still have "Manage Open Social Web handles" link showing up. Answer from AI: The modal is rendered from public/templates/modals/intents/trigger.tpl. The link text comes from the language key login:manage-social-web-handles. The click handler is in public/src/modules/intents.js (_intentsHandler), and it is wired up for guest “Log in to reply/post” buttons by: public/src/client/topic.js public/src/client/category.js public/src/client/world.js The ACP Federation → Enable ActivityPub toggle (meta.config.activitypubEnabled) already controls the “Manage Open Social Web Handles” button on the /login and /register pages via osw_logins, but the topic/category/world guest modal does not check that flag. That is a core bug.

My NodeBB is built on docker. (But it may not be the matter, because this is also happening at this official NodeBB community) It's working fine on any of my home PC, mobile..etc. But in my company PC (may behind some kind of proxy), occasionally, it will be frozen when I try to navigate after a short idle time. Sometimes, it even prompt to download some file without extension (named categories and I am trying to navigate to categories page). When this happen, dev console shows the following: nodebb.min.js?v=b864d8633dd:6 ServiceWorker registration succeeded. nodebb.min.js?v=b864d8633dd:5 Uncaught TypeError: Cannot create property 'config' on string '   � 
 ���  � 
' at Object.success (nodebb.min.js?v=b864d8633dd:5:43721) at L (nodebb.min.js?v=b864d8633dd:53:25777) at Object.fireWith [as resolveWith] (nodebb.min.js?v=b864d8633dd:53:26544) at Tn (nodebb.min.js?v=b864d8633dd:56:5940) at XMLHttpRequest.<anonymous> (nodebb.min.js?v=b864d8633dd:56:8417)

Purge a topic will cause a [object Set] ghost tag in system This is happening in both 4.13.2 and 4.14

When you upload a private image, anyone with the link can still view it. Isn't this feature supposed to require certain conditions to access the uploaded content, as I had imagined?

Some language were missing after updated [image: 1783651529110-1eafa332-ce78-4584-b964-00e86f4e574c-image.jpeg] [image: 1783651548955-280a053d-5fd0-43c4-badf-824830150072-image.jpeg]

With temperatures reaching well into the 30s (in celsius of course ) in the Toronto area, we're all firmly in summer mode , but that won't stop us from forging on ahead with new features and fixes for NodeBB! There are improvements across ActivityPub federation, administrative tooling, and security hardening. Our ActivityPub integration receives bug fixes including duplicate handling, configurable rate limiting, and better error reporting, alongside new hooks for remote user lifecycle events. The registration queue and invitations are reorganized into a dedicated UI with a new "Reject All" bulk action and improved notification handling. Security reports have been coming in consistently throughout the month with valid security reports (though almost all AI discovered and generated). This led to stricter privilege checks on post diffs, crossposts, and GDPR exports, plus protection against username enumeration. The NodeBB team strongly encourages upgrading to v4.14.0 for the latest security fixes and federation improvements. The release also includes a new tx() translation helper, Benchpress escaping improvements, and a first-run categories onboarding modal for fresh installations. Here are the high level changes you can expect to see when you upgrade from v4.13.0 to v4.14.0... Federation Regression Fixes! Around v4.12.0 or so, a number of regressions were unintentionally introduced as part of security fixes that severely hampered federation — especially with Lemmy-based instances and relays. We've resolved those regressions and Relay/Lemmy federation should resume within 24 hours after upgrading. The public key fetch rate limiter logic was simplified and updated (due to it being faulty and not really working in the first place), streamlined some duplicate logic with Like/Dislike activities, improved the AP Errors reporting page in the ACP, added a parent traversal depth guard, fixed an issue where updates to scheduled topics were accidentally being federated out, and about a hundred other smaller bugs Registration Queue updates The registration queue was moved out of the ACP, and invitations are also managed in this page now. A "reject all" button was added to allow admins to quickly reject every queued registrant in one fell swoop. Privilege & Security Fixes Post diff access — Check topics:read privilege when loading post diffs Crossposts — Added source category privilege check to crossposts GDPR export — Prevented global moderators from performing GDPR data exports Nids ownership — Don't mark nids as read/unread that you don't own Upload privileges — Prevent uploading thumbnails without upload:image privilege; replaced extension-based MIME validation with content sniffing Username enumeration — Use dummy lockout key for non-existent users to prevent enumeration Category disabled flag — Check category disabled flag on getRaw Benchpress Improvements We use Benchpress as our templating engine. We updated our integration for security and performance. @baris put together a thorough write-up for that one here. Miscellaneous First-run modal — New categories onboarding modal for fresh installations Dashboard warnings — Added localhost and URL mismatch warnings to admin dashboard notices Push notifications should work on Safari/iOS devices now (via the web-push plugin)

Hello Everyone, The upcoming 4.14.0 release will have breaking changes for themes and plugins that display html and translation tokens via template variables. This post will outline the changes required to custom themes based on the changes made in the Harmony theme to serve as a guide for upgrading your own themes & plugins. 1. Escape all template variables via {variable} The first and biggest change is the introduction of html and translation escaping of all variables in templates. Prior to 4.14.0 if you wrote {variable} in a template the value would be inserted into the html page unchanged. Benchpressjs supports escaping these variables but it was disabled to prevent a breaking change when the migration was done from templates.js to benchpressjs. We are now aligning with how most template engines work. What this means for themes is if variable contained html then it will no longer be displayed properly. For example the content of posts is rendered via {posts.content} in partials/topic/post.tpl. Upgrading to 4.14.0 without fixing the template would result in: [image: 1781913742447-blog-1.png] To fix this in 4.14.0, you will have to wrap the variable with double braces like {{posts.content}}. This will stop the escaping and the post content will display properly. Double braces should only be used on content that is html sanitized. In this case NodeBB converts markdown to html and sanitizes it so it is safe. Do not use {{variable}} syntax on untrusted content. The {{}} syntax should also be used on all helper functions that return html. For example buildAvatar function return html to display the user icon or picture. So {buildAvatar(user, "24px", true)} should be changed to {{buildAvatar(user, "24px", true)}}. We've updated all these helpers to escape the values and attributes used. If you have custom helpers you should do the same. Below is an example of a helper that is used in header.tpl. It uses the same escape function that {variable} uses. function buildMetaTag(tag) { const name = tag.name ? `name="${escape(tag.name)}" ` : ''; const property = tag.property ? `property="${escape(tag.property)}" ` : ''; const content = tag.content ? `content="${escape(tag.content).replace(/\n/g, ' ')}" ` : ''; return '<meta ' + name + property + content + '/>\n\t'; } Refer to section 3, for a full list of changes that were made to Harmony theme to upgrade it to 4.14.0. 2. Migration to tx() and txEscape() helper functions This is the second major change, and we're introducing it as part of an ongoing upgrade process to help avoid creating too much work for theme maintainers at once. The way translation works in NodeBB is through a post render step. After benchpressjs renders the template and generates the html page, our translator scans the html page and replaces translation tokens that look like [[namespace:key]] with their correct translation. Here is roughly how it goes from request to final html presented to user. User requests /topic/1 Load all required data from database Call filter:parse.post to turn post markdown into html Translator escapes the html from step 3, so tokens in the post content don't get translated Benchpress renders the html filling in all data Translator scans html replacing translation tokens with their translations Translator unescapes the result (reverses step 4) Final html sent to user With the introduction of a helper function tx() instead of scanning the entire page, we can use the helper to translate tokens. For example instead of <button>[[topic:reply]]</button> we can use <button>{{tx("topic:reply")}}</button>. This approach is more efficient because only the translation tokens are processed. With 4.14.0 we will still run the whole page translation to make migration easier, but for 4.15.0 we are going to remove that step, so the entire flow will be: User requests /topic/1 Load all required data from database Call filter:parse.post to turn post markdown into html Benchpress renders the html, calls tx() to translate tokens Final html sent to user We are introducing 2 new helper functions for templates: tx() - translates the string or array passed in. This supports a variety of different usages: Old New [[namespace:key]] {{tx("namespace:key")}} [[namespace:key, foo]] {{tx("namespace:key", "foo")}} [[namespace:key, {arg1}, {arg2}]] {{tx("namespace:key", arg1, arg2)}} {text} {{tx(text)}} You can also pass an array to the tx() helper. For example if you have: const myVar = ["namespace:key", "arg1", "arg2"]; This can be passed straight to tx in the template {{tx(myVar)}} tx helper html escapes arguments and invalid translation keys. txEscape() - escapes variable so it is not translated. This is a stop-gap solution until we remove the whole page translation. For example we use this on content that should not be translated. If someone puts [[namespace:key]] in their post it doesn't get translated. After 4.15.0 it will be safe to remove these since everything will use tx(). 3. List of changes for Harmony Theme Let's summarize the changes needed for 4.14.0. Wrap template helper functions that return html with {{}} instead of {}. Replace {translationString} with {{tx(translationString)}}. Wrap API values that should not be translated with {{txEscape(content)}}. (Ongoing) Replace old translation tokens [[namespace:key]] with {{tx("namespace:key")}}. Refer to the Harmony Upgrade Changes Topic for the full list of changes. 4. Bootbox & app.renderAsync & Misc. The global bootbox object has been removed, there is a new modals module that also handles translations. Use modals.(dialog|confirm|alert|prompt) instead of bootbox variants. The only difference is these methods return a promise. So the old const modal = bootbox.dialog() becomes const modal = await modals.dialog() If you are using app.renderAsync to render a template it needs the translation context for tx() helper to work. NodeBB will automatically try to detect the user's language if app.renderAsync is called as part of a web request, but if it is called from a cron job or manually you can pass it the translation data like below: const data = { foo: 1 }; const languages = nodebb.require('./src/languages); const data._i18n = languages.getFull('en-GB'); const html = await app.renderAsync('mytemplate', data); config.assetBaseUrl was deprecated in 2.x, it is now removed, use config.asset_base_url Why are we doing this? As you know, we have a Bug Bounty Program, and the most commonly reported vulnerability is XSS, which is typically caused by unsanitized user input being rendered directly into HTML. Currently we use the validator module to escape user controlled values however with the introduction of Activitypub support, attackers can manipulate data directly in the database of a remote NodeBB. When this category or user profile is displayed in a target NodeBB instance if any fields are not escaped via validator.escape() then it opens us up for XSS vulnerabilities. By moving the escaping to the template engine, we mitigate this and we no longer have to validator.escape() every value we load from the database. All these changes are now live on this forum. Please let us know if you notice any issues. We plan to release 4.14.0 in July and follow up with 4.15.0 in August. Let us know in the Technical Support category if you need help with updating your themes or plugins.

Right now I am trying to get a nodebb forum migrated to a new server. But right now I am getting an error that says. ERROR: You specified an invalid date. I have been unable to figure out how to fix this and could use some help.

I have not really found a recent topic that seemed to be up to date so let me briefly explain: As previously explained I have setup NodeBB internally for our team and it works great but not on mobile (Android) devices on different browsers. Not sure if this has to do with NodeBB itself but probably someone knows more than me. It seems like something gets blocked as I always have to load pages two times, as on the first load it always looks like that ... [image: 1721676459548-dd259972-79d5-401a-8d51-838a78c0f11a-image.png] or [image: 1721676987807-055b861a-7e23-41e1-90e6-5cb786343ed1-image.png] ... for almost all pages and only after a reload the ressources/html/ are rendered as they should ... [image: 1721676473176-6bdd9b0e-63de-4d84-8276-9813f2f88ac7-image.png] But mostly I still cannot really interact with the page. Posting/Replying is also not really possible. The navigation bar is also somehow blocking a bit of the page. As on Desktop everything works like a charm I am curious if there is something which is known for causing this issues. I am aware of the fact that other NodeBB pages are of course working fine on mobile devices so I am suspecting also the VPN we use to access the network but never had issue before either so .... any clues?

I'm running NodeBB and so far I have no complaints. It works without having to resort to cussing. I've looked but I'm not finding anything that offers Telegram integration. Ideally, it would be great that people could post from Telegram BUT... I'll be happy with anything. Being able to point to Telegram will help with signups.

Ugh. Help appreciated. I am guessing a template name changed?? [image: 1783724871330-screenshot-2026-07-10-at-12.02.42-pm.png]

Not sure if poll plugin is from official, but I find this plugin is very buggy. Those ACP setting not effective, allow guest ti view vote not working..etc I've refactored quite alot to make it usable. hopefully sometime can pick that up to make a workable version compatible with 4.14

Hi everyone, Just a fun discussion. If you could add one feature to every online community or forum, what would it be and why? It could be something that improves discussions, makes moderation easier, or simply makes the community more enjoyable to use. Looking forward to hearing your ideas!

Markdown plugin -> ACP -> Open external links in a new tab/window This option is not working. It's still opening in the same window

Hello @baris I've configured my NodeBB so that images posted in topics are not visible to guests (unauthenticated / guest mode users). This works for images embedded in posts. [image: 1783340485037-7bd320e6-9a2c-4715-b23a-29ba6da9d9e8-image.jpeg] However, guests can still access the images through the topic image gallery. [image: 1783340514441-8ce349bc-e378-4c54-bec3-94097f99187f-image.jpeg] I'd like these gallery images to also be hidden from guests. Is there a recommended way to restrict the topic image gallery to logged-in users only? For example: A hook or setting that filters gallery images based on the user's privileges/UID A privilege I can revoke for the guests group A theme/template adjustment to conditionally render the gallery only for authenticated users Any guidance on the cleanest approach (plugin hook vs. template condition vs. privilege) would be appreciated. Thanks! EDIT: For know, I use this custom JS : $(window).on('action:ajaxify.end', function () { if (!app.user || app.user.uid === 0) { $('[component="topic/thumb/list"]').remove(); } });

Hi all @baris I would like to run a privacy-focused forum on NodeBB and I'd like to stop collecting and storing user IP addresses entirely. From what I can tell, NodeBB core logs IPs on login and exposes them to admins, but there's no built-in setting to turn this off. I've found older community threads and issue asking for an "anonymous logging" / "Privacy Mode" toggle, but it doesn't look like any answer Is there any supported way to disable IP logging without patching core? Would the team consider adding an ACP toggle (default: on, to preserve current behaviour) to disable IP collection forum-wide? Or maybe periodically purging stored IPs with a script, but stopping collection at the source would be much cleaner. Thanks!