Thanks you for the maintain of 1.2 branch .

But when the 1.3 branch was stabilized ? And it's possible to use the SVN version in production ?

1.3 is still in development stage, and you are not recommended to use it in production environment.

But when the 1.3 branch was stabilized ? And it's possible to use the SVN version in production ?

So it was bug rather than a security issue.

I mean, that "group_id=1" should never be there because it didn't make sense at all, not because it was dangerous. Did I got it right?

Yes and no. You're right that it didn't make sense at all. The security issue is that it allows me to subscribe to topics I'm not allowed to see. Which means I get emails when people post in them (along with the contents of the post)

I mean, that "group_id=1" should never be there because it didn't make sense at all, not because it was dangerous. Did I got it right?

Oh yes, we didn't update the DB update script -.-

Don't feel bad, the PunBB team forgot the 12_to_1221_update.php file in their changed files zip.

Let's cut them some slack though, they're doing the best they can in their spare time

Forgive me my ignorance, why is this dangerous?
fp.group_id=1

I guess the group with the id=1 could be other than the admin group in some situations...?

group_id 1 is the admin group, the old query was basically selecting all forums the admin group could view, rather than the actual user logged in can view.

I guess the group with the id=1 could be other than the admin group in some situations...?