[bonelifer]

Two additions to phpbb-test-board/, both from the adduser CSV import work (phpbbmodders/adduser#48).

run-epv.sh

Runs EPV the way the phpbbmodders reusable workflow (phpbbmodders/.github, epv.yml) does, and fails the same way: on every Fatal or Error finding the extension does not list in .github/epv-allowed.txt. EPV itself exits 0 on Error findings, so running it by hand misses what fails CI. adduser#48 failed EPV on a plain htmlspecialchars() call that no local check had caught.

• Sets up ~/.cache/phpbb-release-tools/epv-BRANCH on first use: a shallow phpBB clone, with EPV installed through phpBB's own composer.phar (dev-master, or dev-epv-phpbb4 for master, as CI does).
• Copies the extension in afresh as the only one under phpBB/ext/, runs EPV on that folder, and compares the findings with the allowed list. Allowed findings that no longer occur are listed so they can be removed.
• Has option-handling tests in tests/test-phpbb-test-board.sh and is added to the shellcheck list in CI.

feature_checks.py: adduser's CSV page

When adduser has the Add users from CSV page, its check now also covers:

• file errors, with a column name from the file escaped;
• the check page's counts and per-row messages, with markup in a username escaped and no plaintext password on the page;
• nothing created before confirming, and a tampered payload refused;
• the summary, group, default group, birthday and log entries;
• sending the same rows again creates nothing;
• a 51-row file refused, and a full 50-row file checked and created within PHP's time limit.

Older adduser versions skip this part. It runs with board email off and restores the settings it changes.

Testing

Claude ran:

• run-epv.sh on adduser: it reports the same finding as CI on the pushed commit (exit 1), and passes on the fix (exit 0).
• feature_checks.py --seed-board on seed-forum boards with adduser#48 mounted: 26/26 on phpBB 3.3.19 and on 4.0.0-a3-dev.
• tests/test-phpbb-test-board.sh: all pass, including the 7 new run-epv.sh cases.
• shellcheck -x on run-epv.sh: clean.

---

Investigated and written by Claude on behalf of William Jacoby (bonelifer).