Geeklog History/Changes: May 9, 2010 (1.7.0) ----------- Geeklog 1.7.0 now supports PostgreSQL, implemented by Stan Palatnik during the 2009 Google Summer of Code. Changes since 1.7.0rc1: - Security: The autologin (using the long-term session cookie) was vulnerable to dictionary attacks. This issue was originally reported by Bookoo of the Nine Situations Group in one of his reports in April 2009 but apparently overlooked by the Geeklog Team. Thanks to geeklog.net user Jack for pointing this out. - Fixed a typo in the install check that prevented Geeklog from detecting if it was installed in a subdirectory (bug #0001148) [Dirk] - New and updated German language files, provided by Markus Wollschläger - New and updated Slovenian language files, provided by Mateja B. May 2, 2010 (1.7.0rc1) ----------- Changes since 1.7.0b1: - Fixed call to undefined function WS_makeId() when using very long story ids (bug #0001140) [Dirk] - Fixed cloning of a story (bug #0001127, patch provided by Eric Brisco) - The installation script now recommends setting permissions to 666 for files and 777 for directories that need to be writable (bug #0001126, patch provided by Eric Brisco) - Fixed dynamic renumbering of config items when an item is deleted (bug #0001074, patch provided by Eric Brisco) - Fixed COM_featuredCheck to ensure there's only one featured story on the front page [Tom] - Fixed Last 10 Comments display in user profiles [Tom] - Updated Estonian language file, provided by Artur Räpp - Updated Hebrew language files, provided by LWC - Updated Italian language files, provided by Rouslan Placella - Updated Japanese language files and documentation, provided by the Geeklog.jp group - Updated Slovak language files, provided by Miroslav Fikar Calendar Plugin --------------- - Added call to PLG_itemPreSave to support the CAPTCHA plugin (feature request #0001091) [Dirk] Links Plugin ------------ - Added call to PLG_itemPreSave to support the CAPTCHA plugin (feature request #0001091) [Dirk] - Fixed wrong speedlimit warning when not all required fields are filled in when submitting a link [Dirk] - Treat the pre-populated partial link URL "http://" as if no URL was submitted and prevent it from being used in the spam check [Dirk] Polls Plugin ------------ - Fixed MS SQL upgrade (bug #0001144) Spam-X Plugin ------------- - Removed 'admin_override' entry from language files (bug #0001114) Static Pages Plugin ------------------- - Fixed Page Title when Advanced Editor is enabled (bug #0001113) Apr 4, 2010 (1.7.0b1) ----------- - Fixed paths for image upload in FCKeditor (bug #0000931) and disabled Flash upload [Dirk] - Updated FCKeditor to version 2.6.6 [Dirk] - Raised minimum required PHP version to PHP 4.4.0 [Dirk] - Fixed an old bug that would create a new topic when you tried to change the topic ID [Stan, Dirk] - Introduced an optional page title for stories (feature request #0001096, patch provided by Vlad Voicu) - A new right called htmlfilter.skip allows user groups to skip any html filtering on posts (feature request #0000952) [Tom] - Allow empty database passwords only for local installs (bug #0000923, patch provided by Chetan) - New Plugin API PLG_getWhatsNewComment for adding comments from plugins to the Whats New Block and the User Profile page (feature request #0000835) [Tom] - Truncated stories in Feeds now will have any open html tags closed. (bug #0000749) [Tom] - Introduced a [user:] autotag that links to a user's profile (feature request #0001081, patch provided by Akeda Bagus) - The "Users" entry in the Admins block now displays the number of active users only, i.e. it only counts users that logged in at least once [Dirk] - Fixed display of list of allowed HTML tags and available autotags in advanced story editor mode (bug #0001020, patch provided by Chetan) - Fixed sort by date in search results (bug #0001002) [Sami] - Since we can now re-authenticate expired security tokens, we don't need to display the token expiry notice any longer. Exception: Users who logged in through OpenID can't re-authenticate and will still get the message [Dirk] - Block Names can no longer be empty [Dirk] - When you had more than 50 blocks per side, disabling a block on one page of the block list would also disable all blocks on all the other pages of the list (reported by cesar) On closer inspection, the same effect could also be triggered when using the list's search or dropdown to only display a certain amount of entries. The same problems also existed in the lists for Feeds, Plugins, and Weblog Directory Services. All fixed now [Dirk] - Fixed links to comment pages (bug #0001061) [Tom] - Improved comment readability by adding a paragraph tag around "Plain Old Text" comments and some padding in threaded mode (bug #0000833) [Dirk] - Hide the "Logout" link when editing a comment or comment submission (bug #0000893) [Dirk] - CR and LF are now removed from the submitted password when a user logs in (for bug #0000799) [Dirk] - Changed the label for the $_CONF['disable_autolinks'] config option to read "Disable Autotags" and updated the documentation (bug #0000912) [Dirk] - Allow Spam-X to skip filtering of submitted content from certain user groups (feature request #0001018) [Tom] - Changed the 'gravatar_rating' config option to a dropdown since it only supports four options anyway [Dirk] - For anonymous comment submissions, use "Your Name" instead of "Username" in the comment submission form (feature request #0001039) [Dirk] - CUSTOM_group_change() was being called with wrong parameters (bug #0001051) [Blaine] - Added clickjacking protection for the printer-friendly version of articles [Dirk] - When a login is required to view some part of the site, we now display a login form. This replaces the simple "Login required" message [Dirk] - Hide "New user" option from "Login required" form when new user registration is disabled (bug #0000933) [Dirk] - Show the block name in the list of blocks (feature request #0000819) [Dirk] - Added an option (under My Account > Layout & Language) for users to select whether they want to use the Advanced Editor or not. The option is on by default but only available when Advanced Editor has been enabled in the Configuration (feature request #0000984) [Dirk] - Added support for textarea input fields in the Configuration (feature request #0000905) [Dirk] - Blocks could not contain words in curly braces as they were mistaken for template variables (bug #0001057) [Dirk] - Allow groups to be marked as a Default Group. New users will automatically be added to all default groups (feature request #0000798) [Dirk] - Make sure all onclick events in the Configuration return false (bug #0001054) - Moved hard-coded sort direction indicator (asc/desc) for search results to the language files [Dirk] - Changed the 'default_perm_cookie_timeout' config option to a dropdown so that it's consistent with the "Remember me for" dropdown in My Account [Dirk] - Raised minimum required MySQL version to MySQL 4.0.18 [Dirk] - Fixed a non-feature where canceling out of the story editor would select that story's topic in the admin's list of stories [Dirk] - Fixed problem uninstalling plugins - missing globals (bug #0001048) - Added an option to create a copy of a story (feature request #0000811) [Dirk] - Prepare database for storing IPv6 addresses (feature request #0000971) [Dirk] - Implemented re-authentication when trying to submit a form with an expired security token. This will allow the user to save changes even when the token has expired [Dirk] - Hide meta tag entry fields from the Story and Topic editors when meta tag support is disabled [Dirk] - Fixed topic selection for the Daily Digest (bug #0001041, patch provided by Ben) - Changed the 'menu_elements' and 'notification' config options to dropdowns since there's only a fixed number of keywords that these two options recognize [Dirk] - Fixed delete option for dynamically added config options: Back in 1.5.1, we renamed our JavaScript remove() function to gl_cfg_remove() but forgot to update the dynamically created function calls (cf. bug #0000681) [Dirk] Calendar Plugin --------------- - Added support for a CAPTCHA in the submission form (bug #0001091, patch provided by tuxcanfly) - Fixed an old bug in the event submission form: The text of the "Submit" button must match the text $LANG12[8] to be recognized. Changed the form to always use that string instead of the one from the Calendar plugin's language file (originally reported by kokaku in 2006(!) and again by Tereso Ramos in 2010). Links Plugin ------------ - A link to an invalid Link Category could lead to an endless loop for users with Links Admin permissions (bug #0001090; reported and patch provided by Akeda Bagus) - Allow autotags in the Links and Link Category description (feature request #0001079, patch provided by Akeda Bagus) - Added support for a CAPTCHA in the submission form (bug #0001091, patch provided by tuxcanfly) - Added a link to "New category" from the Links editor [Dirk] - Fixed localization of "Root" category (bug #0001047) [Dirk] Polls Plugin ------------ - Added What's New Block Support for Polls and Poll comments (feature request #0000835) [Tom] - Poll Topics now have a created and a modified date (bug #0000761) [Tom] - Fixed display of the edit icon in the Poll block - didn't check for polls.edit permissions (but wouldn't let you edit the poll) [Dirk] - Fixed wrong "access denied" message when attempting to view comments on a poll that the user is not allowed to view (bug #0001044) [Dirk] - Fixed comment bar Refresh button (bug #0001044) [Dirk] - Hide meta tag entry fields from Polls editor when meta tag support is disabled [Dirk] Spam-X Plugin ------------- - Fixed "Edit IP of URL Blacklist" module (bug #0001102, reported and patch provided by Abhishek Shrivastava) - A new right called spamx.skip allows SPAM-X to skip filtering of submitted content from certain user groups (bug #0001018) [Tom] - Make sure the Notification Email config option can be disabled [Dirk] - List $_CONF['site_url'] as a non-editable entry in the SLV whitelist to indicate that the site's URL is whitelisted automatically [Dirk] Static Pages Plugin 1.6.2 ------------------- - Introduced an optional page title for static pages (feature request #0001096, patch provided by Vlad Voicu) - Fixed SQL error in the search when multi-language support was enabled (bug #0001099) [Dirk] - Added What's New Block Support for Static Page comments (feature request #0000835) [Tom] - Added modified date column. What's New Block Support for Static Page now allows you to use created or modified date [Tom] - Added clickjacking protection for the printer-friendly version [Dirk] - Fixed SQL compatibility with MS SQL (bug #0001050) - Added a draft flag (feature request #0000884) [Dirk] - Removed the sp_uid field since it's simply a duplicate of owner_id [Dirk] - Display number of comments in Static Page editor [Dirk] - Fixed wrong "access denied" message when attempting to view comments on a page that the user is not allowed to view (bug #0001043) [Dirk] - Fixed comment bar Refresh button (bug #0001043) [Dirk] - Hide meta tag entry fields from Static Page editor when meta tag support is disabled [Dirk] - Avoid a pair of empty brackets on the printer-friendly version for Static Pages which have comments disabled [Dirk] - Added a config option to define the default sort order for the admin's list of Static Pages (feature request #0000812) [Dirk] - Made the initial size of the Static Pages edit area (when using FCKeditor) larger (feature request #0001037) [Dirk] - If a page does not exist and the user has staticpages.edit rights, send them to the Static Page Editor (feature request #0000975) [Dirk] - Added a Comment Default config option (feature request #0000966) [Dirk] - Added support for query highlighting [Dirk] May 9, 2010 (1.6.1sr1) ------------ This release addresses the following security issue: The autologin (using the long-term session cookie) is vulnerable to dictionary attacks. This issue was originally reported by Bookoo of the Nine Situations Group in one of his reports in April 2009 but apparently overlooked by the Geeklog Team. Thanks to geeklog.net user Jack for pointing this out. Nov 22, 2009 (1.6.1) ------------ Changes since 1.6.1rc1: - It wasn't possible to email a user via their profile page - checked the wrong field for '@' characters (cf. bug #0000992; reported by rayleigh) [Dirk] - Fixed use of wrong constant in unpacker.class.php [Blaine] - Updated the age-old help texts and added help files for comment and user submissions as well as the draft stories list [Dirk] - The success message at the end of the install recommended setting db-config.php and siteconfig.php to 755. These files don't need to be executable, so recommend 644 instead (bug #0001036) [Dirk] - Updated Estonian language files, provided by Artur Räpp - Updated German language files, provided by Markus Wollschläger - Updated Japanese language files, provided by the Geeklog.jp group Static Pages Plugin ------------------- - Content in curly braces in a static page was mistaken for template variables in the static pages editor (bug #0001038) [Dirk] - Added missing code to handle $_SP_CONF['includesearchcenterblocks'] and $_SP_CONF['includesearchphp'] options that was accidentally left out when merging Tom's patch [Dirk] - Removed reference to undeclared variable in SP_render_content (bug #0001032) [Dirk] Nov 8, 2009 (1.6.1rc1) ----------- Changes since 1.6.1b1: - Moved hard coded green color for the search result byline (when using "Google" style) to the stylesheet (new class "searchresult-byline") [Dirk] - "Refine search" lost the status of the "Titles Only" checkbox [Dirk] Note: This fix requires a change in search/searchform.thtml - Improved display of the "Sort by" and "Show n results" dropdowns on the search results page (feature request #0000910) [Sami, LWC] - The search results page used HTML
tags even when XHTML was requested (bug #0001022, patch provided by taca) - Fixed wrong path reported in case of a missing 'data' directory (reported by Markus Wollschläger) [Dirk] - When a plugin returns 0 items for its entry in the Admins Block, don't display that as 'N/A' (bug #0001025) [Dirk] - Fixed a bug in the Group Editor that didn't let you add groups to other groups unless your $_TABLES['groups'] happened to be called "groups" (bug #0000998) [Dirk] - Updated Hebrew language files, provided by LWC Links Plugin ------------ - When URL rewriting is enabled, return rewritten URLs for search results [Dirk] Static Pages Plugin ------------------- - Fixed use of wrong CSS class for the entries for the What's New block [Tom] Nov 1, 2009 (1.6.1b1) ----------- - The user's time zone selection (from My Account) is actually used now [Dirk] - Modernized the "timezone hack", made the config option a dropdown, and moved all timezone-related code into a new TimeZoneConfig class [Dirk] - Fixed an old bug that could cause SQL errors when a user changed their "Show & hide boxes" settings [Dirk] - Searching by author threw an error on PHP 4 (bug #0001008) [Dirk] - Moved the functionality of the toinnodb.php script into the Database Backups admin panel [Dirk] - Added an option to optimze tables to the Database Backups admin panel [Dirk] - Added a notice about the expiry time for the security token (and the potential loss of changes) to most editors. This is meant as an intermediate step until we get around to updating the editors and provide a more user friendly solution. [Dirk] - Fixed display of text excerpt for search results on PHP 4 (bug #0001004) [Dirk] - The comment speed limit was being ignored (bug #0001003) [Dirk] - Added an icon to make the plugin update option somewhat more obvious [Dirk] (icon "stock_update-data.png" taken from Gnome 2.18 icon theme set by AMAZIGH Aneglus, released under the GPL) - Allow bigger values for a topic's Sort Order field (feature request #0001011) [Dirk] - When a Story Admin did not have permission to edit a story, Geeklog threw a "call to a member function on a non-object" error when trying to display a proper "access denied" message (reported by Chase and Cesar) [Dirk] - Allow external apps to contribute to search results (feature request #0000985) [Sami] - Remember current sort/limit in search results (bug #0001007) [Sami] - Don't display the comment form for a story when comments aren't enabled for it (bug #0000994) [Dirk] - Fixed a long-standing quirk of the submission handling where the "Submissions" entry in the Admins Block wasn't updated after accepting / rejecting a submission [Dirk] - Fixed creation of multiple plugin groups in plugin autoinstall [Randy, Dirk] - Added new option $_CONF['article_comment_close_enabled'] to enable/disable automatically closing stories for comments after a certain amount of days (bug #0000959). Changed handling of comment_expire field in gl_stories such that 0 means the story is always open for comments [Dirk] - The "Admin Group" checkbox in the Group Editor didn't work (bug #0000995, reported & fix provided by Tsuchi) - Setting $_CONF['article_comment_close_days'] to a high value (to work around bugs with the "Disable Comments" option in 1.6.0) may result in values outside of the range of the year dropdown for that option, in which case it reverted to the previous(!) year and caused comments to be closed immediately [Dirk] - When viewing your own profile page, you now get an "edit" link that takes you to "My Account" [Dirk] - Additional checks in "Mail Story to a Friend", "Send mail to user", and "Mail Users" dialogs to make sure users don't enter email addresses into the name fields (bug #0000992) [Dirk] - Added an option to send a copy to self to the "Mail Story to a Friend" dialog and made the look of this and the "Send mail to user" dialogs more consistent [Dirk] - Display the number of stories in the current topic in the Topic Editor (feature request #0000806) [Dirk] - Call CUSTOM_userCheck from admin/user.php (bug #0000925) [Dirk] - You can now have one featured story per topic (feature request #0000750, patch provided by Tom Homer) - Changing the Post Mode in Advanced Editor mode selected the wrong tab (bug #0000980, patch provided by dengen) - Made the former $cc parameter for COM_mail an optional array of additional email headers (using a string for that parameter still works as CC:) [Dirk] - Fixed reply notification for the very first comment (bug #0000973) [dengen, Dirk] - When an anonymous commenter left a name, use it in the comment notification email (bug #0000960) [Dirk] - Removed the CSRF token from all links to edit a comment. We only need it in the actual comment editor and it caused problems on the moderation page [Dirk] - For anonymous comments, use the anonymous user's name from the database, not from the language file (cf. bug #0000960) [Dirk] - The session and password cookies are now created with the HttpOnly flag set to make it somewhat harder to read them from JavaScript (requires browser support) [Dirk] - Fixed visibility of the "Send Ping" links in the Story Admin's list of stories and the Story Options block [Dirk] - The install script was switching back to English in some upgrade scenarios (bug #0000969, patch provided by taca) - Added a workaround to not lose the XMLSitemap priorities for Locales where the comma is used as the decimal separator [Dirk] - Keep track of actual upper/lowercase spelling of plugin names in the XMLSitemap plugin [mystral-kk, Dirk] - Added support for a CUSTOM_renderMenu function when rendering the top menu (feature request #0000845) [Dirk] - In the install script, always open db-config.php and siteconfig.php in binary mode to avoid EOL character mixup on Windows (bug #0000730) [Dirk] - Avoid SQL error with certain db dumps during migration (bug #0000955) [Dirk] - Plugin migration was only called when the plugin also needed an upgrade (bug #0000947) [Dirk] - The Migrate option in the install script now also works on an existing database (feature request #0000945) [Dirk] - Comment notifications used the phrase "Read the full article" when pointing to the new comment post (bug #0000940) [Dirk] - Send correct content type and character set header in the install script (bug #0000964, patch provided by taca) - The "Remember Me For" option under My Account did not recognize the "(don't)" option any more (bug #0000961) [Dirk] - Send a notification when a comment goes into the submission queue [Dirk] - Added a link back to the story to the "Mail Story to a Friend" form [Dirk] - Only list [code], [raw] tags when story.* permissions are required [Dirk] - [page_break] was not listed when all HTML was allowed for Root users [Dirk] - Added support for meta tags and meta keywords, provided by Tom Homer - When an error occurs in bigdump.php (during migration) keep the selected language when sending the user back to migrate.php (bug #0000943) [Dirk] - Use COM_getUserDateTimeFormat, i.e. the user's preferred format, for displaying the date and time in search results [Dirk] - When disabling a feed, delete the feed file [Dirk] - Moved leftover hard-coded text from admin/sectest.php to the language files [Dirk] - When creating Pingback excerpts, convert the other site's content to our site's character set, when necessary [Dirk] - New function COM_getTextContent converts HTML into continuous text. Used for a more accurate "read more" count for articles and to improve the text excerpts for search results and pingbacks [Dirk] - Use COM_numberFormat to format the number of registered and anonymous users displayed in the Who's Online block [Dirk] - Use $LANG_ADMIN['na'] instead of hard-coding 'N/A' in several places [Dirk] - For Remote Users, display their service name in the User Editor [Dirk] Calendar Plugin 1.1.1 --------------- - Keep track of the user id for submitted events (bug #0000993) [Dirk] - Reintroduced {event_begin_anchortag} and {event_end_anchortag} variables in event.php [Dirk] - The number of hits for an event was reset when editing the event [Dirk] - When cloning an event, the number of hits for the clone should be 0 [Dirk] - Avoid triggering a false spam report when submitting an event with the default "http://" entry for the link still in place (bug #0000946) [Dirk] Links Plugin ------------ - Display the number of links in the current category in the Category Editor. Note: Does not (yet) count links in sub-categories [Dirk] - Link titles in autotags showed up with backslashes before quotes (bug #0000986) [Dirk] Polls Plugin ------------ - Fixed display of the Polls block when it only contained polls not visible for anonymous visitors (bug #0000996) [Dirk] - When upgrading from Geeklog 1.5.2, the length of the poll IDs was not extended to 40 characters - only fresh installs of Geeklog 1.6.0 and upgrades from older versions worked correctly (cf. feature request #0000754) [Dirk] - Added support for meta tags and meta keywords, provided by Tom Homer - Introduced [poll:], [poll_vote:], and [poll_result:] autotags, allowing to embed polls where autotags are allowed, provided by Tom Homer Static Pages Plugin 1.6.1 ------------------- - Certain types or all Static Pages can now be excluded from the search results (feature request #0000979, provided by Tom Homer) - New and updated Static Pages are now listed in the What's New block (feature request #0000908, provided by Tom Homer) - Fresh installs of the plugin in Geeklog 1.6.0 accidentally used a wrong name for the plugin's admin group. Silently fix that during the upgrade [Dirk] - Made the list of pages sortable by author (feature request #0000978) [Dirk] - List available autotags in the static pages editor [Dirk] - Added support for meta tags and meta keywords, provided by Tom Homer Aug 30, 2009 (1.6.0sr2) ------------ This release addresses the following security issue: - Unauthorized file uploads were possible through FCKeditor. Uploaded files still had to go through FCKeditor's filter, so it was not possible to upload scripts (and the integrity of the Geeklog site as such was not in danger). There were, however, reports that this was used to host malware. This update prevents use of the upload feature when FCKeditor is disabled and disables it for anonymous users. It also doesn't allow uploading of archive files any more. Furthermore, you need some sort of "edit" permission now to be able to upload files through FCKeditor (this is meant as an interim measure - we will probably introduce a separate "upload" permission in future Geeklog versions). Not security-related: - Fixed installation using InnoDB tables [Dirk] - Links plugin: Fixed wrong function name in the autoinstall.php file (bug #0000954) - Fixed an SQL error (due to a missing global declaration; not exploitable) when the commentcode field was auto-updated (reported by Jokke_K) [Dirk] This release also includes updated Hebrew (provided by LWC) and German language files. Jul 30, 2009 (1.6.0sr1) ------------ This release addresses the following security issues: - Gerendi Sandor Attila reported an XSS in the forms to email a user and to email a story to a friend. - The "Mail Story to a Friend" function didn't check story permissions, so that it was possible to email a story even if you didn't have the permissions to view it on the site. Not security-related: - Fixed an SQL error (due to a non-initialized variable; not exploitable) when the story submission queue was off (reported by Dieter Thomas) [Dirk] - Fixed calls to a nonexistent function COM_outputMessageAndAbort (should have been COM_displayMessageAndAbort) [Dirk] Jul 19, 2009 (1.6.0) ------------ Geeklog 1.6.0 incorporates the following projects implemented during the 2008 Google Summer of Code: + Site migration support and easier plugin installation, by Matt West + Improved search, by Sami Barakat + Comment moderation and editable comments, by Jared Wenerd Changes since 1.6.0rc2: - Updated language file for formal German, provided by Markus Wollschläger - Updated Japanese language file and documentation, provided by the Geeklog.jp group Jul 12, 2009 (1.6.0rc2) ------------ Changes since 1.6.0rc1: - Updated FCKeditor to version 2.6.4.1 [Dirk] - Fixed advanced search not using start and end dates (bug #0000924, patch provided by dengen) - Fixed auto-detection of table prefix during migration when the SQL dump contained CREATE TABLE IF NOT EXISTS requests (bug #0000922) [Dirk] - When an error occurs in bigdump.php (during migration) send the user back to migrate.php (bug #0000919) [Dirk] - Fixed warning in migration script when no backups are available (bug #0000918, patch provided by hiroron) - Updated Estonian language files, provided by Artur Räpp - Updated Hebrew language files, provided by LWC - Updated Japanese language files and documentation, provided by the Geeklog.jp group Jun 28, 2009 (1.6.0rc1) ------------ Changes since 1.6.0b3: - Fixed include path for db-config.php in bigdump.php (bug #0000915) [Dirk] - Improved detection of UTF-8 database dumps in migration (bug #0000916) [Dirk] - Fixed typos in the install script (bugs #0000913 and #0000914) [Dirk] Jun 21, 2009 (1.6.0b3) ------------ Changes since 1.6.0b2: - Fixed IE6 and Safari compatibility issue with sort and limit combo boxes in search results (part of bug #0000874) [Sami] - Fixed HTML in the Configuration (bug #0000907) [Dirk] - Added a more prominent reminder to remove the install script [Dirk] - Made the link to a comment's parent object from the comment bar work properly for plugins [Dirk] - Allow searching by topic (without a query string) again (reported by Markus Wollschläger) [Dirk] - Fixed handling of $_CONF['comment_close_rec_stories'] (bug #0000899) [Dirk] - Improved selection of text portion displayed in search results [Dirk] - Fixed an error that occured after deleting a trackback [Dirk] - Replace autotags in search results (bug #0000887) [Dirk] - Don't insist on an email address when editing a Remote User (bug #0000885) [Dirk] - Added a config option to send an X-FRAME-OPTIONS HTTP header to prevent "clickjacking" (requires browser support) [Dirk] - Prevent XSS in the install script (reported independently by Nemesis and MaXe) [Dirk] - Removed old plugin API function plugin_commentsupport from the Calendar, Polls, and Static Pages plugins [Dirk] - Updated Japanese language files and Japanese documentation, provided by the Geeklog.jp group Calendar plugin --------------- - Fixed leap year check [Sean Clark] Polls plugin ------------ - Implemented PLG_getCommentUrlId [Dirk] - Update polls comments when changing a poll's ID so the comments don't become orphaned (part of bug #0000901) [Dirk] Static Pages plugin ------------------- - Another attempt to fix a compatibility issue with PHP 4 (parse error) [Ben, Dirk] - Implemented PLG_getCommentUrlId [Dirk] - Update static pages comments when changing a page's ID so the comments don't become orphaned (part of bug #0000901) [Dirk] - When deleting a static page, also delete its comments (bug #0000901) [Dirk] XMLSitemap plugin ----------------- - Add the Polls plugin to the sitemap by default (part of bug #0000898) [Dirk] - When manually adding or removing plugins, automatically add/remove corresponding entries for priority and frequency (part of bug #0000898) [Dirk] May 31, 2009 (1.6.0b2) ------------ Changes since 1.6.0b1: - Various fixes to the new search (work in progress) [Sami] - The list of Comment Submissions now tries to provide a link to a comment's parent object (article, poll, ...). If not available, it displays an excerpt from the comment [Dirk] - Plugin comments lost their type when being saved in the comment submission queue (they were treated as comments on stories) [Dirk] - SQL errors now trigger the standard error handler ("Unfortunately, an error has occurred ..."). Details are available in error.log, as usual [Tony, Dirk] - Removed the $_CONF['search_no_data'] config option and moved the text to the language files (bug #0000873) [Dirk] - All bundled plugins now include a check to see if they support the DBMS the site is running on [Dirk] - A fresh install didn't check if the bundled plugins are compatible with the Geeklog version about to be installed [Dirk] - Users couldn't change their password or delete their account (reported by Tom Homer) [Dirk] - Fixed plugin postinstall from the install script [Dirk] - Made COM_createImage recognize https:// URLs (bug #0000881) [Dirk] - Fixed notices in the config class (reported by tgc and others) [Dirk] - Fixed empty entries in the "Type" dropdown on the Advanced Search page. Requires an updated search/searchform.thtml template (part of bug #0000874) - Ensure PLG_templateSetVars (and therefore CUSTOM_templateSetVars) is called properly when the "Skip Preview" option is disabled (bug #0000880) [Dirk] - Fixed handling of multi-byte encoded texts when limiting the content of feed entries to a certain amount of characters (reported by alank) [Dirk] - Added a verbose logging option to the search class and make it default to off [Dirk] - lib-custom.php was missing from the 1.6.0b1 tarball - Updated Spanish language file, provided by Juan Pablo Novillo Polls plugin ------------ - Display a message when a plugin comment is queued [Dirk] - If you knew a poll's ID, you could find out the poll's title even if you did not have access to the poll [Dirk] - Fixed (mostly) blank page when calling up a non-existing poll ID (reported by scarecrow) [Dirk] Static Pages plugin ------------------- - Display a message when a plugin comment is queued [Dirk] - Fixed handling of "entire page" centerblocks in a multi-language environment: Need to allow one per language (reported by Norbert Ortmann) [Dirk] - Fixed a typo that prevented the [staticpage:] autotag from working [Dirk] XMLSitemap plugin ----------------- - Added an option to exclude plugins from inclusion in the sitemap. Defaults to the Links plugin [Dirk] - Remove sitemap files when uninstalling the plugin [Dirk] - Don't include Links in the sitemap.xml automatically [Dirk] - Fixed "missing argument 2" error when changing config options (reported by Markus Wollschläger) [Dirk] May 1, 2009 (1.6.0b1) ----------- - New XMLSitemap plugin that creates a XML sitemaps file as supported by all major search engines, provided by mystral-kk - Don't allow to add/remove users to/from the All Users and Logged-in Users groups via the group editor (bugs #0000863 and #0000864) [Dirk] - Cosmetic changes to the form to add/remove users to/from groups, for consistency with the other admin panels [Dirk] - Document where CUSTOM_templateSetVars is actually called from (bug #0000862) [Dirk] - Added option to search by titles only (feature request #0000840) [Sami] - The "Plugins" entry in the Admins Block now displays the number of enabled plugins (previously included the disabled plugins) [Dirk] - Added a config option to enable/disable automatically turning URLs in text postings into clickable URLs [Dirk] - Changed some default settings [Dirk]: * Webservices are now disabled * Cronjob emulation is off * Default sort for topics is alphabetically * Default comment mode is nested These settings are _not_ changed when upgrading from an earlier version. - Experimental: Compress HTML output before sending it to the browser (disabled by default; has to be supported by both the browser and the webserver) [Dirk] - Added canonical link for article directory [Dirk] - Moved hard-coded texts from admin/sectest.php to the language files (bug #0000716) [Dirk] - Added an option to send a copy of the email to a user to self (feature request #0000771, based on a patch by Roshan Singh) - COM_checkList would use the table name for the name of the checkbox array in the HTML(!). Added a new parameter for the name (pointed out by Bookoo in the exploit for usersettings.php, cf. Geeklog 1.5.2sr4) [Dirk] - Fixed wrong use of COM_allowedHTML and COM_checkHTML in plugins: Functions were called without specific permissions, so they defaulted to 'story.edit'. I.e. as a Story Admin, you could use the admin_html set in events, but as a Calendar admin, you could not ... (bug #0000785) [Dirk] - Added missing finish() calls for some templates, e.g. header.thtml (bug #0000855) [Dirk] - Moved documentation to docs/english so that it can be translated (feature request #0000770) [Dirk] - New plugin API function PLG_pluginStateChange [Dirk] - Fixed dropdown for the "censor mode", which has more than the two options offered previously (bug #0000692) [Mike, Maciej Cupial] - Slightly faster template class (feature request #0000760, patches provided by dengen and mystral-kk) - Use a more efficient implementation of Story::hasContent (bug #0000858, patch provided by Maciej Cupial) - Make sure formerly optional config items can be disabled (bug #0000846) [Dirk] - New plugin API function PLG_getDocumentationUrl (feature request #0000848) [Dirk] - Fresh installs + MySQL only: Changed some tinyint fields that are only used as flags to tinyint(1) from tinyint(3) (bug #0000857) - Fixed one of the predefined date format strings (bug #0000854) - Replace Wiki-style formatting in the Daily Digest and when emailing a story to a friend (bug #0000837, patch provided by Pawel Szczur) - New plugin API function PLG_configChange (feature request #0000694) [Dirk] - Fixed layout of Batch Add and Batch Admin options of the User Manager [Dirk] - On a login failure, the user registration form showed up even when new user registration was disabled (bug #0000843) - The Wiki-style format broke national special characters, e.g. Japanese and German umlauts (bug #0000823) [Dirk] - Introduced new plugin API function PLG_migrate [Dirk] - Allow switching the DOCTYPE from the Configuration. Requires a theme that uses {doctype} instead of a hard-coded DOCTYPE declaration (feature request #0000745) [Dirk] - The notification email about new user submissions didn't include information about the remote service used (if any) [Dirk] - Define {xmlns} when using XHTML for XHTML compliance. Updated header.thtml and article/printable.thtml template files to include that variable [Dirk] - Fixed wrong use of '&' when sending a trackback (bug #0000825) - Removed incomplete PDF generator (never enabled in any shipped version) [Dirk] - Fixed a problem with words being merged together in newsfeeds when the article was written with CR as the line separator [Dirk] - Made url rewriting work on setups that only set $_SERVER['ORIG_PATH_INFO'] (bug #0000816) - Fixed duplicate plugin entries when a plugin has more than one entry for the admin or user menu (bug #0000820) - {contributedby_user} and {contributedby_fullname} weren't set in the story templates (bug #0000821) [Dirk] - Reinstated old definitions of the {start_contributedby_anchortag}, {end_contributedby_anchortag}, and {contributedby_author} variables, i.e. the two anchortag variables are set again and _author contains the name only (bug #0000821) [Dirk] - Auto-deleting a story didn't delete trackbacks for that story [Dirk] - Ensure consistent template variable names for the Permission Editor [Dirk] - Added new permission 'group.assign', now required to be able to assign a user to a group. Part of the Group Admin (not User Admin) permissions by default (feature request #0000190) [Dirk] - Raised minimum required PHP version to PHP 4.3.0 and removed all workarounds that ensured compatibility with PHP 4.1.0 [Dirk] - Added a filename mask config option for the names of the database backups [Dirk] - Removed $_CONF['pagetitle'] hack. Use COM_siteHeader('menu', $pagetitle) instead [Dirk] - Added canonical link for articles [Dirk] - Moved hard-coded "Reminders" column title to the language file (bug #0000817) - Hide archive option radiobutton from the story editor when no archive topic is defined (feature request #0000807) [Dirk] - Display group names with an uppercase first letter everywhere [Dirk] - Added an ISO 8601-ish format to the gl_dateformats table [Dirk] - Let users with user.mail permissions only email groups that they are in themselves [Dirk] - Gave the Groups and User editors a facelift. Requires a new template file, admin/lists/inline.thtml [Dirk] - Introduced list of "advanced HTML" tags that are allowed when FCKeditor is enabled. Needed for images (bug #0000757) [Blaine] - Add new permissions plugin.install and plugin.upload for more fine-grained control to the plugin admin panel (bug #0000637) [Dirk] - Introduced new plugin API function PLG_itemDeleted [Dirk] - Changed API for PLG_itemSaved to make it simpler and easier to use [Dirk] - Updated FCKeditor to version 2.6.4 [Blaine] - Usersettings.php - can not change password when custom membership is enabled. Modified CUSTOM_userCheck to return both a error message string and Error code. Updated users.php and usersettings,php (bug #0000776) [Blaine] - Implemented extended API for PLG_getItemInfo [mystral-kk, Dirk] - Fixed inconsistencies and various small mistakes when displaying "Access denied" messages on the admin pages [Dirk] - Added a print.css stylesheet to be used by the printable template files (feature request #0000766) [Dirk] - Re-introduced the path hints in the install script when it can't find db-config.php [Dirk] - Added a note about the max. dimensions of a userphoto in the About You pane of a user's My Account page (feature request #0000629) [Dirk] - Display a message when no topics exist and don't let the user enter the story editors (bug #0000738) [Dirk] - Added a configuration option to control the JPEG quality (Feature request #0000720) [Dirk] - Updated Hebrew language file for the install script, provided by LWC - New Serbian (Latin) language files, provided by Aleksandar Scepanovic Calendar plugin --------------- - Added migration support [Dirk] - Removed extra double quote from upcoming events block (bug #0000827) - Added auto installation support [Dirk] - Added support for PLG_getItemInfo, PLG_itemSaved, PLG_itemDeleted [Dirk] Links plugin ------------ - Added migration support [Dirk] - Added category default permissions [Dirk] - Added auto installation support [Dirk] - Added support for PLG_getItemInfo, PLG_itemSaved, PLG_itemDeleted [Dirk] - Introduced function LINKS_getCategorySQL and fixed visibility of link categories in the Top 10 Links list and site statistics [Dirk] - Added an option to allow opening external links in a new window (feature request #0000693). Use with care, please [Dirk] - Only external links are marked with class="ext-link" [Dirk] Polls plugin ------------ - Added migration support [Dirk] - Set the page title when viewing a poll [Dirk] - Added auto installation support [Dirk] - Added support for PLG_getItemInfo, PLG_itemSaved, PLG_itemDeleted [Dirk] - Extended length of poll IDs to 40 characters (feature request #0000754) [Dirk] Spam-X ------ - Added migration support [Dirk] - Added auto installation support [Dirk] Static Pages plugin ------------------- - Added migration support [Dirk] - The printable.thtml template file now uses the {xmlns} variable [Dirk] - Added canonical link [Dirk] - Added auto installation support [Dirk] - Added support for PLG_getItemInfo, PLG_itemSaved, PLG_itemDeleted [Dirk] - The printable.thtml template file uses the HTML Strict doctype and print.css now [Dirk] - Display "successfully saved" and "successfully deleted" messages, just like every other plugin and built-in function does (bug #0000644) [Dirk] May 9, 2010 (1.5.2sr6) ------------ This release addresses the following security issue: The autologin (using the long-term session cookie) is vulnerable to dictionary attacks. This issue was originally reported by Bookoo of the Nine Situations Group in one of his reports in April 2009 but apparently overlooked by the Geeklog Team. Thanks to geeklog.net user Jack for pointing this out. Jul 30, 2009 (1.5.2sr5) ------------ This release addresses the following security issues: - Gerendi Sandor Attila reported an XSS in the forms to email a user and to email a story to a friend. - The "Mail Story to a Friend" function didn't check story permissions, so that it was possible to email a story even if you didn't have the permissions to view it on the site. Apr 18, 2009 (1.5.2sr4) ------------ This release addresses the following security issue: Bookoo of the Nine Situations Group posted another SQL injection exploit, targetting an old bug in usersettings.php. As with the previous issues, this allowed an attacker to extract the password hash for any account and is fixed with this release. Apr 13, 2009 (1.5.2sr3) ------------ This release addresses the following security issue: Bookoo of the Nine Situations Group posted another SQL injection exploit, this time targetting the webservices API. As with the previous issue, this allowed an attacker to extract the password hash for any account and is fixed with this release. Not security-related: - Re-introduced function get_SPX_Ver in the install script, which is still needed when upgrading from old Geeklog releases (reported by Sheila) [Dirk] Apr 4, 2009 (1.5.2sr2) ----------- This release addresses the following security issue: Bookoo of the Nine Situations Group posted an SQL injection exploit for glFusion that also works with Geeklog. This issue allowed an attacker to extract the password hash for any account and is fixed with this release. Mar 30, 2009 (1.5.2sr1) ------------ This release addresses the following security issue: Fernando Munoz reported a possible XSS in the query form on most admin panels that we are fixing with this release (bug #0000841). Feb 8, 2009 (1.5.2) ----------- - The default replacement text for censored text was supposed to read "censored", not "censormode" [Dirk] - Fixed problem with extra backslashes appearing in a story's title during the story preview when magic_quotes_gpc = On (bug #0000790) [Mike, Dirk] - Added missing page title when viewing a single comment [Dirk] - Sort groups in the group dropdowns non-case sensitive [Dirk] - Display a message when sending the email to report an abusive comment failed [Dirk] - Display a message when sending the email for a new password failed [Dirk] - Updated Estonian language file for the Calendar plugin, provided by Artur Räpp - Updated Japanese language file, provided by the Geeklog.jp group Static Pages plugin ------------------- - Fixed parse error when saving a static page (reported by greenteagod). This problem was only introduced in 1.5.2rc1 [Dirk] Jan 24, 2009 (1.5.2rc1) ------------ - Fixed various issues with COM_makeClickableLinks (bug #0000767, #0000793, #0000796) [Sami] - The comment submission form didn't show the user's full name when $_CONF['show_fullname'] was enabled [Dirk] - Comments were always showing the username, even when $_CONF['show_fullname'] was enabled (reported and patch provided by mystral-kk, bug #0000800) - Fixed story preview losing the story when the sid already existed (bug #0000789) [Dirk] - Fixed wrong use of str_replace in STORY_extractLinks (bug #0000794) [Dirk] - Added "Send Pings" to the Story Options block (if enabled and allowed for the current user) [Dirk] - Don't let the user enable plugins when there's no functions.inc for the plugin [Dirk] - When the install script can't find db-config.php, that message was always displayed in English, i.e. you could not change the language for that screen [Dirk] - When upgrading from a Geeklog version prior to 1.5.0, the plugin config.php files are no longer renamed [Dirk] - Admin lists allowed non-sortable columns to be sortable (reported and patch provided by hiroron, bug #0000791) - Fixed STORY_getItemInfo - need to check the draft flag and for a publish date in the future [mystral-kk, Dirk] - Fixed wrong use of COM_isAnonUser in COM_getPermSQL (since 1.5.0) [Dirk] - When calling COM_getYearFormOptions with a $startoffset parameter, the list of years was off by one (bug #0000783; patch provided by hiroron) - Fixed updating feeds after changing topic permissions (bug #0000779) [Dirk] - The security token was missing from the trackback editor template file (reported and patch provided by hiroron, bug #0000778) - Removed rel="tag" from topic links in lib-story.php as that would indicate a Microformat with a slightly different meaning [Dirk] - Don't include X-Originating-IP header in emails sent from the site's admin area (bug #0000701) [Dirk] - Check if COM_errorLog exists before using it in the config class (for possible problems during installation, bug #0000768) [Dirk] - Fixed filling out the Site Email / No-Reply Email fields in the install script, which was overwriting the correct values from config.php during upgrades (bug #0000759) [Dirk] - Set language direction in templates for printable versions of articles and static pages. Also set $LANG_DIRECTION to 'ltr' now if the language file does not already define it (bug #0000762) [Dirk] - Removing an element from the middle of the censorlist caused the censoring to act up (bug #0000763) [Dirk] - Saving a story tried to update a feed of type 'geeklog' instead of 'article' (reported by Tom Homer) - Delete a feed's file when deleting a feed (bug #0000758) [Dirk] - When using gdlib, use imagecopyresampled instead or imagecopyresized to scale images. This should result in better image quality (part of Feature request #0000720) [Dirk] - The {start_storylink_anchortag} variable in the story templates was missing a '>' (reported by Michael Brusletten) [Dirk] - Display a "Service" column in the Admin's list of users when remote auth is activated [Dirk] - Introduced new function COM_showMessageText to display a free-form text in a "System Message" box (feature request #0000676) [Dirk] - Introduced new function COM_showMessageFromParameter for easy and consistent display of messages passed in the URL, including plugin messages (second attempt to fix bug #0000618) [Dirk] - Display confirmation message when emailing a story (feature request #0000689) [Dirk] - Implemented new function COM_renderWikiText to convert wiki-formatted text to (X)HTML (feature request #0000643) [Dirk] - Added support for CUSTOM_formatEmailAddress and CUSTOM_emailEscape functions (feature request #0000727) [Dirk] - Fixed 'cookiedomain' being reported as changed in the Configuration (bug #0000638) [Dirk] - Reverted fix for bug #0000618 (COM_showMessage automatically picking up a 'plugin' parameter) as it's causing problems when displaying more than one message on the same page [Dirk] - Added missing check for allowed IP addresses in downloader class (bug #0000709) [Dirk] - Force a refresh after uninstalling a plugin so that the plugin's entry disappears from the Admins block [Dirk] - Fixed an issue with story expiry dates on PHP 4/Windows (reported by zeb) [Mike] - Updated Hebrew language file for the install script and Spam-X plugin, provided by LWC - Updated Japanese language files, provided by the Geeklog.jp group - Updated Polish language files, provided by Robert Stadnik - Updated Slovenian language file for the Links plugin, provided by gape Calendar plugin --------------- - Fix for calendar plugin - unable to add personal event [Blaine] - Make {event_url} available in eventdetails.thtml [Dirk] Links plugin ------------ - Missing parentheses my have resulted in incorrect search results [Dirk] - Added urlencoded versions of {link_actual_url} and {link_name} [Dirk] - Prevent overwriting existing links when changing the link ID [Dirk] Polls plugin ------------ - Lowered the default number of questions per poll to 5 and the number of answers per question to 8 to avoid running into Suhosin's default post.max_vars limit (for new installs only) [Dirk] - Fixed SQL error when poll questions contained single quotes (bug #0000756) [Dirk] - Fixed handling of poll IDs in Polls editor (bug #0000753) [Dirk] Static Pages plugin ------------------- - The owner of a static page changed to the user who last edited it (bug #0000777) [Dirk] - Fixed call to WS_makeId when sp_id was longer than STATICPAGE_MAX_ID_LENGTH (found by Marc Maier) [Dirk] Sep 22, 2008 (1.5.1) ------------ - Fixed protection against direct execution in various include files which may have failed on non-case sensitive file systems (reported by Mark Evans) [Dirk] - Saving a story as someone other than the owner will revert the story to your ownership. (bug #0000742) [Mike] - Fixed searching for non-installed plugins when open_basedir restrictions are in effect (bug #0000741) - Fix for first change of password issue (bug #0000724) [Mike] - Fixed failure to switch language with new query highlighting URLs (bug #0000733) [Dirk] - Fixed bug with HTML Encoding of default comment title for articles (bug #0000737) [Mike] - Fixed another case where a duplicate of a story submission was left in the submission queue after approving the story [Mike] - Fixed problem with the MySQL class not recognizing UTF-8 when the character set name was written in uppercase (bug #0000731) [Dirk] - Updated Hebrew language files, provided by LWC - Updated Estonian language files, provided by Artur Räpp - Updated Japanese language files, provided by the Geeklog.jp group - Updated Slovenian language files, provided by gape Sep 7, 2008 (1.5.1rc1) ----------- - Added missing slash in the install script (bug #0000715) [Dirk] - CSRF token not passed to draft list (bug #0000726) [Ted Powell] - If root debugging is enabled, hide anything in the array stack that has a key containing 'cookie' or 'pass'. And added option to override this. (bug #0000722) [Mike] - Prevent direct execution of the FCKeditor upload script (reported by t0pP8uZz) [Dirk] - Renamed the "Restore" option in the Configuration to "Enable" [Dirk] - Provided better error handling for database backups (bug #0000714) [Mike] - Provided auto-detection of -left and -right overrides for any given block template. This allows any block to auto-style to left and right for themes without the need for the theme to work it out, or talk to the database. ("Bug" #0000684) [Mike] - Fixed handling of corrupted config value db entries, e.g. after importing Calendar event_types with the wrong character set (bug #0000690) [Dirk] - Fixed handling of HTML entities in the Configuration (bug #0000710) [Sami, Dirk] - Story image upload: Only add a link to the unscaled image if such an image actually exists [Dirk] - Removed unused code from lib-story.php [Dirk] - COM_siteFooter no-longer creates two sets of right blocks. (bug #0000698) [Mike] - Microsummaries work in topics, reported by Joe. [Mike] - Added DB_checkTableExists and changed INST_checkTableExists to use it. [Mike] - Changed REPLACE INTO for DB_save for MSSQL compat [Mike] - Re-introduced function get_SP_Ver in the install script, which is still needed when upgrading from old Geeklog releases (reported by libexec) [Dirk] - Fixed issue where you can post a comment to an unpublished story (bug #0000705) [mystral-kk/Mike] - Fixed make clickable links with quotes (bug #0000691) plus truncated long urls. [Sami] - Fixed table prefix issues with constraints (bug #0000702) [Mike/Sami] - Fixed error when attempting to highlight a search query that contained a slash [Dirk] - Updated FCKeditor to v2.6.3 [Blaine] - Moved remove() (config JavaScript) to gl_cfg_remove (bug #0000681) [Mike] - Change for CUSTOM_usercreate to support passing in $batchimport, set true if called via the Admin->Users Batch_Add [Blaine] - Fix for date formatting in RSS fields (bug #0000696) [mystral-kk] - A small tweak to the Professional theme's commentbar to make the "Post a comment" option easier to find [Dirk] - Renamed the syndication feed type "geeklog" to "article" since that's what they are nowadays [Dirk] - New option "All Frontpage Stories" for article feeds: skip stories that have the "Show only in topic" option set (feature request #0000652) [Dirk] - If there is a feed for a topic, there will now be a "Subscribe to ..." option in the Story Options block for every story for that topic (feature request #0000154) [Dirk] - Cop-out fix for bug #0000671: Don't display the icon for external links when the text direction is 'rtl' (e.g. Hebrew) [Dirk, Mike] - Keep letter case intact when highlighting a search query string (patch provided by Sami Barakat) - Provide nicer URLs to story search results when URL rewriting is enabled (bug #0000665, based on a patch by Sami Barakat) [Dirk] - Better support for plugin messages (bug #0000618) [Blaine] - Introduced new variable {page_title_and_site_name} for header.thtml so that we can have "Site Name - Site Slogan" in the frontpage's title again [Dirk] - Fixed SQL error(s) for story submissions by users with story.submit but no further Story Admin permissions (reported by Orion) [Dirk] - End a user's session when they are being banned [Dirk] - Signatures in HTML-formatted comments weren't XHTML compliant [Dirk] - Minor cleanups in style.css - no actual layout changes (bug #0000683) [Dirk] - Allow creation of banned users, i.e. ban the user on account creation [Dirk] - Minor improvements in the error handling, e.g. preventing Geeklog from creating error.log files outside the logs directory [Dirk] - Send a HTTP status code 503 "Service Unavailable" when the site is disabled [Dirk] - Hide the database password when the database backup failed and we're logging the mysqldump command [Dirk] - Disable OpenID login when new registrations are disabled [Dirk] - Allow to unset Configuration options again after they have been "restored", i.e. enabled (bug #0000664) [Dirk] - Adopted hack to allow multilingual blocks (bug #0000626) [Dirk] - Fixed SQL error in story submissions (reported by Chase) [Mike] - Stories with a publishing date in the future and stories with the draft flag set were accessible if you knew their story id (bug #0000678) [Mike] - Enabled siteconfig.php to override database config in core, primarily for rootdebug. [bug 0000673] [Mike] - Allow remote users to use the webservices (bug #0000640). Due to the authentication method it is not possible for OpenID users to use the webservices. Other remote users will have to use username@servicename for their username when logging in through the webservices [Dirk] - Fix to template.class to better handle full path being passed in [Blaine] - Updated PLG_uninstall to supress errors for table drop. [bug 0000668] [Mike] - Fixed INST_checkTableExists for MS SQL Support. [bug 0000668] [Mike] - Hardcode an ltr div around HTML tags in the allowed html tag list. Plus minor HTML compliance issues. [bug 0000669] [Mike] - Plaintext stories have nl2br applied in syndication feeds to provide correct formatting in feed readers. [bug 0000662] [Mike] - Changed SEC_createToken so that it will only return one token per page (effectively making it a singleton). This fixes the problem of not being able to delete comments when you also have trackbacks for the same article [Mike, Dirk] - Approving a story submission by saving it from the Admin's story editor left a duplicate in the submission queue, unless you changed the story ID at the same time [Dirk, Mark Evans] - Fixed user submission queue (reported by greenteagod) [Dirk] - Updated Hebrew language files, provided by LWC Calendar plugin --------------- - Fixed tags in the German language files for the Calendar [Dirk] - Fixed date comparison ("End date is before start date.", bug #0000703) [Dirk] - Fixed Admin delete links in day and week view (bug #0000680) [Dirk] - Search for an event's "author" didn't work [Dirk] - Calendar block now includes events from the current day (in progress or all day events, bug 0000604, patch from forums) (really) [Mike] Links plugin ------------ - Fixed passing the category on multi-page link lists [Dirk] - Fixed new category silently overwriting an existing category if they had the same id (part 2 of bug #0000659) [Dirk] - Fixed SQL error when trying to change a category id to an already existing id (part 1 of bug #0000659) [Dirk] Polls plugin ------------ - For multi-question polls, make the "Vote" button read "Start Poll" in the polls block (bug #0000633) [Dirk] - Fixed display of "Results" link while a poll is open [Dirk] Static Pages plugin ------------------- - Menu entries were not language-aware (in multi-language setups), i.e. all the menu entries were always displayed (bug #0000713) [Dirk] - Removed unused 'config_data' entry from the plugin uninstall function (bug #0000666) [Dirk] - Fixed printer friendly version of a static page not working when url_rewrite is enabled (bug #0000661) [Dirk] June 15, 2008 (1.5.0) ------------- Geeklog 1.5.0 incorporates the following projects implemented during the 2007 Google Summer of Code: + New user-friendly install script by Matt West + New Configuration GUI (replacing config.php) by Aaron Blankstein + New Webservices API based on the Atom Publishing Protocol by Ramnath R. Iyer Changes since 1.5.0rc2: - Users that used a different theme than the site default would see the site switch temporarily back to the site's default theme when changing a config option. This was a side effect of the fix for bug #0000648 [Dirk] - In a tradeoff between security and convenience, we decided to go with security: The install script will no longer display the database credentials from db-config.php. The downside is that you will have to enter them again when doing a database upgrade or re-running the install (reported by Mark Evans) [Dirk] - Links plugin: The word "Root" wasn't taken from the language file for the page title of the public list of links (reported by Markus Wollschläger) [Dirk] - Fixed remaining places where the Admin panels had inconsistent layouts: Calendar list of events, Polls editor (bug #0000650) [Dirk] - Updated Hebrew language file, provided by LWC - Updated German language files, provided by Markus Wollschläger - Some Korean language files had a mixture of CR/LF and LF as line separators (bug #0000655) [Dirk] June 8, 2008 (1.5.0rc2) ------------ Changes since 1.5.0rc1: - Hide the | separator for static pages with page format "blank page" (reported by Tetsuko Komma) [Dirk] - Hardcoded all URL entry fields in the templates and the date selection in the calendar plugin to dir="ltr" (reported by LWC) [Dirk] - Fixed handling of UTF-8 languages in the install script (reported by Tetsuko Komma) [Dirk] - Ensure consistent display of the admin lists (bug #0000650) [Dirk] - Sanitize the language in the install help (reported by Mark Evans) [Dirk] - Moved the hard-coded CSS for the System Message to the stylesheet [Dirk] - Added a workaround for the Yulup Atompub client that sometimes sends Text nodes within XHTML nodes [Dirk] - Made the Install / Upgrade buttons in the install script a bit wider to provide more space for the Japanese and German translations [Dirk] - Fixed bug #0000647: All modifications of usersettings should go through CUSTOM_usercheck [Blaine] - Removed hard-coded