Changes

This document is intended to give a quick overview over the most important and / or obvious changes. For a detailed list of changes, please consult the ChangeLog. The file docs/changed-files has a list of files that have been changed since the last release.

Geeklog 2.1.0

Geeklog 2.1.0 major new features include and an updated template libray and a new advanced editor system. A large number of bugs have also been fixed related to child topics which was introduced in Geeklog 2.0.0.

This Geeklog release now ships with jQuery 1.10.2 and jQuery UI to 1.10.3.

Major New Features and Improvements

• Integrated Caching Template Library original developed by Joe Mucchiello.
• Support for themes to specify a default theme.
• Added configruable caching support for blocks (regular and gldefault), staticpages and articles.
• Speed increases by caching topic tree structure.
• New OAuth login methods supported (Google, Microsoft, Yahoo).
• New Advanced Editor System that allows developers to easily to add new javascript editors.
• Added CKEditor 4.3.2 as the default advanced editor for Geeklog.
• Numerous fixes for multi-language support.
• Added a Filemanager.

Geeklog 2.0.0

Note: Geeklog 2.0.0 manages topics differently. Topic assignments for articles and blocks are now stored in their own database table. This means the article and block tables have changed slightly. Plugins that modify blocks directly or have a centerblock may not be compatible with Geeklog 2.0.0. Please check to see if the plugins you have installed are compatible before you upgrade. If they are not then disable them if you still wish to upgrade. We expect most plugin authors to upgrade their plugins to support Geeklog 2.0.0 soon after the release.

The theme engine has also been updated. Geeklog 2.0.0 introduces a new function that allows a page to be generated all at once instead of in specific parts as it was before. Only themes and plugins that have been updated to use the new function for display can take advantage of the new features this brings to Geeklog and themes.

This Geeklog release now ships with jQuery 1.7.2 and jQuery UI 1.8.20.

New Features and Improvements

• Improved strength of password hashing.
• Allow Topics to have child Topics.
• Allow Articles, Blocks and other Plugin objects to be associated with more than one Topic.
• Topic Breadcrumb support.
• Emergency Rescue Tool is included with the Geeklog Install.
• Added support for MySQLi.
• Add Stop Forum Spam and Spam Number of Links Modules to Spam-X.
• A new theme called Denim which is based on Responsive Web Design.
• A new theme called Modern Curve.
• Comments Form on same page as article.

Geeklog 1.8.2

Geeklog 1.8.2 is a maintenance release. There were no changes in the database, the templates, or the language files in this release, so upgrades should be straightforward.

Bugfixes

• Fixed compatibility with MySQL 5.5 (upgrade, database backup). For this fix, we also had to raise the minimum supported MySQL version to 4.1.2.
• Fixed Twitter OAuth login.

Geeklog 1.8.1

Geeklog 1.8.1 is a maintenance release and a recommended update for all users of Geeklog 1.8.0. There were no changes in the database, the templates, or the language files (other than some updated translations) in this release, so upgrades should be straightforward.

This Geeklog release now ships with jQuery 1.6.3.

Bugfixes

• Fixed information leakage:
  • The "rootdebug" option, when enabled, also dumped the OAuth consumer key and secret. You now have to additionally set the rootdebug option to "force" to make them show up in the variable dump.
  • The MS SQL driver was displaying detailed SQL error messages by default.
• Fixed a regression in Geeklog 1.8.0 that made the [code] and [raw] tags not escape content properly.
• Fixed some problems with adding and removing elements to/from arrays in the Configuration.
• The admin's User Editor no longer loses changes when an error occured.
• Fixed images not being displayed in the story preview (when editing an existing story).
• Plugins can now set $_SCRIPTS in the plugin_getFooter() function.
• Fixed some warnings raised by PHP 5.4.

Geeklog 1.8.0

Note: Geeklog 1.8.0 now requires PHP 5.2.0 or later. We will provide legacy PHP 4 support for Geeklog 1.7.2 for a limited time, but would strongly suggest that you switch to PHP 5.2 or later as soon as possible.

For details, please see the announcement on the Geeklog homepage.

New Features and Improvements

• Improved Configuration with input validation and a search function. These improvements were implemented by Akeda Bagus as part of the Google Summer of Code 2010.
• OAuth support, allowing users to log into a Geeklog site with their Facebook, Twitter, or LinkedIn account. This functionality was originally developed by Hiroshi Sakuramoto (Hiroron) of Geeklog Japan.
• New icons in the default theme (taken from the Tango, Gnome, and Humanity icon themes).
• Ships with jQuery, which is now the "official" JavaScript library for Geeklog.
• Autotags now have permissions and a description (tooltip).
• Revamped Plugins admin panel, which also lets you change the plugin load order. Plugins can now also indicate dependencies on other plugins.

Geeklog 1.7.2

Note: Geeklog 1.7.2 is the last Geeklog version to work on PHP 4. We will be providing security fixes, if required, for this version until 2012. New features will only be added to Geeklog 1.8.0 and later versions, which will require at least PHP 5.2.0 to run. Please see the announcement on geeklog.net for details.

Bugfixes

• Fixed PostgreSQL support (multiple Geeklog instances sharing one Postgres database; dbSave function; error reporting; PHP 4 compatibility).
• Fixed replacing the [imageX] tags when changing a story id.
• Fixed a PHP 4 compatibility issue in the Static Pages plugin.

Geeklog 1.7.1sr1

This release fixes an XSS in the admin's configuration panel, reported by Aung Khant of the YGN Ethical Hacker Group.

Geeklog 1.7.1

New Features and Improvements

• A Static Page can now be marked as a template and used by other Static Pages.
• Themes can now have their own display functions for the start and end of blocks.
• Please also see the list of theme changes.

Bugfixes

• In Geeklog 1.7.0, comment submissions for plugins were missing the type, i.e. the comments were not recognized as plugin comments.
• Changing anything in My Account while Advanced Editor was disabled for the site also disabled the user's setting for the Advanced Editor.
• Fixed the "Show & Hide Boxes" option in My Account.
• Reverted a change from Geeklog 1.7.0: Curly braces in block content are not escaped any longer. To avoid words in curly braces being interpreted as template variables (e.g. for JavaScript code), add a space after the opening or before the closing brace.
• Reverted a change from Geeklog 1.7.0 that would send a Content-Type header when calling COM_refresh() since this conflicts with some plugins (e.g. the Forum).

Geeklog 1.7.0

New Features and Improvements

• Geeklog now supports PostgreSQL databases. This feature was implemented by Stan Palatnik during the 2009 Google Summer of Code.
• When the security token (CSRF protection) expires, the user will now be asked to authenticate again. On successful re-authentication, the operation will be repeated and no changes will be lost.
• The options to skip spam checks and HTML filtering are now permissions and no longer restricted to the Root group.
• Groups can now be marked as a default group. New users will automatically be added to all default groups.
• Comments in plugins can now be listed in the What's New block and in a user's profile (through a new Plugin API function - requires changes in plugins).
• Pages that require authentication now display a login form.
• When the Advanced Editor is enabled for the site, users can now enable or disable it for themselves in their settings under My Account.
• There is now an option to create copies of existing stories (like the options to copy existing static pages and calendar entries).
• A new [user:] autotag is available to easily create links to a user's profile.

Other changes

• Security: Fixed a vulnerability to dictionary attacks in the autologin, originally reported by Bookoo of the Nine Situations Group.
• The minimum requirements for Geeklog are now PHP 4.4.0 and MySQL 4.0.18.
• Ships with FCKeditor 2.6.6
• Please also see the list of theme changes.

This release also includes a number of patches and improvements made by students applying for participation in the Google Summer of Code 2010. Thank you!

Geeklog 1.6.1sr2

This release fixes an XSS in the admin's configuration panel, reported by Aung Khant of the YGN Ethical Hacker Group.

Geeklog 1.6.1sr1

This release fixes a vulnerability to dictionary attacks in the autologin, originally reported by Bookoo of the Nine Situations Group.

Geeklog 1.6.1

New Features and Improvements

• Geeklog now lets you enter meta descriptions and meta keywords for the main page, for stories, topics, static pages, and polls. Please note that these meta tags may not be used by some search engines.
• You can now have one featured story per topic (for stories set to "Show only in Topic").
• New autotags now allow you to embed polls in stories and everywhere else where autotags are allowed.
• The Migrate option in the install script can now also be applied to an existing database (i.e. you don't need to import a database dump to update your URLs and paths).
• The Database Backup admin panel now includes options to optimize the database and convert tables to InnoDB (MySQL only).
• Improved timezone support and let users actually set their own timezone.
• Minor security enhancements:
  • "Important" cookies (like the session cookies) are now created with the HttpOnly flag set. This will help avoid some XSS attacks, provided your browser supports this flag.
  • Template errors will now trigger the standard error handler instead of exposing the template path.
  • Fixed inclusion protection for some of the Spam-X class files.

Please also see the list of theme changes.

Bugfixes

• Fixed automatic closing of stories for comments after a certain amount of days. If you need to re-open comments on stories that were closed due to this bug, you can use this SQL request:
  UPDATE gl_stories SET commentcode = 0, comment_expire = 0 WHERE commentcode = 1;
• The comment speed limit was being ignored.
• Fixed a bug in the Group Editor that didn't let you add groups to other groups (this problem was only introduced in Geeklog 1.6.0).
• The admin group for the Static Pages plugin was created with a wrong name in Geeklog 1.6.0 (fresh installs only).
• Several tweaks and minor fixes (e.g. compatibility with PHP 4) in the search.

Geeklog 1.6.0sr2

This release addresses the following security issue:

• Unauthorized file uploads were possible through FCKeditor.
  Uploaded files still had to go through FCKeditor's filter, so it was not possible to upload scripts (and the integrity of the Geeklog site as such was not in danger). There were, however, reports that this was used to host malware.
  This update prevents use of the upload feature when FCKeditor is disabled and disables it for anonymous users. It also doesn't allow uploading of archive files any more. Furthermore, you need some sort of "edit" permission now to be able to upload files through FCKeditor (this is meant as an interim measure - we will probably introduce a separate "upload" permission in future Geeklog versions).

Other fixes:

• Fixed installation using InnoDB tables.
• Fixed a (non-exploitable) SQL error when auto-updating a story's commentcode field.
• Fixed a wrong function name in the Links plugin.

Geeklog 1.6.0sr1

This release addresses the following security issues:

1. Gerendi Sandor Attila reported an XSS in the forms to email a user and to email a story to a friend.
2. The "Mail Story to a Friend" function didn't check story permissions, so that it was possible to email a story even if you didn't have the permissions to view it on the site.

Other fixes:

• Fixed an SQL error when submitting a story and the story submission queue was off.
• Fixed calls to a nonexistent function COM_outputMessageAndAbort.

Geeklog 1.6.0

Results from the Summer of Code

This release incorporates the following projects implemented during the the 2008 Google Summer of Code:

• Site migration support and easier plugin installation, by Matt West
• Improved search, by Sami Barakat
• Comment moderation and editable comments, by Jared Wenerd

Other changes

• The minimum PHP version required by Geeklog is now PHP 4.3.0. Given that the PHP team ended support for PHP 4 in August 2008, you should be looking into upgrading to PHP 5 anyway.
• Includes FCKeditor 2.6.4.1
• Includes a new plugin, XMLSitemap, that automatically generates a XML sitemap file, as supported by all major search engines. Plugin written and provided by mystral-kk.
• Several new plugin API functions have been added and existing functions have been extended.
• The included documentation has been moved to docs/english to allow for translations. Links to the documentation from within Geeklog will link to existing translations for the current language automatically (or fall back to the English documentation if no suitable translation can be found).
• There were a variety of theme changes to support new functionality and fix inconsistencies in the layout.

This release also includes a number of patches and improvements made by students applying for participation in the Google Summer of Code 2009. Thank you!

Geeklog 1.5.2sr6

This release fixes a vulnerability to dictionary attacks in the autologin, originally reported by Bookoo of the Nine Situations Group.

Geeklog 1.5.2sr5

This release addresses the following security issues:

1. Gerendi Sandor Attila reported an XSS in the forms to email a user and to email a story to a friend.
2. The "Mail Story to a Friend" function didn't check story permissions, so that it was possible to email a story even if you didn't have the permissions to view it on the site.

Geeklog 1.5.2sr4

Bookoo of the Nine Situations Group posted another SQL injection exploit, targetting an old bug in usersettings.php. As with the previous issues, this allowed an attacker to extract the password hash for any account and is fixed with this release.

Geeklog 1.5.2sr3

Bookoo of the Nine Situations Group posted another SQL injection exploit, this time targetting the webservices API. As with the previous issue, this allowed an attacker to extract the password hash for any account and is fixed with this release.

Geeklog 1.5.2sr2

Bookoo of the Nine Situations Group posted an SQL injection exploit for glFusion that also works with Geeklog. This issue allowed an attacker to extract the password hash for any account and is fixed with this release.

Geeklog 1.5.2sr1

Fernando Muñoz reported a possible XSS in the query form on most admin panels that we are fixing with this release.

Geeklog 1.5.2

Bugfixes

• Fixed a bug in the story preview where the story content was lost when previewing a story with a duplicate story ID.
• Fixed another bug in the story preview that caused extra backslashes to appear in the story's title.
• The Trackback editor didn't work since the security token was missing from the editor template.
• Fixed issues with clickable links in plain text postings.
• Fixed various problems with updating feeds, e.g. when changing topic permissions.

Fixes in the bundled Plugins

• Calendar: You couldn't add a new event to your personal calendar.
• Links: Changing a link's ID to one that was already in use overwrote the other link.
• Polls: Changing a poll's ID created a new poll. Also fixed an SQL error when the poll question contained single quotes.
• Static Pages: Saving a static page changed the owner to the user who saved it.

Other Changes

• Improved image quality when using gdlib to rescale uploaded images.
• Theme changes are documented in the theme documentation, as usual. There are 4 bugfixes (one of which is in the templates for the Polls plugin) that should be applied to all themes for the 1.5.x series.

Geeklog 1.5.1

Geeklog 1.5.1 is mostly a bugfix release and a recommended upgrade for users of Geeklog 1.5.0. There were also a few minor feature additions.

Bugfixes

Security related

• The upload script for FCKeditor could be called directly to upload various media files (but not executable scripts), as reported by t0pP8uZz.
• The protection in various include files against direct execution did not work properly on non-case sensitive file systems, e.g. on Windows (reported by Mark Evans).
• It was possible to view stories with a publication date in the future and stories that had the draft flag set if you knew their story ID.
• It was possible to post comments on unpublished stories if you knew their story ID.
• When a database backup fails, the database password is no longer logged to error.log.

Other Bugfixes

• All right-side blocks were rendered twice, which not only took more time than necessary, but could also affect the functionality of add-ons like the Chatterblock or Shoutbox.
• Fixed handling of security tokens (for CSRF protection) that prevented you from deleting comments on a story that had trackbacks.
• Other fixes were applied to the user submission queue, story submissions, the list of draft stories and the support for MS SQL.

Fixes in the bundled Plugins

• Calendar: Fixed display of events in the Upcoming Events block for the current day (really this time ...).
• Links: Fixed SQL error when trying to change a category and fixed new categories silently overwriting existing categories with the same ID.
• Static Pages: Fixed printer friendly version when url_rewrite is enabled.

New Features and Improvements

• Includes FCKeditor 2.6.3
• In multi-language setups, blocks can now also be multi-lingual.
• New "Subscribe to ..." feed story option when there is a separate feed for a story's topic.
• New option "All Frontpage Stories" for article feeds (skip stories that have the "Show only in topic" option set).
• Allow to unset Configuration options again after they have been "restored", e.g. after accidental activation.
• Configuration options can now be overwritten in siteconfig.php. This is mostly useful for the $_CONF['rootdebug'] option.
• Remotely authenticated users can now use the webservices (they need to use username@servicename for their username).
  Note: OpenID users can not use the webservices, due to technical issues with the authentication method.
• Improved compatibility of the webservices (i.e. AtomPub).

Theme Changes

There was one mandatory theme change: The template file for configuration items, admin/config/config_element.thtml has to be updated (copy from the Professional theme). All other theme changes in this release are optional - see the theme documentation for details.

Geeklog 1.5.0

Results from the Summer of Code

This release incorporates the following projects implemented during the the 2007 Google Summer of Code:

• New user-friendly install script by Matt West
• New Configuration GUI (replacing config.php) by Aaron Blankstein
• New Webservices API based on the Atom Publishing Protocol by Ramnath R. Iyer

Other New Features and Improvements

• OpenID support: You can now allow users to log into your site using an OpenID, so that they don't need to create a new account with your site but still get all the benefits of a normal registered user.
• New LDAP remote authentication module.
• The Links plugin now has hierarchical (sub-)categories.
• Updated FCKeditor to version 2.6.
• Rewrite of the underlying story code. Amongst other things, this should finally resolve all outstanding issues with the handling of special characters, HTML entities, etc. in stories. Also introduces a new [raw] tag as an inline complement to [code] when you want to post pieces of code (e.g. HTML) "as is", so that they are not interpreted.
• Comments can now be closed, i.e. existing comments will still be displayed but no new comment can be posted.
• The Polls plugin now allows for multiple questions per poll.
• The Static Pages plugin now supports comments.
• The database backup admin panel now lets you delete and download backups.
• The default Professional theme is now HTML 4.01 Strict compliant. Geeklog now also supports XHTML (given an XHTML compliant theme).

Security

• Geeklog now includes protection against cross-site request forgery attacks.
• Lukasz Pilorz reported security issues in kses, the HTML filter we're using in Geeklog.

Geeklog 1.4.1

New Features

• Support for Microsoft SQL Server. Starting with this release, Geeklog can now also be installed on Microsoft SQL Server, so it's no longer restricted to just MySQL. The MS SQL support was developed by Randy Kolenko. Thanks, Randy!
  Please note that any third-party plugins will have to offer support for MS SQL before they can be installed on Microsoft SQL Server. The bundled plugins (Calendar, Links, Polls, Spam-X, Static Pages) have already been updated accordingly.
• Calendar plugin. The formerly built-in calendar and events have now been moved into a separate plugin. This complements the move of the polls and links sections into plugins in Geeklog 1.4.0 and makes Geeklog more modular as you can now easily disable or replace functionality that you don't need for your site.
• Multi-language support. It is now possible to build truly multi-lingual sites with Geeklog where not only the navigation but also the content of the site changes with the language.
• Ships with FCKeditor 2.3.1, which once again includes a file manager for uploading images.
• A function for mass-deletion of old or inactive users. The list automatically searches for users that have never logged in, only used the site for a very short time or have not been online since a very long time. The time span can be varied, and found users can be selectively deleted.

Security

In the light of the security issues discovered in Geeklog 1.4.0 and earlier versions, the Geeklog source code has undergone a code review. We have identified and addressed several minor issues and introduced new measures to enhance security in this release. As a welcome side effect, the code reviews have also uncovered a few bugs and inconsistencies that we also fixed in this release.

Spam Protection

With this release we are finally removing support for the discontinued MT-Blacklist. In its place, we are now using a system called Spam Link Verification (SLV) run by Russ Jones at www.linksleeve.org. SLV could be described as a community-driven, automatically updated blacklist. See the documentation of the Spam-X plugin for details.

Geeklog 1.4.0sr6

MustLive pointed out a possible XSS in the form to email an article to a friend that we're fixing with this release.

Geeklog 1.4.0sr5-1

This release fixes display problems in the comment preview that were only introduced in Geeklog 1.4.0sr5.

Geeklog 1.4.0sr5

JPCERT/CC informed us about a possible XSS in the comment handling that we're fixing with this release.

Geeklog 1.4.0sr4

Two exploits have been released by "rgod" for insecure Geeklog installations and for a bug in the "mcpuk" file manager that we've been shipping as part of FCKeditor in all previous 1.4.0 releases.

• Some of the files outside of the public_html directory were not protected against direct execution. If Geeklog was installed such that those files were accessible from a URL (which has always been strongly discouraged in the installation instructions) then those files could be used to load and execute malicious code from a remote server.
  
  More information: So-called Geeklog "exploit" posted
  
  In this release, we've added the missing execution prevention for all files outside of public_html. We would still, however, suggest that you fix your Geeklog install if the files outside of public_html are accessible from a URL (see our FAQ for details).
• The "mcpuk" file manager that we've integrated into FCKeditor allowed the upload of arbitrary PHP code (even if FCKeditor was disabled in Geeklog's config.php). Depending on your webserver's configuration, it was then possible to execute that uploaded code.
  
  More information: Exploit for FCKeditor's mcpuk file manager
  
  The file manager has been removed from this release. You will therefore no longer be able to upload files, e.g. images, through FCKeditor. Future versions of Geeklog will ship with an updated version of FCKeditor and its included file manager.

Note: This release also includes the updated lib-trackback.php for better protection against Trackback spam.

Geeklog 1.4.0sr3

This release addresses the following security issues:

1. Possible SQL injection and authentication bypass in auth.inc.php (reported by the Security Science Researchers Institute Of Iran).
2. Possible XSS in getimage.php (reported by the Security Science Researchers Institute Of Iran).
3. Path disclosure in getimage.php and the functions.php of some themes, e.g. the Professional theme (reported by the Security Science Researchers Institute Of Iran).
4. Possible SQL injection in story submissions.

Geeklog 1.4.0sr2

This release addresses the following security issues:

• Konstantin Dyakoff found an old bug in the session handling that would allow anyone to log in as any user.
• HTML was not stripped from the Location field in a user's profile.

Geeklog 1.4.0sr1

This release addresses the following security issues:

• James Bercegay of GulfTech Security Research reported several issues with Geeklog's cookie handling that made it vulnerable to SQL injections, arbitrary file access, and even injection and execution of arbitrary code.

Geeklog 1.4.0

(Geeklog 1.4.0 was originally supposed to be called 1.3.12, so any references you may find to a version 1.3.12 apply to version 1.4.0)

New Features

• Geeklog now officially works with register_globals = off. Please note that some plugins may still require it to be on, though.
• Added support for sending and receiving Trackback and Pingback comments. Both are supported for stories, but there is also a new plugin API so that plugins can use this feature, too. Trackback and Pingback can be disabled in config.php.
• Added the ability to "ping" weblog directory services to advertise site updates (preconfigured to ping Ping-o-Matic). As with Trackback and Pingback, this is supported for stories, but plugins can also make use of this feature via the plugin API.
• New syndication framework so that Geeklog can now read and write feeds in different formats (currently supported: RSS, RDF, and Atom).
• New administrator controlled user status. Including banning and administrator activation of accounts.
• New Remote Authentication system to allow people with accounts on remote services such as Blogger.com or LiveJournal.com to login to your site without having to directly register on your site. (Remote accounts can be banned as normal accounts).
• The Admin sections have been revamped to provide a more consistent look and sortable lists. "Command and Control" (moderation.php) now also comes with a new set of icons and has one icon for every Admin section. Furthermore, the Admin block and Command and Control can be sorted alphabetically.
• Ships with FCKeditor (WYSIWYG editor). To enable, set $_CONF['advanced_editor'] = true; in your config.php.
• The search now only displays a specified amount of results per page to avoid running into timeouts when searching through large databases.
  Note: Plugins will have to be updated to support the "paged" search. Until then, Geeklog fakes the paged results for plugin searches, which means that a plugin that hasn't been updated will still search through the entire database, but Geeklog will only display the results for the current result page.
• Introduced an "Article Directory", providing an overview of all past articles, sorted by year and month.
• The default permissions for new objects (stories, topics, blocks, etc.) can now be set in config.php.

Compatibility

• Due to the changes, themes will have to be updated to work with Geeklog 1.4.0. See the list of theme changes for details.
• The plugin API for comments has changed. Plugins using comments will have to be updated to work with Geeklog 1.4.0.

More Information

We have posted a series of stories on the Geeklog homepage that highlight and explain some of the new features:

• Geeklog's Advanced Editor
• Remote Authentication
• Trackback and Pingback
• Sending a Ping
• New Comment Plugin API

Geeklog 1.3.11sr7

JPCERT/CC informed us about a possible XSS in the comment handling that we're fixing with this release.

Geeklog 1.3.11sr6

This release addresses the following security issues:

1. Possible SQL injection and authentication bypass in auth.inc.php (reported by the Security Science Researchers Institute Of Iran).
2. Possible XSS in getimage.php (reported by the Security Science Researchers Institute Of Iran).
3. Path disclosure in getimage.php and the functions.php of some themes, e.g. the Professional theme (reported by the Security Science Researchers Institute Of Iran).
4. Possible SQL injection in story submissions.

Geeklog 1.3.11sr5

• Konstantin Dyakoff found an old bug in the session handling that would allow anyone to log in as any user.

Geeklog 1.3.11sr4

This release addresses the following security issues:

• James Bercegay of GulfTech Security Research reported several issues with Geeklog's cookie handling that made it vulnerable to SQL injections, arbitrary file access, and even injection and execution of arbitrary code.

Geeklog 1.3.11sr3

This release addresses the following security issues:

1. Provided you knew the story id, it was possible to submit comments for stories even if you did not have access to those stories (reported by LWC). The same problem also existed with poll comments.
2. Supplying an illegal start or end date to the advanced search resulted in a warning message that disclosed the path to the Geeklog install on the server (reported by r0t3d3Vil).
   It was not possible to use this for SQL injections.

Also included in this release are bugfixes, e.g. for the problems editing static pages when URL rewriting was enabled, that were introduced in 1.3.11sr2.

Geeklog 1.3.11sr2

This release provides security enhancements and better spam protection originally developed for Geeklog 1.3.12. It also addresses a few bugs where the bugfix could be integrated with a reasonable amount of work (other bugfixes will have to wait for the 1.3.12 release).

Security and Spam protection

• There is now a speed limit for login attempts, defaulting to three tries in a five minute period (configurable in config.php).
• Linefeeds are filtered from the To:, From:, and Subject: fields of any email sent through COM_mail.
• When a new user account is created and the user submission queue is enabled in config.php, Geeklog now ensures that the new account is properly queued even in the unlikely event that the account creation fails halfway through.
• When a post is identified as spam, it now also triggers the speed limit (ie. posters will have to wait for the speed limit to expire before they can make another submission).
• Spam posts now get a 403 "Forbidden" HTTP response code.
• Spam checks are now done for comments, story, link, and event submissions, the message sent with the "email story to a friend" option, and for the contents of the user profile.
• Spam-X plugin 1.0.2 included.

Please note that MT-Blacklist (used by Spam-X) has recently been discontinued. The Spam-X plugin as included in this release is configured to get the last version of the blacklist from geeklog.net, but there will be no more updates.

Bugfixes

• Fixed an error message thrown up by PHP 5.0.5 or later when viewing the article page (bug #483).
• Quote names in email addresses as soon as they contain any non-alphanumeric characters, apart from the blank (bug #368). This should help when trying to email users with special characters in their name.
• Upgraded included kses class to version 0.2.2 which fixes problems with Japanese and Thai characters (bugs #94 and #119).
• Fixed SQL error when using the [staticpage:] autotag (bug #373).

For a complete list of bugfixes, please see the Changelog.

Improvements

• Added support for a custom_usercheck function (for the custom registration code). See the included lib-custom.php for details.
• Improved handling of the auto-archive option in index.php, which should slightly improve page load times.
• Includes several new and updated language files.
• Includes updated PEAR classes.

Geeklog 1.3.11sr1

This release addresses the following security issue:

• Stefan Esser found an SQL injection that can, under certain circumstances, be exploited to extract user data such as the user's password hash.

Geeklog 1.3.11

Geeklog 1.3.11 is a bugfix and security release over Geeklog 1.3.10 and is meant to replace 1.3.10. The change in the version number was necessary since one of the bugfixes involves a change in the database.

Security issues

1. It was possible to submit stories anonymously even if anonymous submissions were turned off in config.php (reported by Barry Wong).
   These stories still ended up in the submission queue, though, unless you disabled it in config.php.
2. Some of the parameters in link and event submissions weren't filtered, leaving them open to potential SQL injections.
3. The links for the What's Related block were created from the unfiltered story text, opening the possibility of XSS attacks (reported by Vincent Furia).

Bugfixes

• Fixes the length of the 'sid' field in the gl_comments table. Using story IDs longer than 20 characters prevented comment posts from being associated with the story.
• Ensures compatibility with PHP 4.1.x (includes updated PEAR packages).
• Fixes the archiving option being activated too early (bug #345).
• Properly deletes comments and story images when deleting entire topics (bug #339).
• Deletes comments when deleting polls.
• Fixes several bugs in the calendar and improves overall handling of both the site calendar and the personal calendars (bugs #268, #336, #338, and others).
• Fixes "More by author" and "More from topic" links in articles.
• Various other fixes, see docs/history for details.

We strongly advise users of Geeklog 1.3.10 to upgrade to 1.3.11 ASAP. Upgrading should be relatively painless, as there weren't any changes in the themes, language files, or config.php over 1.3.10.

Geeklog 1.3.10

New Default Theme

This release comes with a new default theme: We've chosen the Professional theme, kindly provided by Victor B. Gonzalez (of Aeonserv fame). The theme has been modified slightly and is now fully HTML 4.01 and CSS compliant.

We've also decided to remove the old set of themes (Classic, Clean, Digital Monochrome, Gameserver, Smooth Blue, XSilver, Yahoo) from the distribution. They are now available as a separate tarball.

New Features

• Spam-X plugin included. Tom Willet has kindly provided his spam detection plugin, which is now part of the default Geeklog install.
  The plugin has been modified slightly to store the blacklists in the database. Users of the previous version of the plugin will have to import their personal blacklist via the plugin's admin panel.
• Story Archive feature: It is now possible to move stories to an "archive" topic or have them deleted automatically at a given time.
• Customizable menu bar: The site's menu bar can now be configured in config.php, i.e. you can choose which entries should be displayed there and in which order. It's also possible to add custom entries by providing a function in lib-custom.php.
• Clickable links in text postings: URLs in non-HTML postings are now recognized by Geeklog and displayed as clickable links.
• Editable story IDs: The IDs of stories can now be changed (like the IDs of static pages) to provide more readable URLs (and further improve the chances of being picked up by seach engines, especially when used with URL rewriting).
• Autolinks are a new form of links that can be used in stories and comments. An autolink takes the form [name:id link text] where name is the tag name, id is the ID of an object the link should be pointing to, and link text is used as the text of the link.
  Example: [story:email-bug About the email bug] would be translated into <a href="http://example.com/article.php/email-bug">About the email bug</a>
  For the built-in autotags, the link text is optional and Geeklog will use the title of the object (story / event / static page) if it is not given.
  Predefined autotags are [story:] to link to stories and [event:] to link to events. Plugins can define their own autotags to provide links to objects under their control. The Static Pages plugin already provides a [staticpage:] autotag.
• Customizable welcome email: The email that is sent out to users registering with your site is now fully customizable by providing the text in a text file (/path/to/geeklog/data/welcome_email.txt).
• Timezone hack: The popular "timezone hack" is now included. It lets you set the site's timezone for when your server is located in another timezone.

Other Improvements

• Various changes have been made to improve the overall performance.
• On fresh installs, there is now an option to use InnoDB tables (instead of MyISAM) if your MySQL version supports them (as of MySQL 4.0, or 3.x "Max" builds). Existing databases can be converted to InnoDB by using the script admin/install/toinnodb.php.
  Warning: Using InnoDB tables makes database backups somewhat more complicated. Small and medium-sized sites should work just fine with MyISAM tables, so if in doubt don't use InnoDB tables.
• The calendar's week can now either start on a Sunday or a Monday.
• The Static Pages plugin now has an option to display a printer-friendly version of a static page.

Comments

• The comment code has undergone major changes to improve performance and add improvements like the ability to link to individual comments, paging comments, etc.
• Users can now report abusive comments to the site admin.
• The site admin can get an email notification when a new comment is posted (similar to the notification emails for new stories, links, events, and users).
• The IP addresses of comment posters are now tracked and can be looked up directly by linking to a Whois service (or you can install Tom Willet's NetTools, which include a Whois function).

Security-related fixes

Note: All of the following bugs were problems with Geeklog's permissions system and fall into the "information leakage" category, i.e. under certain circumstances, site content was visible to persons who shouldn't be able to see it. None of these bugs were exploitable in the sense that they could be used to gain privileges or cause damage to Geeklog or the environment it's running in.

• Group Admins were able to list the members of all groups, even if they were not members of those groups.
• Group Admins were given a list of all the groups in the system, even if they were not members of those groups (bug #280).
• Story and Event Admins were always given a list of all the stories / all the events, even when they didn't have read access to them (bug #269).
• It was possible to request comments from stories even if the user didn't have permission to read the story (provided you knew both the story and the comment id).
• Event permissions in the calendar's day and week view weren't checked properly, so that events may have been visible to users who shouldn't have been able to see them.
• It was possible to add any event to the personal calender, even if you didn't have permissions to see it in the site calendar (provided you knew the event id).

Other bugfixes

• Previewing and saving a story submission left the submitted story in the submission queue, but did additionally save it as a new story.
• Deleting an event from the personal calendar didn't work (bug #199).
• Old userphotos weren't removed when the new photo had a different file type, e.g. when changing from a .gif to a .jpg (bug #228).
• Scaling images didn't work when the image exceeded the max. height but not the max. width (bug #242).
• Keeping an unscaled image wasn't possible when using gdlib to rescale images (bug #197).
• When using gdlib, GIF images were converted to PNG format, but Geeklog was still trying to display the GIF version. Since the LZW patent has now expired, it is safe to use GIF images again and the PNG conversion has been dropped.
• The tarball also includes updated PEAR packages which should address the email problems some users were having (bug #246).
  Note: These are the same PEAR packages that already shipped with Geeklog 1.3.9sr2.

Please note that there have also been theme changes, some of which are important to make the new features work (e.g. the editable story IDs and the story archive options)!

This release contains various improvements provided by the Geeklog community (see the docs/history file for proper credits). Thank you!

Geeklog 1.3.9sr3

This release addresses the following security issues:

1. It was possible to submit stories anonymously even if anonymous submissions were turned off in config.php (reported by Barry Wong).
   These stories still ended up in the submission queue, though, unless you disabled it in config.php.
2. Some of the parameters in link and event submissions weren't filtered, leaving them open to potential SQL injections.

Geeklog 1.3.9sr2

This release addresses the following security issues:

1. Fixed a cross site scripting vulnerability caused by using the variable $topic in the language files (bug #293).
2. Prevent comment posts on stories or polls were comment posting has been disabled.

Other fixes

• Fixed lib-plugins.php to work properly with PHP 5.
• The complete tarball also includes updated PEAR packaged that fix some of the reported email problems.

Geeklog 1.3.9sr1

This release addresses the following security issues:

1. It was possible to post anonymous comments, even when anonymous comment posting had been switched off in config.php.
   This bug was apparently exploited by spammers to send hundreds of spam posts to certain Geeklog sites.
2. Added additional speed limit checks for comments and submissions.
3. If none of the topics were visible for anonymous users, the site's index page may still have displayed some stories for anonymous users, depending on the stories' permissions.
4. Users still got Daily Digest emails for topics from which they had been removed (bug #178).
5. It was possible to subscribe to the Daily Digest for all topics, even if the user did not have access to certain topics.
6. Comments to stories were sometimes listed in a user's profile, even if the user viewing the profile didn't have permissions to access the story the comments belonged to.

Other fixes

• Fixed an SQL error in COM_showTopics if users excluded topics from their preferences.
• Fixed sporadic "Duplicate entry '...' for key 1." messages in error.log, caused by the handling of pseudo-session ids for anonymous users.
• Fixed incorrect author names in Daily Digest (bug #207).
• The plugin_profileblocksedit_plugin-name Plugin API function wasn't working due to a missing piece of code in usersettings.php.
• COM_extractLinks will now ignore anchor tags that do not contain "href" (bug #183).

Geeklog 1.3.9

New Features

• Geeklog now uses PEAR::Mail to send all emails. This gives you the option to send emails via PHP's built-in mail() function (as before), via sendmail or via SMTP.
• There is a new admin option called Content Syndication that lets you create and configure (RSS) feeds. In addition to the standard feed containing all the new stories, you can now create feeds per topic, for upcoming events, and for links.
  This feature is extensible in that plugins can provide additional feeds. It is also possible to provide feeds in formats other than RSS 0.91 by providing additional feed classes.
• Admins can change the block order easily from the list of blocks now.
• There is an alternative interface to adding users to groups (requires JavaScript).
• Users in the Group Admin group can now only assign other users to groups of which they themselves are a member.
• Image upload can now also use the GD library to scale images.
• Comments now use templates.
• To accomodate strict webhosts who don't allow file uploads to the standard image directory, you can now set a new configuration variable, $_CONF['path_images'] to point to a directory outside of your webtree where article images and user profile pictures will be saved.
• Geeklog now supports URL rewriting for story URLs, i.e. you can have URLs like http://www.geeklog.net/article.php/20031229225326631 which are known to be picked up by Google.
• Plugins can add their own section to Geeklog's What's New block.
• All URL fields can now hold up to 255 characters (requires theme updates).

Please see the themes documentation for a complete list of theme changes.

Also included is the Static Pages plugin 1.4, which now has, among other improvements, a second option to include PHP in static pages without having to use the PHP return statement.

Bugfixes

• Words from a search query are now properly highlighted in comments. Also fixed a problem with highlighting when the search query contained '*' characters.
• Various fixes in the search class.
• Fixed a bug that let users register with an empty username.
• When batch-importing users, those users were all subscribed to the Daily Digest automatically (uses the $_CONF['emailstoriesperdefault'] setting instead now).
• Fixed option to delete comments, which previously was only available to users in the Root group (e.g. Admin). Now those users that have story.edit permissions for the actual story can delete comments.
• Deleting a group may have left orphaned entries in the group_assignments table (this has been fixed now). When upgrading to 1.3.9, the install script will remove any orphaned entries from the database.

There have also been a lot of changes to improve security, especially against SQL injections.

Geeklog 1.3.8-1sr6

This release addresses the following security issues:

1. Fixed a cross site scripting vulnerability caused by using the variable $topic in the language files (bug #293).
2. Prevent comment posts on stories or polls were comment posting has been disabled.

Geeklog 1.3.8-1sr5

This release addresses the following security issue:

1. It was possible to post anonymous comments, even when anonymous comment posting had been switched off in config.php.
   This bug was apparently exploited by spammers to send hundreds of spam posts to certain Geeklog sites.

Geeklog 1.3.8-1sr4

This release addresses the following security issues:

1. It was possible for users in the Group Admin and User Admin groups to become a member of the Root group (reported by Samuel M. Stone, bug #135).
2. Being admin for a certain area (e.g. Story Admin for stories) made it possible to delete all objects in that area (e.g. stories) even if the user was not supposed to have access to them, provided the id of the object was known.
3. It was possible to delete other people's personal events if you knew the event ID.
4. It was possible to browse through the comments of a story even if the user did not have access to the actual story (reported by Peter Roozemaal).
5. Due to an XSS issue, it was possible to change someone's account settings (including the password) if you got them to click on a specially crafted link (reported by Jelmer, fix suggested by Vincent Furia).
6. The comment display suffered from the possibility of an SQL injection (reported by Jelmer).
7. It was possible to inject Javascript code in the calendar (reported by Jelmer).
8. It was possible to execute (but not save) Javascript code in the comment preview (reported by Jelmer).

Geeklog 1.3.8-1sr3

This release addresses the following security-related issues:

1. As "dr.wh0" pointed out, the category field for link submissions was not filtered at all. Although you probably can't cause too much harm with those 32 characters, this has now been fixed.
2. Vincent Furia found that the restrictions for the form to email users could be circumvented and could even be used to spam users. In addition to fixing theses issues, there is now also a speed limit on that form (defaults to the speed limit for story submissions).
3. There was a way to post comments anonymously even when posting for anonymous users had been disabled.
4. It was possible to post comments under someone else's username.

Geeklog 1.3.8-1sr2

Jouko Pynnonen found a way to trick the new "forgot password" feature, introduced in 1.3.8, into letting an attacker change the password for any account. This release addresses this issue - there were no other changes.

Obviously, we strongly recommend to upgrade as soon as possible.

Geeklog 1.3.8-1sr1

The purpose of this release is to address some of the security issues reported in September and early October 2003. We strongly recommend upgrading to this version.

Security issues

1. By including Ulf Harnhammar's kses HTML filter, this release addresses a variety of possible Javascript injection and CSS defacement issues.
2. Details of SQL errors will not be reported in the browser any more (but only in Geeklog's error.log file). This will avoid disclosing any sensitive information as part of the error message (which is so far the only problem we have found with the alleged SQL injection issues that have been reported).

Please note that at the moment we do not recommend to use Geeklog with MySQL 4.1 (which, at the time of this writing, is in alpha state and should not be used on production sites anyway). An upcoming release of Geeklog will include more thorough filtering of SQL injections attempts, thus also fixing the problems with MySQL 4.1.

Other fixes

• Fixed the auto-detection of the value for the $_CONF['cookiedomain'] variable if the URL included a port number (such as example.com:8080). This will fix the login problems some users were reporting.
• The full 1.3.8-1sr1 tarball also includes updated French (Canada) and Turkish language files.

Geeklog 1.3.8-1

Geeklog 1.3.8-1 is a bugfix release over Geeklog 1.3.8. It contains a variety of (mostly minor) bugfixes. None of those fixes are security-related.

Bugfixes

• Fixes to the new search to restore pre-1.3.8 behavior (display search form again if no results are returned, handling of $_CONF['searchloginrequired'], etc.). Also fixed the search by date.
• Fixed problems in the install script when trying to identify the MySQL version. The install script failed silently on PHP 4.0.4 and earlier versions.
• Fixed a problem with the What's Related block on stories that contain images.
• Skip user "Anonymous" when sending out the Daily Digest.
• Prevent admin from changing a user's email address to one that's already used by another user.
• Update RSS feed and Older Stories block when deleting a story.

The full 1.3.8-1 tarball also includes new and updated language files (see the Changelog for details).

Geeklog 1.3.8

New Features

Geeklog 1.3.8 Includes the Static Pages 1.3 plugin which replaces both the Static Pages 1.1 and 1.2 plugins. See the Static Pages documentation for details.

• The search function has been rewritten. You can now search for the exact phrase, all the words, or any of the words from a query. Search words are also highlighted in stories.
• New Privacy options: Users can decide whether they want to receive email from other users and/or admins and whether they want to show up in the Who's Online block.
• You can now get a list of all users who are in a certain group (from the Admin's group editor).
• When scaling is configured for images in stories, you can now keep the unscaled image (has to be enabled in config.php first). In that case, the scaled-down image in the story will serve as a thumbnail and link to the unscaled image.
• You can now make one topic the default topic. The topic selection in the story submission form will then default to that topic. However, when browsing by topic (index.php?topic=Geeklog etc.) new story submissions will default to the current topic.
• You can give your users the ability to change their username and delete their account. Both features have to be enabled in config.php.
• Extended Plugin API: Plugins can now display content in Geeklog's center area, add their own information to the user profile, and add information to the site's header (<head> section).
• There's a new API for custom registration forms (see lib-custom.php for sample code).
• There have been quite a few theme changes in order to move most larger portions of hard-coded HTML to template files and to give theme designers more control over the layout. Please consult the themes documentation for a list of changes.

Bugfixes

• The "forgot password" function has been rewritten. Instead of resetting your old password and sending you a new one, you will now receive an email with a unique link in it. If you follow this link, you can enter a new password directly. Otherwise, you can simply ignore the email and your old password will remain valid.
• Topic access was not always checked properly. If Story Admins report getting access denied messages after upgrading to 1.3.8, check your topic permissions carefully.
• The poll editor let you enter one answer too many (i.e. when the max. number of answers was set to 10 you could actually enter 11). Please check your existing polls or you may lose the last answer if you exceeded the max. number of answers in a poll (adjust $_CONF['maxanswers'] accordingly, if necessary).
• Geeklog should install and run again on old versions of MySQL (specifically, 3.22.xx). Please note that some of these old versions aren't even supported by MySQL AB any more and MySQL installs older than 3.23.54 are having security issues.

Geeklog 1.3.7sr5

This release addresses the following security issues:

1. It was possible for users in the Group Admin and User Admin groups to become a member of the Root group (reported by Samuel M. Stone, bug #135).
2. Being admin for a certain area (e.g. Story Admin for stories) made it possible to delete all objects in that area (e.g. stories) even if the user was not supposed to have access to them, provided the id of the object was known.
3. It was possible to delete other people's personal events if you knew the event ID.
4. It was possible to browse through the comments of a story even if the user did not have access to the actual story (reported by Peter Roozemaal).
5. Due to an XSS issue, it was possible to change someone's account settings (including the password) if you got them to click on a specially crafted link (reported by Jelmer, fix suggested by Vincent Furia).
6. The comment display suffered from the possibility of an SQL injection (reported by Jelmer).
7. It was possible to inject Javascript code in the calendar (reported by Jelmer).
8. It was possible to execute (but not save) Javascript code in the comment preview (reported by Jelmer).

Geeklog 1.3.7sr4

This release addresses the following security-related issues:

1. As "dr.wh0" pointed out, the category field for link submissions was not filtered at all. Although you probably can't cause too much harm with those 32 characters, this has now been fixed.
2. Vincent Furia found that the restrictions for the form to email users could be circumvented and could even be used to spam users.
3. There was a way to post comments anonymously even when posting for anonymous users had been disabled.
4. It was possible to post comments under someone else's username.

Geeklog 1.3.7sr3

The purpose of this release is to address some of the security issues reported in September and early October 2003. If you don't plan to upgrade to the latest version of Geeklog (1.3.8-1sr1, at the time of this writing), we strongly suggest you upgrade to at least 1.3.7sr3 instead.

Security issues

1. By including Ulf Harnhammar's kses HTML filter, this release addresses a variety of possible Javascript injection and CSS defacement issues.
2. Details of SQL errors will not be reported in the browser any more (but only in Geeklog's error.log file). This will avoid disclosing any sensitive information as part of the error message (which is so far the only problem we have found with the alleged SQL injection issues that have been reported).

Please note that at the moment we do not recommend to use Geeklog with MySQL 4.1 (which, at the time of this writing, is in alpha state and should not be used on production sites anyway). An upcoming release of Geeklog will include more thorough filtering of SQL injections attempts, thus also fixing the problems with MySQL 4.1.

Geeklog 1.3.7sr2

Security issues

The purpose of this release is to fix the following security issues. All users are strongly encouraged to upgrade to this version ASAP.

1. It was possible to obtain valid session ids for every account on a Geeklog site, including the Admin account (reported by SCAN Associates).
2. Using Internet Explorer, it was possible to upload an image with embedded PHP code and execute it (reported by SCAN Associates).
3. Story permissions could override topic permissions, resulting in the display of stories to users who shouldn't have access to them (reported by Andrew Lawlor). This was already fixed with the new index.php, released 2003-05-15.
4. Added a warning in config.php that adding any of the following tags to the list of allowable HTML can make the site vulnerable to scripting attacks:
   <img> <span> <marquee> <script> <embed> <object> <iframe>
   (pointed out by Joat Dede).

This update also includes fixes for the notorious "permission denied" error messages that some users would get in the Admin area (e.g. when trying to save a story and being "only" a user with Story Admin permissions).

The full 1.3.7sr2 tarball also includes various new and updated language files (see the Changelog for details).

Geeklog 1.3.7sr1

Security issues

The main purpose of this release is to fix the following security issues. All users are strongly recommended to upgrade to this version.

1. Javascript code could be injected in the homepage field of a user's profile (reported by Jin Yean Tan).
2. Javascript code could be injected in certain URLs to be used in a cross-site scripting attack (reported by Jin Yean Tan).
3. Comments could be deleted by anybody if they knew the comment id (which is not normally visible).
4. A StoryAdmin could manipulate stories even if s/he did not have access to them (e.g. when s/he was not a member of a certain group). The same applied to Admins for events, links, polls, topics, and blocks (reported by Kobaz).

Other Bugfixes

• Fixed possible causes for endless loops with the redirect in index.php: No redirect will be done if $HTTP_SERVER_VARS['HTTP_HOST'] is not set. Also, the comparison of the configured and actual server name is not case-sensitive any more.
• Fixed image resizing when using ImageMagick.
• The new user notification email (introduced in Geeklog 1.3.7) was always sent out, even if 'user' was not listed in $_CONF['notification'].
• The Admin menu will now be displayed for users who have Admin access to plugins only, but not to one of the core Admin features.
• The default for the daily digest is now back to "off", i.e. new users will not receive it automatically. To enable the daily digest for new users again, set $_CONF['emailstoriesperdefault'] = 1 in config.php.

Documentation and hard-coded links (version check, link to Geeklog in a site's footer) have been updated to point to www.geeklog.net.

Geeklog 1.3.7

New Features

• A notification email can now be sent when a new story, link, or event has been submitted or a new user has registered with the site (see the submission settings for details).
  Please note that this feature doesn't tie in with Geeklog's security features - it's really more of a hack, since many people asked for this functionality.
• Following the "X stories in last 24 hours" link in the What's New block will now display just those new stories.
• User photos are now resized, just like images in stories (if the use of an image library is configured). The max. dimensions for user photos can be set with a separate set of config variables in config.php.
• The plugin menu now lists all plugins which exist in the file system but haven't been installed yet. It also provides a link to the install script of those plugins for easy installation.
• Several new config variables have been added to config.php (notification, showfirstasfeatured, dateonly, timeonly, skip_preview, upcomingeventsrange, emailstoryloginrequired, hideemailicon, hideprintericon, hidenewstories, hidenewcomments, hidenewlinks, max_photo_width, max_photo_height, max_photo_size). Please see the config documentation for details.
• Theme changes: Please consult the themes documentation for a list of changes.

Bugfixes

• Added sanity checks in the Admin story editor to prevent the loss of all stories when using an incomplete language file (or when manipulating the URL).
• Fixed a nasty bug in lib-security.php that let any user with UserAdmin permissions change the Root user's password, thus effectively becoming root.
• Fixed problems with blocks disappearing when they were set to "homeonly".
• Fixed problems with multiple [code] ... [/code] sections in stories and comments.
• Fixed double line spacing in [code] sections and HTML-formatted comments on PHP 4.2.0 and up.
• Fixed problems with slashes and HTML entities in emails sent by Geeklog.
• Fixes and improvements to the plugin API.

Contributors: Blaine Lang, Vincent Furia, and Kenn Osborne have contributed to this release. Thank you!

Speeding up Geeklog (a bit)

If you're upgrading from 1.3.6 or older versions, you may want to run the script called addindex.php that you will find in the install directory. This script adds index fields to some of Geeklog's database tables which should improve overall access times a bit.

This has been implemented as a separate script (and not as part of the upgrade process of the install script) since it may take some time to run, depending on how many users / stories / etc. you have in your database. Some people may even run into timeouts, e.g. when their hosting service limits the execution time of PHP scripts. If that happens to you - Don't Panic. Simply run the script again (and again and ...) until it reports that it didn't add any fields to any tables.

Please note that you do not need to run this script if you're doing a fresh install of Geeklog 1.3.7. A database created during a fresh install already has the new index fields.

Geeklog 1.3.6

New Features

• Images in articles can now be resized automatically during upload (provided you have either ImageMagick or netpbm installed). See the configuration description for details.
• The contents of a static page entitled "Frontpage" will be displayed before the first story on the front page of a Geeklog site. If the static page additionally carries the label "nonews", then it will completely replace the news on the front page.
• User submission queue: When activated (in config.php), new users will need to be approved by an admin before they receive their password.
• The submission queues can be switched off separately, either completely (in config.php) or only for certain groups of users (by using the new features story.submit, links.submit, and event.submit).
• When posting source code (e.g. PHP, HTML, ...), you can now use the [code] ... [/code] pseudo tags to enclose those portions of your posting that should be reproduced verbatim.
• The links section now uses a categorized and paged display (can be switched off separately and even back to the pre-1.3.6 style listing).
• Anonymous users can now be blocked from almost every part of the site (e.g. links section, site stats, ...), if needed.
• A Geeklog site can now be disabled easily (e.g. for maintenance) by setting a flag in config.php.
• Theme changes: Please consult the themes documentation for a list of changes.

Bugfixes

• Several fixes have been made to ensure that permissions are taken into account properly (e.g. not revealing titles of stories that the user has no access to).
• Several fixes have been made to make sure that Geeklog can now be properly localized (provided you have a language file that is up to date and have chosen the proper locale settings for your country and language).
• The variable $_CONF['site_admin_url'] is now used properly so that you can rename Geeklog's admin directory if needed.
• New RDF parser will now import most (if not all) RDF news feeds properly

Notes

• Since there are a lot of new variables in config.php, it is recommended you start with a fresh copy of that file instead of copying over your old config.php from your previous installation.
• Please note that currently only the English, German, Italian, Polish, and Japanese language files are up to date. Using one of the other language files may result in your Geeklog site not working properly.

Contributors: Gene Wood, Blaine Lang, Tom Willet, and Roger Webster have contributed to this release. Thank you!