YAFNET.RazorPages
4.0.10
dotnet add package YAFNET.RazorPages --version 4.0.10
NuGet\Install-Package YAFNET.RazorPages -Version 4.0.10
<PackageReference Include="YAFNET.RazorPages" Version="4.0.10" />
<PackageVersion Include="YAFNET.RazorPages" Version="4.0.10" />
<PackageReference Include="YAFNET.RazorPages" />
paket add YAFNET.RazorPages --version 4.0.10
#r "nuget: YAFNET.RazorPages, 4.0.10"
#:package YAFNET.RazorPages@4.0.10
#addin nuget:?package=YAFNET.RazorPages&version=4.0.10
#tool nuget:?package=YAFNET.RazorPages&version=4.0.10
YAF.NET Razor Pages Client Library
Prerequisites:
- ASP.NET Core 10.0 (YAF v4.x)
Quick Guide
Add the YAF Nuget Packages
- Install the YAFNET.RazorPages Package via Nuget Browser or the console
> dotnet add package YAFNET.RazorPages
- Depending on which Data Provider you want top use add the package ..
YAFNET.Data.SqlServer Package via Nuget Browser or the console
> dotnet add package YAFNET.Data.SqlServer
YAF.Data.MySQL Package via Nuget Browser or the console
> dotnet add package YAFNET.Data.MySQL
YAFNET.Data.PostgreSQL Package via Nuget Browser or the console
> dotnet add package YAFNET.Data.PostgreSQL
YAFNET.Data.Sqlite Package via Nuget Browser or the console
> dotnet add package YAFNET.Data.Sqlite
Getting Started
Program.cs
In the Program.cs add the following.
var builder = WebApplication.CreateBuilder(args);
builder.Host.UseServiceProviderFactory(new AutofacServiceProviderFactory());
builder.Host.ConfigureYafLogging();
builder.Host.ConfigureContainer<ContainerBuilder>(containerBuilder =>
{
containerBuilder.RegisterYafModules();
});
builder.Services.AddRazorPages(options =>
{
options.Conventions.AddAreaPageRoute("Forums", "/SiteMap", "/Sitemap.xml");
}).AddYafRazorPages(builder.Environment);
builder.Services.AddYafCore(builder.Configuration, "/Forums");
// only needed for blazor
builder.Services.AddServerSideBlazor();
var app = builder.Build();
....
app.RegisterAutofac();
app.UseAntiXssMiddleware();
app.UseStaticFiles();
app.UseSession();
app.UseYafCore(BoardContext.Current.ServiceLocator, app.Environment);
app.UseRobotsTxt(app.Environment);
app.MapRazorPages();
app.MapAreaControllerRoute(
name: "default",
areaName: "Forums",
pattern: "{controller=Home}/{action=Index}/{id?}");
app.MapControllers();
app.MapHub<NotificationHub>("/NotificationHub");
app.MapHub<ChatHub>("/ChatHub");
await app.RunAsync();
Now the Forum is ready and you can add a link to your _Layout.cshtml
<li class="nav-item">
<a class="nav-link" asp-area="Forums" asp-page="/Index">Forums</a>
</li>
Community Support Forum
See a real live YAF Forum by visiting the YetAnotherForum.NET community support forum: https://yetanotherforum.net/forums. Also, get your questions answered by the YAF community.
License
Yet Another Forum.NET is licensed under the Apache 2.0 license.
Yet Another Forum Community Support
If you have any questions, please visit the YAF Community Support forum: https://yetanotherforum.net/forums, or visit the Wiki for More Informations.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- HtmlProperties (>= 1.0.2)
- Microsoft.AspNetCore.Mvc.NewtonsoftJson (>= 10.0.13)
- Microsoft.Extensions.FileProviders.Embedded (>= 10.0.13)
- YAFNET.Core (>= 4.0.10)
- YAFNET.Types (>= 4.0.10)
- YAFNET.Web (>= 4.0.10)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 4.0.10 | 43 | 10/21/2026 |
| 4.0.9 | 167 | 8/30/2026 |
| 4.0.8 | 156 | 8/10/2026 |
| 4.0.7 | 155 | 8/2/2026 |
| 4.0.6 | 184 | 6/20/2026 |
| 4.0.5 | 262 | 4/26/2026 |
| 4.0.4 | 334 | 1/10/2026 |
| 4.0.2 | 436 | 9/24/2025 |
| 4.0.1 | 310 | 8/31/2025 |
| 4.0.0 | 617 | 3/16/2025 |
| 4.0.0-rc04 | 561 | 11/17/2024 |
| 4.0.0-rc03 | 815 | 7/6/2024 |
| 4.0.0-rc02 | 307 | 5/29/2024 |
| 4.0.0-rc01 | 294 | 5/29/2024 |
| 4.0.0-beta09 | 251 | 5/18/2024 |
| 4.0.0-beta07 | 273 | 3/28/2024 |
| 4.0.0-beta05 | 277 | 2/28/2024 |
* [NEW] Extended unit test suite including repository tests against an in-memory SQLite database
* [NEW] UI tests for changing the e-mail address, two-factor authentication, deleting the own account, the login of not approved accounts, password reset links, editing posts of other users and the history of deleted posts
* [NEW] Form UI tests: save the edit forms of the admin pages, the user editor and the profile without changes (the values must stay the same, no error, and the stored values must be accepted by the fields), and with changed text fields (the changes must be saved)
* [NEW] Crawl UI test: follows the links of the forum as admin, member, guest, forum moderator (no admin) and a member with an other language and time zone (with polls, albums, moved posts, tags, bb codes with scripts in their values, display names and new forums, categories, groups, ranks, medals and profile fields), calls every kind of page with invalid ids, and checks for server errors, error pages, errors in the event log and script of user input (html with a script in names, titles, tags and profile fields) running on any page
* [CHANGES] The client address behind a reverse proxy is taken from X-Forwarded-For / X-Real-IP only for requests of trusted proxies (ASP.NET Core forwarded headers middleware). Proxies in loopback and private networks (same host, LAN, docker) are trusted by default; a proxy or CDN with public addresses (e.g. Cloudflare) has to be added to the new setting BoardConfiguration:TrustedProxies (addresses or CIDR networks), otherwise its address is used as the client address
* [CHANGES] The BBCode rule engine is now async: IReplaceRule.ReplaceAsync, IProcessReplaceRules.ProcessAsync, IBBCodeService.MakeHtmlAsync and ConvertHtmlToBBCodeForEditAsync replace the synchronous methods (breaking change for custom rules that implement IReplaceRule directly, rules based on BaseReplaceRule keep working)
* [CHANGES] Html.LocalizedText with BBCode is now Html.LocalizedTextAsync
* [CHANGES] TopicRepository Prune is now PruneAsync(boardId, forumId, days, permDelete) and deletes the topics
* [CHANGES] Missing translations are shown as [PAGE.TAG] and logged to the event log
* [CHANGES] The unread private messages popup is shown only once per new message (like the pending friends popup), not on every page
* [CHANGES] The web service requests (StopForumSpam, BotScout, AbuseIPDB, IP locator, latest version check) use the IHttpClientFactory (registered with AddHttpClient) instead of a new HttpClient for every request
* [CHANGES] The login cookie contains the security stamp of the user now, after the update all users have to log in again once
* [CHANGES] Changing the own e-mail address needs the current password and is only done after the new address is confirmed with the link of the confirmation e-mail; suspending or deleting the own account needs the current password (accounts of external logins without a password are not asked)
* [CHANGES] "Email this topic" only lets the user choose the recipient (one address), the subject (topic name) and the text (link to the topic) are fixed, and a user can send at most 5 such emails per hour, so the forum can not be used to send spam
* [FIXED] Security: Admin > Languages / Edit Language are host admin pages now: the language files are used by all boards and their texts are html, the admin of one board could put script into the pages of all boards (also for the host admin); the pages can not be granted to board admins anymore
* [FIXED] Security: The test data generator (Admin > Test Data) was only hidden in release builds, its "create" handler still worked for admins with the page access and created boards, users, categories and private messages in any board; all handlers are refused in release builds now and the page is host admin only (also in debug builds)
* [FIXED] Security: Admin > Edit Board had no host admin check and could be granted to the admins of a board (unlike the list of the boards), they could create boards and rename any board; it is host admin only now
* [FIXED] Security: The select lists with icons (category and parent forum of Admin > Edit Forum, the forums of the moderators on the team page, the image, medal, avatar and country lists) showed the texts of the options as html, a forum or category name with html ran script for every user opening the page (on Edit Forum also for the host admin), a quote in a name broke the list; the texts are encoded now
* [FIXED] Security: The forum jump and the other forum selects (search, move topic/message, moderation, prune, delete forum) showed the names of the categories as html, a category name with html ran script on these pages for every user (the forum names were already encoded)
* [FIXED] Security: The tags of a topic were shown as html in the tags field (edit post, tag search of the post forms), a tag with an unclosed html tag (not removed when the topic is saved) ran script for the moderators editing the post and for the users finding the tag
* [FIXED] Security: The admin pages showed the names and descriptions of groups, ranks, access masks, medals (also the category and the messages of the awards) and profile fields, the styles of groups and ranks and the reasons of banned ips as html (also the group names on Edit Forum and Edit Medal), the admin of a board could run script in the pages of the host admin; they are encoded now
* [FIXED] Security: The name of the board was shown as html in the header of every page, in the login notice for guests, in the cookie notice and as the title of the notifications, the admin of a board could run script for all users (also the host admin)
* [FIXED] Security: The simple select lists (e.g. the rank and group filter of the members page, the groups of Admin > Mail, the access masks of Admin > Settings) showed the texts of the options as html
* [FIXED] Security: The names of the custom profile fields (set by the admin of the board) were shown as html in the messages of invalid or missing values (register page, edit profile, admin edit user), the user name of Admin > Register User, the file type of an album upload and the error of a failed attachment upload were shown as html in the notifications
* [FIXED] Security: With display names turned on, the display name of the last poster was shown as html in the topic lists ("by ..."), and the display name of the user in the header of the e-mail and albums pages, a member could run script for everybody viewing the topic list (display names can contain any character)
* [FIXED] Security: The style of a topic title (set by moderators) was written as html into the last topic link of the forum list, it could add attributes like event handlers (script for every visitor, also admins); it is encoded now and only used with "styled topic titles" enabled
* [FIXED] Security: The search index contained the hidden content of posts (hide, hide-reply, hide-thanks, group-hide, hide-posts): every user could find posts by words of hidden content and see them in the highlighted part of the result. Hidden content is not indexed anymore; run Admin > ReIndex to remove it from an existing index
* [FIXED] Security: The html part of the notification e-mails (topic and forum watch mails, reported posts, approval, medals, welcome...) contained the values of users as html and bb code: a topic name, a display name or the reason of a report could add links, images or forms (also disguised [url] links and html in [code] blocks) to the mails other users and the moderators get. The values are text in the html mail now (html encoded, their brackets are no bb codes), only the template text itself is formatted
* [FIXED] Security: Removing a thanks returned the users who thanked a message (names and avatars) for any message id, also of forums the user can't read
* [FIXED] Security: The page load took the forum (and so the access rights) from the forum and category ids of the address when both were set, a topic or message id of another forum was not checked against them; e.g. the print page showed a topic of a hidden forum with the ids of a readable forum in the address (PrintTopic/{hidden topic}?f={readable forum}&c={category}). The forum is now always the forum of the topic/message
* [FIXED] Security: The api of the admin dialogs (banned ips, e-mails, names, user agents and countries, bb code, spam word and replace word import, medals, profile definitions, user import, group access masks, the user statistics) only checked that the user is an admin, an admin of the board without the access to the admin page (Admin > Page Access) could use it anyway; "Grant all" of the page access could grant the pages of the host admin with a manipulated form
* [FIXED] Moderation pages (forum, unapproved posts, reported posts) failed with a server error for a forum that does not exist (e.g. /Moderate/Forums/0); the admin pages Edit BB Code, Rank, Access Mask, Category, Group and Medal failed for a negative id (it was not checked like the other ids)
* [FIXED] Active users (page and admin dashboard): the page failed when a visitor was at the albums of a user (/Albums/{id}, the name was expected in the address) or at an album that does not exist (anymore); the album link had no address (the user id was missing) and its title was shown the other way round (the id when a title is set); the name of a profile or albums location was the text of the address (any text could be shown), it is the name of the user now
* [FIXED] Profile: the birthday was converted like a point in time (from the time zone of the user into the time zone of the viewer), viewers west of the user saw the day before; it is shown as a date now (new IDateTimeService.FormatCalendarDate)
* [FIXED] RSS/Atom feeds: the times of the posts were wrong by the time zone of the user (the time of the user was marked with the time zone of the server); the feeds contain utc times now, the feed reader shows them in its time zone
* [FIXED] A plain url (without [url] bb code) in a post, signature or e-mail removed the text before it on its line, and of several urls on a line only the last one was shown (the rules to skip youtube urls matched the whole line)
* [FIXED] Push notifications of new topics and posts showed the topic name html encoded (e.g. "&") and without the replaced bad words
* [FIXED] "Users browsing this forum/topic": users who hide themselves ("hide me") were listed for everyone; the topic list read the flags of the user as the flags of the visit, so approved users were treated as guests (the list was not shown) and users excluded from the captcha were shown as crawlers
* [FIXED] Message history: admins got a "restore" button for the current text of the post (no old version), which always ended on the "invalid" info page
* [FIXED] Admin > Edit Medal: removing a medal of a group asked with a missing translation ("Missing Translation For ADMIN_EDITMEDAL.REMOVE MEDAL FROM THIS USER?" in the log), it asks now "Remove medal from this group?" (new text ADMIN_EDITMEDAL.CONFIRM_REMOVE_GROUP); removing a medal of a user did not ask at all
* [FIXED] Error page: the error message and the stack trace were written as html (an exception message with user input could add html, the generic and async names like Task<IActionResult> were swallowed)
* [FIXED] Security: Install: after the installation the install steps could still be posted by anybody (also guests), this put the whole forum into the install mode (all pages redirected to the install), the steps that create the forum and its admin account could be run again and test e-mails could be sent to any address; the install pages only work while an installation is running now
* [FIXED] Security: Password reset: the reset link logged in users with two factor authentication without the code (the e-mail alone was enough), the code is asked now
* [FIXED] Security: Login with two factor authentication: the "remember me" choice of the login was ignored, the login was always kept for a month (also when it was unchecked, e.g. on a public computer)
* [FIXED] Moderated posts and quick replies: the mentioned and quoted users were never notified, they are notified when a moderator approves the post and for a quick reply like for the reply page
* [FIXED] Security: Notifications (page and popup): the notifications showed the topic names of topics the user can't read anymore (moved to a hidden forum, access removed) and of deleted topics
* [FIXED] New topic: the tags were only saved for approved topics of users with the activity stream enabled
* [FIXED] Moderate > Reported Posts: "View" redirected to any post with its topic name in the link (also of hidden forums), an unknown post failed with an error
* [FIXED] My Topics: a "since" value or a list mode that is not in the list (sent by the client) failed with an error
* [FIXED] The post count of a topic got wrong when a deleted post was deleted again (e.g. the form sent twice) or erased later (Admin > Restore), when a deleted post was moved and when a post or a deleted topic was restored with its replies (counted twice), a topic with a count of 0 was not listed anymore; restoring a post counted the posts of test forums for the author
* [FIXED] New topic / reply: quoting or mentioning a name without user (a guest post, a deleted user, a changed display name) failed with an error after the post was saved, mentioned and quoted users are only notified when they can read the forum
* [FIXED] Security: Polls: the images of the question and the choices (loaded from any site), multiple choices and hidden results were saved from a manipulated form although the settings only allow them for admins (and moderators)
* [FIXED] Profile > Edit Settings: a user could hide from the active users list with a manipulated form although "allow users to hide themselves" is disabled (the default)
* [FIXED] Avatars: with the avatar upload disabled (the default) an avatar could still be uploaded with a post (profile and admin edit user), only the form was hidden
* [FIXED] Albums: with the albums disabled the album images could still be uploaded with a post to the edit album page (only the get was denied)
* [FIXED] Security: Team page and help: the post (forum select of the team page, help search) did not check the "show team to" / "show help to" setting, it showed the team (admins and moderators) to everyone
* [FIXED] Security: Topics page: the post handlers (page size, show list, collapse, mark read) did not check the read access, they showed a hidden forum with its name, description, moderators and users
* [FIXED] Admin start page: a page of the active users list after the last one (e.g. a bookmark when fewer users are online) failed with an error, the "showing x to y" of the unverified users used the numbers of the active users list
* [FIXED] Paged lists: a page number of 0 or less (from the url) failed with an error, a huge page number overflowed to a negative offset (an error on SQL Server and PostgreSQL)
* [FIXED] Register: the user name, e-mail and display name were checked trimmed but saved as typed (a space after the user name gave an "invalid user name" error), the password was saved trimmed while the login uses it as typed (a password with a space at the start or end never worked), the same for the new password of Admin > Edit User > Change Password
* [FIXED] Login box: the user name was not trimmed like on the login page (a space added by autocomplete gave "wrong password"), a missing password (manipulated form) failed with an error
* [FIXED] Security: Team page: the forum select (the forum id is sent by the client) redirected to any forum with its name in the link, also hidden forums and forums of other boards, a forum id that is not a number or unknown failed with an error
* [FIXED] Message history: restoring an older version of a message always showed "Invalid", the time of the version was compared exactly with milliseconds while the database stores it more exact (and was read with the culture of the user); the version is now found by its time as shown on the page (a time range in the query also missed versions now and then)
* [FIXED] Profile > Subscriptions: a notification type that is not a number (manipulated form) failed with an error, a number that is not in the list was saved
* [FIXED] Admin > Users: a "since" filter that is not a number or out of range and a huge number of years for "Lock inactive accounts" (manipulated form) failed with an error
* [FIXED] Security: Topic and forum watch e-mails and the digest e-mails contained the hidden content of posts (hide-reply, hide-thanks, hide-posts, group-hide, ...) as plain text, also for users who do not meet the condition; hidden content is removed from the e-mails now
* [FIXED] Active discussions: guests got the cached list of the page that filled the cache first, the index of a category showed the topics of all categories (or the other way round); the guest cache is kept per category now
* [FIXED] Security: My Topics (watched topics) listed the watched topics of forums the user can not read (anymore, e.g. after a group change or a move to a private forum), with the text of the last post
* [CHANGES] A user can send 5 emails per hour to other users (like "email this topic"), and can't send emails to a user who ignores them (like private messages)
* [FIXED] Requests for unknown album images or attachments wrote an event log entry each time (the event log could be flooded), they now only return "not found"
* [FIXED] "Next topic" / "Previous topic" without a further topic (and "Reply" in a locked topic) showed an error page instead of the message, the topic is now shown again with the message
* [CHANGES] Security: Admin > Run SQL and Admin > ReIndex work on the whole database (all boards), they are host admin only now and can no longer be granted to the admins of a board (also not with a manipulated form)
* [CHANGES] Security: Admin > Restart App stops the application of all boards, it is host admin only now and can no longer be granted to the admins of a board
* [FIXED] Attachments: the allowed file extensions setting is read with spaces and dots ("jpg, .png"), before such an entry never matched and the files were rejected as "Invalid File"
* [FIXED] Avatar upload (profile and admin edit user): an image file larger than the "Avatar size" setting was saved anyway and the warning was shown afterwards (in the profile without the avatar gallery); it is not saved now. The "image was resized" message was lost on the profile page, and the admin page went to the own avatar page of the admin after an upload instead of back to the user
* [FIXED] New topic / edit message: a priority that is not in the list (manipulated form) failed with an error (number too big) or was saved as unknown priority, it is limited to normal, sticky and announcement now; Admin start page: a huge "days old" for deleting the not approved users failed with an error
* [FIXED] Admin > Board Announcement and Admin > Edit User > Suspend: a huge duration failed with an error (date overflow), and an announcement with 0 or less was saved already expired; the duration is limited to 1 unit - 100 years now
* [FIXED] Move topic: the days of the moved topic link were not checked on the server, 0 or less left a link that was already expired, a huge value failed with an error; they are limited to 1 - 36500 days now
* [FIXED] Profile > Edit Settings and Admin > Edit User > Settings: a language that is not in the list (sent with a manipulated form) was saved and every page of the user failed with an error; only languages of the list are saved now. The page size (also of all lists, it is sent with every form) is limited to 1 - 100
* [FIXED] Profile > Delete Account > Suspend: the 30 days were counted from the local time of the user instead of UTC, the suspension ended hours too early or too late
* [FIXED] Admin > Groups (multi boards): the provider roles without a group of the board could be deleted, also when they are the group of another board (the roles are shared by all boards), such roles are no longer deleted
* [FIXED] Admin start page: "Approve all" approved the not approved accounts of all boards including the disabled (deleted) accounts, and "Delete all" deleted the not approved users of all boards; both only work on the listed users of the board now (IAspNetUsersHelper.ApproveAllAsync and DeleteAllUnapprovedAsync have a boardId parameter). Approving a forum user without login account failed with an error
* [FIXED] Admin > Event Log / Spam Log: a date filter that is not a date showed no entries (to date) or all entries (since date), the default is kept now
* [FIXED] Admin > Spam Log: "Delete all" deleted the whole event log (all entries of all types and boards), it deletes only the spam entries of the board now; Admin > Event Log: "Delete all" and the delete of an entry only delete entries of the board (the id is sent by the client)
* [FIXED] Security: Admin > Edit Medal: removing an award of a user or group and the add/edit award dialogs did not check that the medal belongs to the board (an unknown medal failed with an error)
* [FIXED] Admin > Edit User > Avatar: an avatar of the gallery could not be selected (the check was inverted, saving without a selection removed the avatar), and the upload form was nested in another form so the file was never sent
* [FIXED] Security: Admin > Edit User > Avatar and Attachments: the buttons did not check the user id of the form, an admin of a board could change the avatar and list or delete the attachments of any user (other boards, host admins)
* [FIXED] Move message: the topic list offered deleted topics and the links of moved topics as targets, a message moved there was no longer visible; such topics are no longer listed or accepted
* [FIXED] Polls: the image of the poll question was never shown (the image tag had no source)
* [FIXED] Admin > Edit Medal: a medal awarded to a group could not be edited (the group field is disabled in the dialog and was not sent, the save was refused), awarding a medal to a group again failed with a database error, and sort orders above 255 failed with a server error
* [FIXED] Changed or deleted custom profile definitions were still shown in the posts and profiles of the users (cached data), the cache is cleared now when a definition changes
* [FIXED] Admin > Replace Words / Spam Words dialogs: saving without a word failed with a server error instead of the "invalid expression" message
* [FIXED] Admin > Custom Profile Definitions: a new definition without a default value could not be saved (database error, the dialog just reloaded the page); an empty name is refused with a message and an unknown data type is saved as text
* [FIXED] Wrong button texts in admin dialogs: the add button of the replace words and spam words dialogs showed "Add new BBCode" (misspelled language page); the profile definition dialog showed "Edit Profile Definition" and "Save" when a new definition was added
* [FIXED] Custom profile fields: the required fields and number fields were checked with the settings sent by the client (a manipulated form could leave out required fields), the profile page did not check them at all and number fields accepted any text; they are checked against the field definitions of the board now (new text EDIT_PROFILE.NEED_CUSTOM_NUMBER). The length of a custom field was not limited on the register and admin pages (the attribute was written as text), and a length of 0 (no limit) blocked any input on the profile page
* [FIXED] A page could fail with an error (NullReferenceException in LoadPageLazyUserData) when the groups or access masks were changed in another request at the same time: the access rows of the user were cleared after they were checked and the page had no access data; they are created again now. A failure while loading the page data is no longer hidden behind a follow-up error
* [FIXED] SQLite: parallel requests (e.g. the tabs of Admin > Edit User loaded at the same time) could fail with "database is locked" although the connection waits for the busy timeout; such an operation is tried again (up to 3 times)
* [FIXED] Admin > Edit Group: the access masks of the forums were saved by script requests that ran while the page was already left (the browser could cancel them, with many forums the next page often showed and saved again the old masks); they are saved with the form now, only for forums and access masks of the board
* [FIXED] Moderate > Forums: the warnings (nothing selected, no forum chosen, pointer days) showed the topic list without topics, and the topic links contained "UrlRewriteHelper.CleanStringForUrl(...)" as text; Admin > Forums lost the category list with the "can not delete" warning
* [FIXED] Admin > Edit Medal without image showed an error page instead of the warning, Admin > Edit Board lost the culture list with a warning, and Admin > Edit Language showed no texts after saving
* [FIXED] Warnings lost the data of the page: Admin > Edit Category with the name of an existing category lost the image list and the entered values, Admin > Users lost the list of the users when deleting yourself, a guest or an admin, Admin > Access Masks lost the list when deleting a mask in use, Admin > Mail lost the groups when the test mail failed, and the e-mail page (rate limit, empty subject), report post (too long text) and Admin > Delete Forum (another delete running) lost the name of the user, author or forum
* [FIXED] Admin > Edit Access Mask: saving an existing access mask created a new access mask with the changed values, the edited mask was not changed (the id of the mask was not sent with the form)
* [FIXED] Admin > Edit BBCode always showed 1 as execution order (the value was fixed in the page), saving a bb code changed its order to 1
* [FIXED] Admin > Edit Category / Edit Forum / Edit Access Mask: a category, forum or access mask with the sort order 0 (e.g. the "No Access" mask, or after the "sort by name" tools, they start with 0) could not be saved, the field required at least 1
* [FIXED] Post topic / reply as guest: a guest who cleared the name field got an error page (the name of the guest user is used now), and the entered name was replaced by "Guest" when the page was shown again with a warning
* [FIXED] Posting in a moderated forum showed an error page ("Could not find a part of the path '/css/themes/yaf/bootstrap-forum.min.css'") after the post was saved: the notification of the moderators read a style file that the mail template does not use, from a wrong path; the moderators were not notified
* [FIXED] Edit poll: after a warning (no question, less than two choices) the poll could not be saved anymore ("access denied", the id of the poll was kept only for one request), and the poll of a new topic in a moderated forum sent the user to the topic, which is not shown before it is approved ("invalid"), instead of the approval info
* [FIXED] Admin > Edit Forum: a forum with a parent and sub forums could not be saved anymore ("cannot be child forum"), the check now only refuses a parent that is the forum itself or one of its sub forums (ForumRepository.IsOwnSubForum)
* [FIXED] Admin > Edit Forum: every warning (no category, parent loop, name exists) showed an error page instead of the message (the lists of the page were missing), and changing the category of an existing forum reset the selection (the forum was loaded again)
* [FIXED] Admin > Edit Forum: the save button posted to ".../Model.Re/Save" (the route needs a forum id before the handler), it now posts the forum id; the board check covers the forum id of the route and of the form
* [FIXED] Deleting a forum and moving its topics failed when a user had an own access mask in both forums (the user keeps the one of the new forum)
* [FIXED] Some buttons of the admin pages did nothing or showed an error page, their handlers did not exist or were not public: deleting old private messages (Admin > Private Messages), removing points of a user (Admin > Edit User > Reputation), "New access mask" in the context menu of the access masks, and the four sorting tools of Admin > Forums (a unit test now checks all handler names of the pages)
* [FIXED] Marking a post as answer wrote the flags of the post as they were when the topic was opened, e.g. a post deleted by a moderator in the meantime was undeleted; the current flags are used now
* [FIXED] Some host settings could not be changed, the form fields had the wrong type and were never saved: "Show team page to", "Show help page to", "Show share topic to", "Days before posts are locked" and "Disable nofollow on posts older than" (a unit test now compares all fields with the board settings)
* [FIXED] Changing the access mask of a group in a forum did not refresh the cached moderator list (up to 24 hours), so new moderators got no emails about reported or unapproved posts and removed moderators still got them
* [FIXED] The team page listed all forums of a moderator, also forums the user can't read (the names of hidden forums were shown); it now lists only readable forums, and the per user list no longer changes the cached moderator list
* [FIXED] The "load more" requests of the topic list, My Topics, My Account and Notifications, and the paged lists of the editor (attachments, album images) and of the notification menu accepted any page size from the client (also negative or huge values); the page size is now limited to 1-100
* [FIXED] The limit of images per album did not work for an upload of several images at once (the limit was raised with every saved image)
* [FIXED] The page for a new album compared the number of albums with the allowed images per album (instead of the allowed albums), and the album limit message showed the image limit
* [FIXED] Reporting the same post again sent the