Introduction

ATTENTION! This release contains an XSS and SQL Injection Vulnerability fix. All previous versions of kunena are affected. Please update immediately.

Kunena 3.0.6 [K 3.0.6] is available for download as a native Joomla extension for J! 2.5 and J! 3.x. This version is a security release for Kunena that addresses several maintenance issues that have been reported since the last version release. and this new version replaces (and makes obsolete) all previous versions of Kunena.

This version of Kunena coincides with the simultaneous release of an updated language pack, downloaded separately, for deployment on non-English websites. The release of this version does not not coincide with the release of other Kunena Add-ons that have not been updated at this time and that may or may not be updated for this version.

In general, Kunena Add-ons designed for previous versions of K 3.x should interoperate with this version of Kunena; in general, Kunena Add-ons designed for older major versions of Kunena will not interoperate with this version of Kunena.

The summary of important changes in K 3.0.6 are:

  • XSS vulnerability (credit goes to Raymond Rizk from Dionach Ltd., thank you for the report, much appreciated.
  • SQL Injection vulnerability (credit goes to Raymond Rizk from Dionach Ltd., thank you for the report, much appreciated.

The Kunena 3.0.6 release notes are essential reading before installing K 3.0.6 for the first time or if you are upgrading from an earlier version of Kunena.

Upgrading to K 3.0 involves changes that may affect Kunena's interoperability with other extensions installed on your site. For this reason it is advisable that you first test K 3.0.6 on a test site before you upgrade your live production site(s).

For users who are familiar with older versions of Kunena, an overview of some of key differences is given in Kunena Features in the Wiki.

Other details

Find the full online README: Here.

K 3.0.6 is available for download on the download page.

K 3.0.6 is has been tested with the latest J! 3.3.3 (stable) and further work has been done to make Kunena more compatible with the J! 3.2.X series. For people contemplating the use of J! 3.3 on their site they should first test K 3.0.6 to make sure that there are no outstanding compatibility issues.

Other plans

The team is is continuing to develop new, optional add-ons for Kunena — additional templates and features (e.g. WYSIWYG editing, "teasers") — that will be probably become available in the medium-term on a commercial basis (that is, things people will be able to purchase). The basic component and the currently available modules and plugins will continue to be available at no cost and there are no plans to reduce the current features in those areas.

Log in to comment

suamaytinhits replied the topic:
9 years 5 months ago
suamaytinhits's Avatar
Thanks Coder4life and Kunena Team.

Upgraded from 3.0.5 to 3.0.6 / Joomla 3.3.3 without a hiccup.
sozzled replied the topic:
9 years 7 months ago
sozzled's Avatar

lifeguard wrote: It was a plugin ... JCH optimize

Yes, we have written many times in this forum , JCH Optimize is not recommended if you want to use Kunena.
lifeguard replied the topic:
9 years 7 months ago
lifeguard's Avatar

lifeguard wrote: this update sucks.

i have a site joomla 3.3 with kunena 3.0.5 and its ok.

i see the update, make a copy of the site, and update to kunena 3.0.6
so far so good.

but the speed of kunena 3.0.6 its horrible.

i cannot understand why it works so slow.
my kunena 3.0.5 need 0,200seconds to load a page, but 3.0.6 needs almost 6 seconds to load everypagee.

the sites ar the same, because its only test copy.
i am not gonna update this to my live-site because my members will kill me.

for the record, all other components working fine. News, search, admin works fast. Only kunena is slow.


Ok, after a time, i will give a reaction.
You were right. It was me, who failed with this.

Foprgive me for this post. It was not to blame anybody, and i have mucht for the team behind Kunena, and his supporters.

It was a plugin, who makes my site slower. JCH optimize. Maybe i mis a setting, or something.
But on a new site, with same config, it works like a charm.
Thanks people, and aigain, forgive me for my stupid comment here.
Oddy94 replied the topic:
9 years 7 months ago
Oddy94's Avatar
IceCube replied the topic:
9 years 8 months ago
IceCube's Avatar
Yeah, I already tried this and it won't add new entries (like Kunena) to the table. Purge only resets the enabled column to 1 and Find Updates will check the availability of the URLs and sets enabled to 0 if a URL can't be opened.
Then I'll go for a manual update and let you know if an entry to this table is added with it.

edit: Update successful and entry with URL update.kunena.org/3.0/list.xml was added to the table :)
coder4life replied the topic:
9 years 8 months ago
coder4life's Avatar

In this table I can't see an entry referring to a Kunena site. Should there be one?


Yes there should be.

You might of tried this, but lets try this. Click Button "Purge" in the Joomla Extensions Manager and then Click "Find Updates". Let me know if Kunena shows up. If it does not you will need to install manually, however reinstalling should fix the update issue for next time.
IceCube replied the topic:
9 years 8 months ago
IceCube's Avatar
Thanks for your fast reply. It's Joomla 2.5

This message contains confidential information

Database collation check: The collation of your table fields are correct

Joomla! SEF: Enabled | Joomla! SEF rewrite: Enabled | FTP layer: Disabled |

This message contains confidential information
htaccess: Exists | PHP environment: Max execution time: 60 seconds | Max execution memory: 64M | Max file upload: 128M

Kunena menu details:

Warning: Spoiler!

Joomla default template details : dark_night_free | author: ThemeKat | version: 1.0.0 | creationdate: Unknown

Kunena default template details : Joomlana_Dark_II_FREE | author: bz_kunena-templates | version: 2.0.3 | creationdate: 2013-01-11

Kunena version detailed: Kunena 3.0.5 | 2014-03-09 [ Invecchiato ]
| Kunena detailed configuration:

Warning: Spoiler!
| Kunena integration settings:
Warning: Spoiler!
| Joomla! detailed language files installed:
Warning: Spoiler!

Third-party components: UddeIM 3.3

Third-party SEF components: None

Plugins: Content - Kunena Discuss 3.0.1

Modules: Kunena Login 3.0.1


I already noticed this update_sites table in the DB and that most of the entries were disabled. After clearing the extension cache, they were reenabled and it offered me the latest update for Joomla, but not for Kunena. In this table I can't see an entry referring to a Kunena site. Should there be one?
Is it possible to manage these entries in the Joomla Backend somehow or only in the DB?
coder4life replied the topic:
9 years 8 months ago
coder4life's Avatar
Hello IceCube,

What version of Joomla are you running out of curiosity, can you please provide a configuration report which gives these details to use automatically.

Just a note the normal Joomla Cache is different from the Extension Manager Cache. In Joomla 2.5 you may notice that Joomla has a "Purge" button for the cache in the Joomla Extensions Manager. This was to purge the update records that had become disabled by Joomla automatically. Joomla does this for security reasons as the update URL has become invalid and there is no reason to check it anymore. However the disable of update capability for a specific URL was not perfect and problems could occur.

Disabling of update records has a side affect, it is subject to to a false positive scenario due to network issues or server maintenance of the vendor, the vendor in this case being our server at Kunena.org. An update record can become disabled if our server becomes unavailable for a short period of time during the time that you used "Find Updates" button. Joomla now ignores that update record in the database because it is set as disabled, it never checks again to see if the site has been made available. So now updates do not get reported in the Joomla Extension Manager from Kunena.org because Joomla never looks again.

What is crazy in J3.0 to J3.3 there is currently no way to purge the disabled status records without going into the database. There is a patch for J3.4 to reapply the purge button to be able to fix these issues in case they happen. If you have J3.0 - J3.3 you will have to manually log into your database (through a tool like phpMyAdmin) and go into the updates table to re-enable the Kunena specifc entry to be able to update. J3.4 should read a purge button (or similar form of it as it exists in J2.5)
Shimei replied the topic:
9 years 8 months ago
Shimei's Avatar
Yes. The update wasn't showing in the backend of my Joomla 3.3.3 either. I did a manual install by downloading the package and then installing it onto my site. The downloads are available here:

www.kunena.org/download
IceCube replied the topic:
9 years 8 months ago
IceCube's Avatar
Is this version already available via Joomla autoupdate?
I have 3.0.5 installed and Joomla is not displaying that an update is available for Kunena.
I already tried clearing caches.
Matias replied the topic:
9 years 8 months ago
Matias's Avatar

lifeguard wrote: but the speed of kunena 3.0.6 its horrible.

i cannot understand why it works so slow.
my kunena 3.0.5 need 0,200seconds to load a page, but 3.0.6 needs almost 6 seconds to load everypagee.


There should be no changes in Kunena 3.0.6 which may affect the speed. The only thing that comes into my mind is that something is different in your copy, most likely either you have wrong file permissions (file caching doesn't work) or database doesn't have all the keys (or indexes aren't optimized).

Easiest way to get some idea of what's happening is to enable Joomla debug mode and look what's taking all that time.
coder4life replied the topic:
9 years 8 months ago
coder4life's Avatar
Hello lifeguard,

Up to 2 seconds is a long time for a site, are you having the same problems on the Kunena.org website? Also worth noting that we have not received any reports about Kunena being any slower.

From a developer perspective nothing has architecturally change that should create a slow down.

Can you please configuration report as it tell us more about your set up.
lifeguard replied the topic:
9 years 8 months ago
lifeguard's Avatar

Shimei wrote: Thanks Coder4life and Kunena Team.

Upgraded from 3.0.5 to 3.0.6 / Joomla 3.3.3 without a hiccup.

where is your copyright to kunena?
lifeguard replied the topic:
9 years 8 months ago
lifeguard's Avatar
this update sucks.

i have a site joomla 3.3 with kunena 3.0.5 and its ok.

i see the update, make a copy of the site, and update to kunena 3.0.6
so far so good.

but the speed of kunena 3.0.6 its horrible.

i cannot understand why it works so slow.
my kunena 3.0.5 need 0,200seconds to load a page, but 3.0.6 needs almost 6 seconds to load everypagee.

the sites ar the same, because its only test copy.
i am not gonna update this to my live-site because my members will kill me.

for the record, all other components working fine. News, search, admin works fast. Only kunena is slow.
Shimei replied the topic:
9 years 8 months ago
Shimei's Avatar
Thanks Coder4life and Kunena Team.

Upgraded from 3.0.5 to 3.0.6 / Joomla 3.3.3 without a hiccup.