This release contains security fixes – you should upgrade as soon as possible

phpList 3.3.0 is the most significant update in years, incorporating over 150 code changes including system-wide security hardening and a brand new user interface.

New user interface

1. A new theme named ‘Trevelin’ presents a much improved user interface. It is included by default and can be enabled using the Theme Switcher.
2. New Theme Switcher allows the application theme to be set via the user interface for the first time, via the Config -> Settings page

Security

1. Introduced Unique User ID code generation for all personalised links in campaigns. Thanks to Edmund Huggett.
2. Introduced optional HMAC authentication code generation for campaign link tracking. Thanks to Edmund Huggett.
3. Increased entropy used by CSRF tokens used to authenticate links between admin pages. Thanks to Edmund Huggett.
4. Introduced additional checks for user-submitted campaign data. Thanks to Tim Coen at Curesec.
5. Introduced additional checks when redirecting subscriber preferences, forward, and unsubscribe links, and admin password reset links. Thanks to Edmund Huggett.
6. Increased randomness of tokens preventing cross-site request forgeries by 3.4 x 10⁴³ times. Thanks to Edmund Huggett.

Usability

1. Introduced Javascript-based loading of statistics for handling large datasets to avoid page load timeout errors on the following pages:
   • Statistics overview
   • Domain Statistics
   • Campaign click statistics
   • View opens
   • View bounces per list

   See Commit 1 and 2

2. Fixed slow page load due to failed RSS News Feed caching. Thanks to Duncanc. See the Pull Request.
3. Added accessibility labels to form fields on public subscribe pages. See the Pull Request.
4. Improved and compacted table layout of ‘View members of list’ page. See the Pull Request.
5. Improved About page formatting. See the Pull Request.
6. Added announcement mailing list signup form to about page. See the Pull Request.
7. Linked campaign title to view campaign on campaign statistics page. See the Pull Request.
8. Linked list name to List Members page from Subscriber Lists page. See the Pull Request.
9. Updated help page content, added links to resources. See the Pull Request.
10. Improved message queue processing notification email content. See the Pull Request.
11. Improved new installation email notification formatting. See the Pull Request.
12. Improved formatting of mail queue event log messages. See the Pull Request.
13. Improved formatting of Event log page. See Pull Request.
14. Improved date formatting on the Schedule tab of the Campaign composer pages. See the Pull Request.
15. Improved form field descriptions on Campaign composer page. See Pull Request.
16. Numerous fixes to table column titles and labels
17. Numerous number formatting fixes on Admin pages

Languages & Translations

1. Languages preferences are saved between sessions. When language is set manually it will be stored after logout (by default phpList uses the default language of the web browser)
2. Made ‘Logout’ and ‘Login’ buttons translatable in new theme See the Pull Request.
3. Numerous fixes to English language text capitalisation

Plugins

1. Introduced support for plugin handling of mail queue sending. Thanks to Duncanc. See the Pull Request.
2. Clearer error message on plugins page when url fopen wrappers are not enabled. Thanks to Duncanc. See the Pull Request.

Other fixes

1. Fix bug misreporting bounce message download failure. Thanks to Duncanc. See the Pull Request.
2. Made content of Database Check page translatable. See the Pull Request.

Support

Need help upgrading your phpList server? Ask the community at discuss.phplist.com. Professional support from community experts, as well as manuals, source code, and developer resources, can be found at phplist.org. Report bugs to the bugtracker!
Want to focus on campaigns and forget hosting headaches? Sign up at phplist.com for an account with everything included. Send from 300 free messages to 30 million messages per month.