Hi @baris , Scenario : I have one web application in next.js in front end and node.js in backend. It has courses, text, Users, etc. We use SSO for the same in web application and in NodeBB. Now our NodeBB (Forum) i need to integrate with my web application. After searching i come to this point is that we can use endpoint API to create frontend in my web application. Could you please tell me can we integrate this? Where i can find the list of all Endpoints API? Is this better way ? or we can do custom modifications in frontend and try to make similar look of current web application ? which is better?

Hello Everyone, The upcoming 4.14.0 release will have breaking changes for themes and plugins that display html and translation tokens via template variables. This post will outline the changes required to custom themes based on the changes made in the Harmony theme to serve as a guide for upgrading your own themes & plugins. 1. Escape all template variables via {variable} The first and biggest change is the introduction of html and translation escaping of all variables in templates. Prior to 4.14.0 if you wrote {variable} in a template the value would be inserted into the html page unchanged. Benchpressjs supports escaping these variables but it was disabled to prevent a breaking change when the migration was done from templates.js to benchpressjs. We are now aligning with how most template engines work. What this means for themes is if variable contained html then it will no longer be displayed properly. For example the content of posts is rendered via {posts.content} in partials/topic/post.tpl. Upgrading to 4.14.0 without fixing the template would result in: [image: 1781913742447-blog-1.png] To fix this in 4.14.0, you will have to wrap the variable with double braces like {{posts.content}}. This will stop the escaping and the post content will display properly. Double braces should only be used on content that is html sanitized. In this case NodeBB converts markdown to html and sanitizes it so it is safe. Do not use {{variable}} syntax on untrusted content. The {{}} syntax should also be used on all helper functions that return html. For example buildAvatar function return html to display the user icon or picture. So {buildAvatar(user, "24px", true)} should be changed to {{buildAvatar(user, "24px", true)}}. We've updated all these helpers to escape the values and attributes used. If you have custom helpers you should do the same. Below is an example of a helper that is used in header.tpl. It uses the same escape function that {variable} uses. function buildMetaTag(tag) { const name = tag.name ? `name="${escape(tag.name)}" ` : ''; const property = tag.property ? `property="${escape(tag.property)}" ` : ''; const content = tag.content ? `content="${escape(tag.content).replace(/\n/g, ' ')}" ` : ''; return '<meta ' + name + property + content + '/>\n\t'; } Refer to section 3, for a full list of changes that were made to Harmony theme to upgrade it to 4.14.0. 2. Migration to tx() and txEscape() helper functions This is the second major change, and we're introducing it as part of an ongoing upgrade process to help avoid creating too much work for theme maintainers at once. The way translation works in NodeBB is through a post render step. After benchpressjs renders the template and generates the html page, our translator scans the html page and replaces translation tokens that look like [[namespace:key]] with their correct translation. Here is roughly how it goes from request to final html presented to user. User requests /topic/1 Load all required data from database Call filter:parse.post to turn post markdown into html Translator escapes the html from step 3, so tokens in the post content don't get translated Benchpress renders the html filling in all data Translator scans html replacing translation tokens with their translations Translator unescapes the result (reverses step 4) Final html sent to user With the introduction of a helper function tx() instead of scanning the entire page, we can use the helper to translate tokens. For example instead of <button>[[topic:reply]]</button> we can use <button>{{tx("topic:reply")}}</button>. This approach is more efficient because only the translation tokens are processed. With 4.14.0 we will still run the whole page translation to make migration easier, but for 4.15.0 we are going to remove that step, so the entire flow will be: User requests /topic/1 Load all required data from database Call filter:parse.post to turn post markdown into html Benchpress renders the html, calls tx() to translate tokens Final html sent to user We are introducing 2 new helper functions for templates: tx() - translates the string or array passed in. This supports a variety of different usages: Old New [[namespace:key]] {{tx("namespace:key")}} [[namespace:key, foo]] {{tx("namespace:key", "foo")}} [[namespace:key, {arg1}, {arg2}]] {{tx("namespace:key", arg1, arg2)}} {text} {{tx(text)}} You can also pass an array to the tx() helper. For example if you have: const myVar = ["namespace:key", "arg1", "arg2"]; This can be passed straight to tx in the template {{tx(myVar)}} tx helper html escapes arguments and invalid translation keys. txEscape() - escapes variable so it is not translated. This is a stop-gap solution until we remove the whole page translation. For example we use this on content that should not be translated. If someone puts [[namespace:key]] in their post it doesn't get translated. After 4.15.0 it will be safe to remove these since everything will use tx(). 3. List of changes for Harmony Theme Let's summarize the changes needed for 4.14.0. Wrap template helper functions that return html with {{}} instead of {}. Replace {translationString} with {{tx(translationString)}}. Wrap API values that should not be translated with {{txEscape(content)}}. (Ongoing) Replace old translation tokens [[namespace:key]] with {{tx("namespace:key")}}. Refer to the Harmony Upgrade Changes Topic for the full list of changes. 4. Bootbox & app.renderAsync & Misc. The global bootbox object has been removed, there is a new modals module that also handles translations. Use modals.(dialog|confirm|alert|prompt) instead of bootbox variants. The only difference is these methods return a promise. So the old const modal = bootbox.dialog() becomes const modal = await modals.dialog() If you are using app.renderAsync to render a template it needs the translation context for tx() helper to work. NodeBB will automatically try to detect the user's language if app.renderAsync is called as part of a web request, but if it is called from a cron job or manually you can pass it the translation data like below: const languages = nodebb.require('./src/languages); const data = { foo: 1, _i18n: languages.getFull('en-GB'), }; const html = await app.renderAsync('mytemplate', data); config.assetBaseUrl was deprecated in 2.x, it is now removed, use config.asset_base_url Why are we doing this? As you know, we have a Bug Bounty Program, and the most commonly reported vulnerability is XSS, which is typically caused by unsanitized user input being rendered directly into HTML. Currently we use the validator module to escape user controlled values however with the introduction of Activitypub support, attackers can manipulate data directly in the database of a remote NodeBB. When this category or user profile is displayed in a target NodeBB instance if any fields are not escaped via validator.escape() then it opens us up for XSS vulnerabilities. By moving the escaping to the template engine, we mitigate this and we no longer have to validator.escape() every value we load from the database. All these changes are now live on this forum. Please let us know if you notice any issues. We plan to release 4.14.0 in July and follow up with 4.15.0 in August. Let us know in the Technical Support category if you need help with updating your themes or plugins.

Hello, I am seeing "error=csrf-invalid" with a NodeBB installation recently upgraded to 4.14.5. The installation is NodeBB 4.14.5 (package version 2.31.5) running in Cloudron 9.2.0 on Ubuntu 24.04.4. Existing sessions continue to work; observed issues are: All attempts to login result in "error=csrf-invalid" and the message "Login Unsuccessful // We were unable to log you in, likely due to an expired session. Please try again" NodeBB users with "admin" privilege cannot actually get to the admin panel (clicking on the "admin" icon takes the user to the /user/admin page rather than the /admin page) Simple things like "(on the server side) let's restart the app and see what happens" and "(on the client side) let's clear all browser cache/cookies/history/data and let's try this on different browsers (Safari/Brave/Chrome)" have been tried to no avail. Any advice for what else I should try?

@testing-ground A test post from Mastodonhello *world*#test

Today I found that the link preview disappeared. However, if I check "Youtube" the preview for Youtube works

Hi, reporting an RTL bug on my forum When tagging a user for example @julian If there is no text on the same line, the RTL is used and written from left to right. If there is text on the same line, then the line is right-aligned as it should be. Hope I understood.

You may have noticed me testing some rich embeds on this forum, or perhaps you've noticed that on this board, pasted links automatically expand/unfurl into a pretty little box instead of staying as a plain anchor. This is due to the Link Preview plugin, which I started working on last month! Link Previews ... wait, why did I just paste a boring ol' anchor like that? https://github.com/NodeBB/nodebb-plugin-link-preview/ SHAZAM! You can install this plugin by running npm install nodebb-plugin-link-preview, or via the plugin manager. It should show up on any NodeBB v3 instance.

Just a quick note for NodeBB admins to update to v4.14.4 as there was a regression identified for versions v4.12.0 to v4.14.3 where federation was broken between NodeBB and Mastodon instances with authorized fetch enabled.

String error [image: 1784874910595-7b8a76e1-bbd8-4618-8fa1-54c2b5170f1d-image.jpeg] The limit at ACP is counting wrong If set maximum:0, it can only add 1 reaction, not "Unlimited" if set 3, it's actually allows 4. [image: 1784874878940-b89afd1e-78c9-44c1-af52-9dc968fe9172-image.jpeg]

When I am in a chat between users, and send a link to a forum page. The link does not display the page but automatically redirects to login. All users who received the link have access to the category, but the category is hidden and not accessible to all forum users. I hope I understood.

urpose: verify whether creating a topic automatically sets the author's topic watch state to "Watching" (followTopicsOnCreate). Steps after publish: Check this topic's watch control (Watching / Not Watching / Ignoring). Record the result. Please do not reply unless testing reply notifications.

Starting with 4.13.3, the default value of trust_proxy will be false on new installs to ensure a secure default setting. An upgrade script will set the value to true if it is not found in config.json to prevent breaking existing installs. The documentation is updated to reflect the change: trust_proxy (Default: false) Enables Express' proxy trust handling for req.ip and related values. Only set this to true when NodeBB is behind a reverse proxy that strips or overwrites untrusted X-Forwarded-For headers. If this is left unset, NodeBB will not trust forwarded client IP headers. For more information see expressjs docs https://expressjs.com/en/5x/guide/behind-proxies/ If you are upgrading from 4.13.2 and already use a proxy like nginx, you don't have to do anything. trust_proxy: true will be automatically set in config.json If your nodebb was facing the public directly on port 4567(which isn't recommended). Remove trust_proxy from config.json OR set it to false via trust_proxy: false.

Hello, tried following a Lemmy community (e.g. [email protected]) both on my own instance (citiverse.it, v4.14.2) and here on community.nodebb.org, from the category page (/category/[email protected]). In both cases the follow seems to go through, but new posts never show up afterwards. Is this a known issue, or should I dig further and post more details?

When you upload a private image, anyone with the link can still view it. Isn't this feature supposed to require certain conditions to access the uploaded content, as I had imagined?

Hi, I see issue on upgrade and now emoji not works. The issue : # ./nodebb build started 2026-07-27T06:49:22.321Z [4567/2873] - info: [build] Building in parallel mode 2026-07-27T06:49:22.322Z [4567/2873] - info: [build] plugin static dirs build started 2026-07-27T06:49:22.323Z [4567/2873] - info: [build] requirejs modules build started 2026-07-27T06:49:22.323Z [4567/2873] - info: [build] client js bundle build started 2026-07-27T06:49:22.324Z [4567/2873] - info: [build] admin js bundle build started 2026-07-27T06:49:22.324Z [4567/2873] - info: [build] client side styles build started 2026-07-27T06:49:22.324Z [4567/2873] - info: [build] admin control panel styles build started 2026-07-27T06:49:22.326Z [4567/2873] - info: [build] templates build started 2026-07-27T06:49:22.326Z [4567/2873] - info: [build] languages build started 2026-07-27T06:49:23.129Z [4567/2873] - info: [build] plugin static dirs build completed in 0.807sec 2026-07-27T06:49:24.363Z [4567/2873] - info: [build] admin js bundle build completed in 2.039sec 2026-07-27T06:49:24.363Z [4567/2873] - info: [build] client js bundle build completed in 2.04sec 2026-07-27T06:49:29.967Z [4567/2873] - info: [build] requirejs modules build completed in 7.643sec 2026-07-27T06:49:29.967Z [4567/2873] - info: [build] Bundling with Webpack. 2026-07-27T06:49:30.084Z [4567/2873] - info: [build] client side styles build completed in 7.76sec 2026-07-27T06:49:30.184Z [4567/2873] - info: [build] admin control panel styles build completed in 7.859sec [10%] building (25/251 modules) [10%] building (400/491 modules) 338 assets 541 modules ERROR in ./build/public/scripts-client.js 3433:5 Module parse failed: Unexpected token (3433:5) You may need an appropriate loader to handle this file type, currently no loaders are configured to process this file. See https://webpack.js.org/concepts#loaders | }); | > ;CC0 1.0 Universal | | Statement of Purpose webpack 5.108.4 compiled with 1 error in 10716 ms 2026-07-27T06:49:46.038Z [4567/2873] - info: [build] Asset compilation successful. Completed in 23.713sec. My release : NodeBB : v4.14.2 NodeJS : v24.18.0 My plugins : # ./nodebb plugins Active plugins: * @nodebb/[email protected] (installed, enabled) * @nodebb/[email protected] (installed, enabled) * @nodebb/[email protected] (installed, enabled) * [email protected] (installed, disabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, disabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, disabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, disabled) * [email protected] (installed, disabled) * [email protected] (installed, disabled) * [email protected] (installed, enabled)

Similar to the v2.0 plugin list, I am creating this topic to keep a list of plugins that are updated for 4.15.0 and up. We will release 4.15.0 in August. I am going to keep a list of plugins here that are compatible already. If you have any plugins that are not in this list let us know and we will try to get them updated within reason. If a plugin is already updated to 3.2.x or 4.x it is usually straightforward to update to 4.15.0. The migration guide is here. ️ - Plugin updated - Plugin not updated - Pull request pending Bundled Plugins ️ nodebb-plugin-2factor": "8.0.3" ️ nodebb-plugin-composer-default": "11.0.5" ️ nodebb-plugin-dbsearch": "7.0.0" ️ nodebb-plugin-emoji": "6.0.15" ️ nodebb-plugin-emoji-android": "4.1.1" ️ nodebb-plugin-link-preview": "2.2.8" ️ nodebb-plugin-markdown": "13.2.7" ️ nodebb-plugin-mentions": "5.0.0" ️ nodebb-plugin-spam-be-gone": "2.3.5" ️ nodebb-plugin-web-push": "0.9.0" ️ nodebb-rewards-essentials": "1.0.3" ️ nodebb-theme-harmony": "3.1.0" ️ nodebb-theme-lavender": "8.1.0" ️ nodebb-theme-peace": "3.1.1" ️ nodebb-theme-persona": "15.1.1" ️ nodebb-widget-essentials": "8.0.2" Other Plugins ️ @nodebb/[email protected] ️ @nodebb/[email protected] ️ @nodebb/[email protected] ️ @nodebb/[email protected] ️ @nodebb/[email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-calendar ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-github-embed ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-night-mode ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-private-forum ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] ️ [email protected] nodebb-plugin-twitter nodebb-plugin-two-way-block ️ [email protected] nodebb-plugin-ws-dice nodebb-widget-rss

Hello @baris I see this bug with tenor gif icon on "Chat Room" ACP widget after upgrade nodebb v4.11.3 to 4.14.2 nodebb 4.14.2 nodebb-plugin-tenor-gif 4.1.1 nodebb-widget-essentials 8.0.4 [image: 1785072246899-2110a365-269a-46c8-ad41-90cc3f2d4f27-image.jpeg] It's OK on Chat room without widget : [image: 1785073120582-665152ee-4d91-4447-81cf-0d21060faef0-image.jpeg]

Some of the plugins were published here separately, but I will not refrain from bringing them here again for the sake of continuity of all the plugins together. nodebb-plugin-admin-chats Chat management plugin For GitHub repository and all details - https://github.com/palmoni5/nodebb-plugin-admin-chats Can be installed through the forum administration interface nodebb-plugin-chat-search Chat search plugin For GitHub repository and full details - https://github.com/palmoni5/nodebb-plugin-chat-search Can be installed by running npm install nodebb-plugin-chat-search nodebb-plugin-reply-as-bot A plugin that allows you to reply as a bot For the GitHub repository and all the details - https://github.com/palmoni5/nodebb-plugin-reply-as-bot Can be installed by running npm install nodebb-plugin-reply-as-bot nodebb-plugin-impersonate-users A plugin that allows administrators to log in as other users For the GitHub repository and all the details - https://github.com/palmoni5/nodebb-plugin-impersonate-users Can be installed by running npm install nodebb-plugin-impersonate-users nodebb-plugin-simple-contact A plugin that creates a dedicated contact page and links to the administration interface, including smart management of referrals through the administration interface To the GitHub repository and all the details - https://github.com/palmoni5/nodebb-plugin-simple-contact Can be installed by running npm install nodebb-plugin-simple-contact nodebb-plugin-custom-notify A plugin that adds the topic name to notifications sent to subscribers when a topic is created in a category they follow GitHub repository and all details - https://github.com/palmoni5/nodebb-plugin-custom-notify Can be installed by running npm install nodebb-plugin-custom-notify nodebb-plugin-edit-locked-topics A plugin that adds the ability to edit posts in locked threads to the forum permissions list For the GitHub repository and all the details - https://github.com/palmoni5/nodebb-plugin-edit-locked-topics Can be installed by running npm install nodebb-plugin-edit-locked-topics nodebb-plugin-original-upload-filenames A plugin that specifies that when downloading a file from the forum, it will be downloaded with its original name without the timestamp that is automatically added to it For the GitHub repository and all the details - https://github.com/palmoni5/nodebb-plugin-original-upload-filenames Can be installed by running npm install nodebb-plugin-original-upload-filenames nodebb-plugin-silent-edit A plugin that allows authorized users to edit a message without sending a notification to followers For the GitHub repository and all the details - https://github.com/palmoni5/nodebb-plugin-silent-edit Can be installed by running npm install nodebb-plugin-silent-edit nodebb-plugin-chat-read-receipts An extension that allows users to see whether participants have read their chat message, and shows the user new messages each time a chat is opened For the GitHub repository and all the details - https://github.com/palmoni5/chat-read-receipts Can be installed by running npm install nodebb-plugin-chat-read-receipts nodebb-plugin-moving-topics A plugin that allows users to move the topic they opened to another category up to a certain number of messages For the GitHub repository and all the details - https://github.com/palmoni5/nodebb-plugin-moving-topics Can be installed by running npm install nodebb-plugin-moving-topics ~~ This plugin is no longer relevant because it was included in the core in recent versions.

Hi all @baris I would like to run a privacy-focused forum on NodeBB and I'd like to stop collecting and storing user IP addresses entirely. From what I can tell, NodeBB core logs IPs on login and exposes them to admins, but there's no built-in setting to turn this off. I've found older community threads and issue asking for an "anonymous logging" / "Privacy Mode" toggle, but it doesn't look like any answer Is there any supported way to disable IP logging without patching core? Would the team consider adding an ACP toggle (default: on, to preserve current behaviour) to disable IP collection forum-wide? Or maybe periodically purging stored IPs with a script, but stopping collection at the source would be much cleaner. Thanks!

I get an odd 404 request for /list on my forum Is this an issue? and if so, how do I fix the 404. I dont see the same request on this forum. my current plugins running on NodeBB 4.14.2 are: Active plugins: * [email protected] (installed, disabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, disabled) * [email protected] (installed, enabled) * [email protected] (installed, enabled) * [email protected] (installed, disabled) * [email protected] (installed, disabled) * [email protected] (installed, disabled) * [email protected] (installed, disabled) * [email protected] (installed, enabled) * [email protected] (installed, disabled) * [email protected] (installed, disabled) * [email protected] (installed, disabled) * [email protected] (installed, enabled)