Geeklog History/Changes: ??? ??, 2013 (2.1.0) ------------ - Integrated Caching Template Library original developed by Joe Mucchiello [Tom] - Support for themes to specify a default theme. Default themes template and css files will be used unless they are included in the new theme directory [Tom] - Added configruable caching support for blocks (regular and gldefault), staticpages and articles [Tom] - Speed increases by caching topic tree structure [Tom] - What's Related article block now includes all Topics. Can set length of titles [Tom] - Articles now list what Topics they are filed under. [Tom] - New related_topics autotag. It displays all topics an item belongs too. [Tom] - New related_items autotag. It displays all other related items based on what topics the defined item belongs too [Tom] - Updated Command & Control layout. Plugins can now organized into groups. [Tom] - New OAuth login methods supported (Google, Microsoft, Yahoo). OAuth supported now includes 1.0, 1.0a, and 2.0 (depends on what the provider supports) [Tom] - Javascript and css can now be loaded in a specified order. [Tom] - Numerous fixes for multi-language support [Tom] - Added CKEditor 4.3.2 as the default advanced editor for Geeklog [Dengen] - New article render which fixes entities etc... from showing up where they shouldn't [Dengen] - New Advanced Editor System that allows developers to easily to add new javascript editors [Dengen] - Article, Staticpages Poll and Topic IDs can now be 128 characters long [Tom] - User Login page now can be accessed directly without first displaying a login error message [Tom] - Fixed deadlock issues with the session table [Tom] - Updated Hebrew language files, provided by LWC - jQuery can now be included in the header [Tom] - Updated to jQuery 1.10.2 and jQuery UI to 1.10.3 [Tom] - Added a Filemanager [Kenji ITO] - Added timepicker jQuery control [Dengen] Mar 29, 2013 (2.0.0) ------------ - Fix for expiry check when 24 hour clock used [Dirk] - Error message is displayed when user tries to access a topic that does not exist [Tom] - Additional checks added to make sure user has read access to topics. If not then changed to all topics [Tom] - Fixed SQL error dealing with article directory and all topics (bug #0001570) [Tom] - H tags now display correctly in articles for modern_curve theme (bug #0001569) [Dengen] - Owner of article can now view his own draft article if comments set to display on same page (bug #0001568) [Tom] - Removed leftover 'search_no_data' config option from the database (bug #0001566) [Dirk] - Searching for "more from topic" didn't work anymore; (bug #0001565, #0001518) [Dirk] Mar 8, 2013 (2.0.0rc3) ------------ - jQuery updated to version 1.9.1 [Tom] - jQuery UI updated to version 1.10.1 [Tom] - Fixed "Find all postings by ..." on user profile page when search doesn't allow empty query string (bug #0001565) [Tom] - Add comments tag to Modern Curve theme to fix jumping to comments section of article page (bug #0001563) [Tom] - Added index.html to tooltips directory of modern_curve theme (bug #0001562) [Kenji] - Removed Japanese characters in modern_curve CSS files (bug #0001561, patch provided by taca) [Kenji] - Fixed a bug "More.." tab in the configuration UI does not work correctly (bug #0001560) [Dengen] - Updated theme changes for Geeklog 2.0.0 in docs [Tom] - Update FCKeditor to version 2.6.9 [Dirk] - Fixed COM_nl2br() that replaces newlines with a line break tag (bug #0001141) [Tom] Feb 19, 2013 (2.0.0rc2) ------------ This release addresses the following security issues: - High-Tech Bridge Security Research Lab reported an XSS in the calendar_type parameter in the Calendar plugin (HTB23143). - Trustwave Spiderlabs reported XSS in the install script, the Configuration, as well as in the Admin interfaces for the Polls plugin and the Topic editor (TWSL2013-001). Not security-related: - jQuery updated to version 1.9.0 [Tom] [Kenji] - jQuery UI updated to version 1.10.0 [Tom] [Kenji] - Illegal string offset 'phantom' when using Batch Admin mode (patch #0001558) [Dirk] - Optimize 2.0.0 MySQL Topic Upgrade Script (feature request #0001544) [Tom] - Introduce DB_escapeString (feature request #0001146) [Kenji] - For articles with 2 or more topics the incorrect topic icon may display in the parent topic (bug #0001509) [Tom] - Topic selection is lost when trying to contribute a story as a Story Admin (bug #0001486) [Tom] - Staticpage Topic Selection (bug #0001462) [Tom] - Span-X plugin: Spam Number of Links (SNL) True, Posted many links users are blocked. (bug #0001516) [Tom] - Delete account oauth (bug #0001417) [Tom] - Can save a staticpage with Add To Menu enabled but no label (bug #0001542) [Tom] - Space as decimal separator (bug #0001537) [Tom] - Replying to a Comment and inputing the incorrect captcha code results in page in a page (bug #0001527) [Tom] - Deleting a Comment with a Notification fails (bug #0001529) [Tom] - CC setting should be an admin option (patch #0001259) [Tom] - Date validation in advanced search (patch #0000853) [Tom] - Can not handle Breadcrumbs in custom function mytheme_createHTMLDocument (bug #0001531) [Tom] - Update Topic Control Description in Admin Article Editor about Inherit (feature request #0001489) [Tom] - Clicking on a user name causes a fatal error (bug #0001514) [Tom] - Can't edit plugin comment submissions (bug #0001511) [Tom] - User comment submission does not get deleted. (bug #0001512) [Tom] - nl2br breaks the HTML compliance (patch #0001141) [Tom] - Spam-X SFS default change to OFF (feature request #0001488) [Tom] - Twitter OAuth login Authentication error (bug #0001497) [Tom] - Trackback SQL Error (bug #0001498) [Tom] - Articles Feeds should only be updated when needed (feature request #0001501) [Tom] - JavaScript error in admin/story.php (bug #0001496) [Yoshinori] - Default Topic for Article with Multiple Topics is always Used for Anonymous Users (bug #0001487) [Tom] - Add HTML 5 DOCTYPE (feature request #0001426) [Yoshinori] Dec 30, 2012 (1.8.2) ------------ - A remote service user now bypasses current password check when account is deleted (bug #0001417) [Tom] - Fixed Twitter OAuth login error after Twitter deactived some old URLs (bug #0001497) [Tom] - $dbconfig_path was not escaped in the install script (bug #0001457, patch provided by mystral-kk) - COM_stripslashes will now handle arrays; this was a problem during re-authentication after a security token expired (bug #0001413) [suprsidr] - The comment count for a story could be wrong if there was a different object with the same id and a comment (bug #0001414) [Tom] - Feeds with the full story text still had a '...' at the end (bug #0001431) [Jeff Rivett, Tom] - Allow MIME type application/x-gzip-compressed when uploading a plugin for installation (bug #0001405) [Dirk] - Fixed compatibility with MySQL 5.5 (bugs #0001410, #0001456). This also raises the minimum supported MySQL version to 4.1.2 [Dirk, Tom] Oct 2, 2012 (2.0.0rc1) ----------- - You can create a new topic with the same id as another topic (bug #0001472) [Tom] - Feed Editor Field "Header-link in topic" Displays None and All Selections Twice (bug #0001481) [Tom] - Error when switching themes (bug #0001473) [Yoshinori] - Config Options for Page Navigation (feature request #0001474) [Tom] - When upgrading Staticpages Plugin for Geeklog 2.0.0 Topic Assignments are not set properly (bug #0001475) [Tom] - Autotags works at block always without Denim (bug #0001471) [Tom] - The part of the page navigator should do markup by a list. (feature request #0001422) [Tom] - Staticpage Template page should display Access Denied message (bug #0001468) [Tom] - Calendar plugin install sql zipcode size is too small (feature request #0001449) [Tom] - Get rid of the ereg functions (patch #0000967) [Tom] - Rework COM_siteHeader and COM_siteFooter (feature request #0001358) [Yoshinori] - "More ..." link in the configuration doesn't work in IE6-7 (bug #0001466) [Tom] Jul 13, 2012 (2.0.0b2) ------------ - rescue.php: add to $config array (feature request #0001463) [Tom] - Crash with multi-lingual setups (bug #0001465) [Yoshinori] - Theme: professional_css and modern_curve: Comment submit button always display (bug #0001464) [Yoshinori] - Staticpage Menu items only visible to logged-in users (bug #0001461) [Tom] - Page title inconsistency when anonymous users submit (bug #0001458) [Tom] - They can have a block and page headers and footers as blankpage will make a static page to indexpage (bug #0001460) [Tom] - Fails to upgrade Geeklog with MySQL-5.5.x (bug #0001456) [Tom] - $dbconfig_path is not escaped (bug #0001457) [Tom] - Use of microsummaries (bug #0001455) [Dirk] - add sub-topics (feature request #0001175) [Tom] - Breadcrumb Root not to use Site Name (feature request #0001454) [Tom] - Multiple breadcrumbs in stories (bug #0001441) [Tom] - PUBLIC_HTML/index.php?display=microsummary (bug #0001451) [Tom] - Typo in function name: SEC_hasConfigAcess (bug #0001446) [Dirk] - PUBLIC_HTML/index.php?topic=aaaa (bug #0001452) [Tom] - Bugs crash site and to enable multiple languages (bug #0001450) [Dirk] - Default Topic for new articles is not selected (bug #0001448) [Tom] May 24, 2012 (2.0.0b1) ------------ - Created the function COM_createHTMLDocument which replaces COM_siteHeader and COM_siteFooter (feature request #0001358) [Dengen] - Fixed issue with $_CONF['left_blocks_in_footer'] and hiding the blocks (bug #0001316) [Dengen] - Created a new theme called denim which is based on Responsive Web Design [Dengen] - Created a new theme called modern_curve which will eventual replace the professional theme (feature request #0001255) [Rouslan] - Added Emergency Rescue Tool written by Suprsidr to Geeklog Install [Tom] - Fixed path issue and changed the order of loading the jQuery css files in the Scripts class (bug #0001439) [Tom] - Improve strength of password hashing (feature request #0001384) [Vinny] - Add IP Address to entries in error.log [Tom] - Allow markup on page navigation (feature request #0001422) [Tom] - Failure when trying to report sitemap.xml write error (bug #0001412) [Vinny] - List dynamic blocks on admin blocks page (feature request #0001434) [Tom] - Admin Database command fails (bug #0001404) [Dirk] - DB Backup fails with MySQL 5.5 or later (bug #0001410) [Dirk] - Gravatar Image Requests (feature request #0001435) [Dirk] - Can't install plugin by uploading a tarball from a browser in Windows. (bug #0001405) [Dirk] - Feed items truncated when Length of entries is 1 (bug #0001431) [Tom] - Comments Form on same page as story (patch #0000728, provided by dengen) - Allow Topics to have child Topics [Tom] - Allow other objects to be associated to Topics (feature request #0001155) [Tom] - Allow objects like Articles, Blocks and Staticpages to be associated with more than one Topic [Tom] - CC setting should be an admin option (patch #0001259) [Tom] - Delete account OAuth (bug #0001417) [Tom] - When saving a Poll in the admin interface the vote count gets reset (bug #0001419) [Tom] - Scripts class including theme's style.css (bug #0001407) [Tom] - Query failed: Syntax error "AS dateFROM" (bug #0001418) [Tom] - Add $_CONF['linktext_maxlen'] to story configuration panel (patch #0001139) [Tom] - Add Breadcrumb Support (feature request #0001062) [Tom] - Configuration Copyright Year can only accept a number (bug #0001416) [Tom] - Articles, Blocks, Topics and Core Plugins do not handle a Group being Deleted (bug #0001397) [Tom] - Stripslashes() expects parameter 1 to be string, array given lib-common.php line 5754 (bug #0001413) [Tom] - Comment Count maybe off for Story after Comment Submission (bug #0001414) [Tom] - Improved logging of SQL errors to include the function name and line number (feature request #0001377) [Dirk] - Add Stop Forum Spam and Spam Number of Links Modules to Spam-X (feature request #0001378) [Tom] - Hardcoded strings in Spam-X plugin (patch #0000656) [Tom] - Added support for MySQLi (patch #0001303, provided by mystral-kk) Oct 9, 2011 (1.8.1) ----------- - Fixed exact match censoring option (bug #0001392) [Tom] - Fixed adding elements to empty Configuration arrays (bug #0001396) [Tom] - Blank out OAuth consumer key and secret in rootdebug dumps [Dirk] - Fixed deleting elements from Configuration arrays (bug #0001394, patch provided by dengen) - Avoid censoring in What's Related block (bug #0001393) [Tom, Dirk] - Fixed error message display in admin's user editor when renaming the userphoto failed [Dirk] - Don't display details of a failed MS SQL query by default [Dirk] - Updated Japanese language file, provided by the Geeklog.jp group Sep 11, 2011 (1.8.1rc1) ------------ - Updated jQuery version to 1.6.3 [Tom] - Fixed user passwords getting lost when saved from User Admin form (bug #0001385) [Tom] - Plugins can now set $_SCRIPTS in plugin_getFooter function (bug #0001383) [Tom] - Attempts to display the user profile of the Anonymous user will now be redirected to the site's main page (cf. bug #0001372) [Dirk] - Fixed some warnings raised by PHP 5.4 (statically calling non-static methods, get_magic_quotes_gpc() being deprecated) [Dirk] - Fixed [code] and [raw] tags no longer escaping content properly (bug #0001368) [Dirk] - The {contributedby_anchortag} variable now includes a rel="author" attribute [Dirk] - Fixed display of center block staticpage if a staticpage template is used (bug #0001370) [Tom] - The admin's user editor no longer loses changes when an error occured (cf. bug #0000653) [Dirk] - Fixed text direction issue with the paths listed on success.php (bug #0001219) [Dirk] - Don't display story edit icon when the user doesn't have all the necessary permissions (bug #0001210) [Dirk] - Fixed uploading topic images when $_CONF['path_images'] was changed (bug #0001268) [Dirk] - Fixed [staticpage_content:] autotag returning empty string for consecutive calls (bug #0001266) [Dirk] - Fixed form action URLs in Calendar templates (patch #0001360, provided by mystral-kk) - Fixed images not being displayed in story previews (bug #0001367) [Dirk] - Fixed backslashes in comment titles when magic_quotes_gpc = On (bug #0000941) [Dirk] - Removed comment title from the URL to submit a comment (feature request #0001031) [Dirk] - Expiry of the security token caused PHP static pages to be escaped (bug #0001230) [Dirk] - New Dutch language file for the Spam-X plugin, provided by Zippo - Updated French language files, provided by Ben Jun 12, 2011 (1.8.0) ------------ This release includes the results from the 2010 Google Summer of Code project to improve the Configuration (input validation, searching), implemented by Akeda Bagus. Changes since 1.8.0rc2: - Fixed a path disclosure through JavaScript [Tom] This issue was present in all previous 1.8.0 betas and release candidates, so upgrading those to the final 1.8.0 is strongly recommended! - Updated Italian translation for $LANG_VALIDATION [Rouslan] - Updated Japanese language files and documentation, provided by the Geeklog.jp group Jun 2, 2011 (1.8.0rc2) ----------- Changes since 1.8.0rc1: - Fixed translation errors in the German, Serbian, and Slovenian language files that affected the input validation for the Configuration [Dirk] - Fixed updating the bundled plugins when upgrading from a Geeklog version older than 1.5.0 (bug #0001354) [Dirk] - Fixed incomplete / corrupted siteconfig.php file after an update (bug #0001353) [Dirk] - Suppress a warning in the XMLSitemap plugin when using an unsupported character set [Dirk] - Fixed plugin update using a cached version of the plugin's old functions.inc (bug #0001345) [Dirk] - Fixed plugin update option not reacting for some users (bug #0001344, patch provided by dengen) - Fixed a wrong table lock that triggered an SQL error when sending a comment notification email (cf. bug #0000939) [Vinny] - Static Pages plugin function plugin_getiteminfo_staticpages did not always return correct data (bug #0001342) [Tom] - Fixed Calendar week view date range display on Windows (bug #0001340) [Tom] - Tweaked font size in Calendar (feature request #0001329) [Tom] - Updated Japanese language file, provided by the Geeklog.jp group May 8, 2011 (1.8.0rc1) ----------- Changes since 1.8.0b2: - Speed up template class (patch #0001302, provided by mystral-kk) - Fixed wrong characters in Slovenian UTF-8 language file (fix provided by gape) - LinkedIn OAuth uses full names for the username now [Dirk] - Facebook OAuth uses full names for the username now [Tom] - Various HTML fixes (patch #0001333, provided by dengen) - Removed array_flip() calls from English language files (feature request #0001336) [Rouslan] - Fixed tooltip flicker (bug #0001337, patch provided by dengen) - Added missing $LANG_VALIDATION['between'] language file entry [Rouslan] - Fixed OAuth and OpenID accounts logging out after 2 minutes of inactivity (bug #0001334) [Tom] Apr 25, 2011 (1.8.0b2) ------------ Changes since 1.8.0b1: - Fixed post mode being switched when plain text comment was previewed or edited (bug #0001324) [Tom] - Sanitize OAuth user data (bug #0001322) [Dirk] - Fixed HTML errors in Configuration (bug #0001318, patch provided by dengen) [Tom, Rouslan] - Added nowrap style to some admin templates for consistency (feature request #0001321) [Tom] - Fixed check for wrong edit permission in the Calendar plugin (bug #0001317, patch provided by dengen) - Added missing jQuery widgets and effects (bug #0001312) [Tom] - Fixed missing / in the setJavaScriptFile method (bug #0001315) [Tom] - Display a warning when JavaScript is required but disabled, e.g. in the comment form with advanced editor enabled (bug #0001282) [Tom] - Make sure tooltips are always fully visible (bug #0001304) [Rouslan] - Added missing images/right_arrow.png for the OpenID login form (bug #0001311) [Rouslan] - Don't load style.css if the theme doesn't use it (bug #0001309) [Rouslan] - Fixed nesting of forms in profile.thtml (bug #0001296) [Tom] - Fixed plugin install issue with plugins that did not support tabs (bug #0001305) [Tom] - Fixed validation of Configuration list entries with numerical values (bug #0001298) [Tom] - Fixed use of mb_strlen() instead of MBYTE_strlen() in the validator class (bug #0001299, patch provided by mystral-kk) - Updated Japanese language files and documentation, provided by the Geeklog.jp group Apr 3, 2011 (1.8.0b1) ----------- - Added a COM_newTemplate function to allow overriding template instantiation (feature request #0001220, patch provided by Joe Mucchiello) - Fixed the "Mail user" form to not lose all filled-in values when an error occured (bug #0001270) [Rouslan] - Clean up images directory and added new icons (bug #0001276) [Tom, Rouslan] - Added support for OAuth remote authentication, provided by Hiroshi Sakuramoto, and added re-syncing of remote user data (feature request #0001191) [Tom] - Updated bigdump.php (as used in the install script's Migrate option) to the latest version (feature request #0001143) [Rouslan] - Removed dependency on JavaScript from some admin pages (feature request #0001243) [Rouslan] - Added support to check version dependencies with plugins and Geeklog, and plugins with other plugins (feature request #0001154) [Rouslan] - Check database requirements before installing a plugin (feature request #0001288) [Rouslan] - Using fopen() to locate a plugin's icon may not provide the expected result (bug #0001265) [Rouslan] - A story's bodytext doesn't need to be evaluated when displaying the site's index page (patch #0001204, provided by LWC) - The status of the "Send me a copy of this email" option was lost when the form wasn't filled out correctly (bug #0001240, patch provided by Rouslan Placella) - Database backup files > 2GB prevented displaying the list of db backup files on some 32 bit systems. Added some workarounds (bug #0001257) [Dirk] - Fixed replacing the [imageX] tags when changing a story's id (bug #0001256) [Dirk] - Fixed logging of SQL errors during the startup phase [Dirk] - The load order of plugins is now configurable (feature request #0001247, patch provided by Rouslan Placella) - The list of plugins is now sortable by status (patch #0001249, provided by Rouslan Placella) - Added a PLG_getFooterCode function and corresponding {plg_footercode} variable in footer.thtml. This will allow plugins to add code to a site's footer, e.g. to load JavaScript code as late as possible (based on patch #0000906, provided by hiroron) [Dirk] - COM_onFrontpage didn't work correctly when called from a theme's functions.php (bug #0001254, patch provided by mystral-kk) - Introduced COM_versionCompare() to compare Geeklog version numbers, since they can't be compared using the PHP version_compare() function (feature request #0000866, patch provided by Rouslan Placella) - When importing RSS feeds, accept a non-permanent guid as a link if there is no dedicated link element, as long as the guid looks like a URL [Dirk] - Added a noindex robots meta tag to printable story pages so they aren't indexed by search engines [Tom] - Autotags in Templates may not always display (bug #0001246) [Tom] - Handle $bulkimport flag in the CUSTOM_userCreate() sample code in lib-custom.php (bug #0001208) [Dirk] If you are using your own CUSTOM_userCreate(), please check that you handle this flag (set to true when doing a Batch User Import) correctly! - Set minimum required PHP version to PHP 5.2.0 and removed all code that ensured compatibility with PHP 4 (feature request #0001217) [Dirk] - Minor optimization and code cleanup in CMT_saveComment (bug #0000939) [Vinny] - Added a proper copyright header and license text (LGPLv2) to the template class (feature request #0001128) [Dirk] - Fixed check for availability of PECL::ZipArchive in the unpacker class (bug #0001209) [Dirk] - Added in Autotag usage permissions and descriptions. Allowed HTML now displays autotag descriptions as tooltips (feature request #0001042) [Tom] - Added in COM_Tooltip function for displaying tooltips [Tom] - Moved handling of the [story:] and [user:] autotags to lib-story.php and lib-user.php, respectively (preparations for feature request #0001115) [Dirk] Calendar Plugin --------------- - Fixed a minor display issue in the batchdelete.thtml (patch #0001244, provided by Rouslan Placella) Links Plugin ------------ - Fixed encoding of link categories in URLs (bug #0001173) [Tom] Note: This fix changes the URLs of categories with spaces in their names from using a '+' sign to using '%20'. - Fixed text above the list of links, which was referring to a menu entry that no longer exists (bug #0001216) Polls Plugin ------------ - Updated the default poll (feature request #0001277) [Rouslan] - Fixed voters do not get counted correctly when updating a poll with multiple questions. (patch #0001056, provided by Erisco) Static Pages Plugin ------------------- - Removed unwanted piece of HTML on "empty" static pages (bug #0001192) [Rouslan] - Added a noindex robots meta tag to printable pages so they aren't indexed by search engines [Tom] XMLSitemap Plugin ----------------- - Removed an unused xmlsitemap.edit permission that existed in some installs (left by all fresh installs with Geeklog version 1.6.0 through to 1.7.0) [Dirk] Feb 20, 2011 (1.7.2) ------------ Note: This will be the last Geeklog version to work on PHP 4. We will provide security fixes for this version until 2012. Future versions of Geeklog will require PHP 5.2.0 or later. For details, please see http://www.geeklog.net/article.php/end-of-php4-support - PostgreSQL fixes: * It wasn't possible for several Geeklog instances to share a Postgres database (bug #0001251) [Rouslan] * Fixed dbSave [Dirk] * Fixed error reporting [Dirk] * Fixed compatibility with PHP 4 [Dirk] - Fixed replacing the [imageX] tags when changing a story's id (bug #0001256) [Dirk] - Fixed Static Pages plugin to work with PHP 4 (bug #0001239) [Tom] Jan 2, 2011 (1.7.1sr1) ----------- This release addresses the following security issue: Aung Khant of the YGN Ethical Hacker Group reported an XSS in the admin's configuration panel. Oct 31, 2010 (1.7.1) ------------ - Fixed description of $index parameter for STORY_renderArticle (bug #0001203) [Dirk] - The number of successfully imported users was always reported as 0 for the "Batch Add" option in the User Manager (bug #0001211) [Ivy, Dirk] - Fixed a bug in the MS SQL changeDESCRIBE method to properly prefix the proper sql query string [Randy] - Updated Hebrew language files, provided by LWC - New Italian language files for the Links plugin, provided by Rouslan Placella - Updated Italian language files for the Static Pages plugin, provided by Rouslan Placella Calendar Plugin --------------- - Fixed an SQL error when returning search results for the Personal Calendar (bug #0001195) [Dirk] Oct 10, 2010 (1.7.1rc1) ------------ - If content from an Autotag produces another Autotag it will be executed (to a maximum of 5 times) [Tom] - Themes can now have their own display functions for the start and end of Blocks. (Feature #0001188) [Tom] - Reverted a change in 1.7.0 that would send a Content-Type header when calling COM_refresh since this conflicts with some plugins (e.g. the Forum) [Dirk] - Fixed wrong view after posting a comment on a poll (bug #0001080, patch provided by Wojtek Szkutnik) - Fixed language in the dropdown for the permanent cookie in the Configuration (bug #0001117, patch provided by Eric Brisco) - Added cancel and delete buttons to comment edit and submission forms when needed. (Feature #0000981) [Tom] - Reverted parts of the changes for bug #0001057: Do _not_ escape curly braces when displaying a block's content (bug #0001156). If you run into the problem that words in curly braces inside blocks are interpreted as template variables, simply add a space after the opening and/or the closing brace [Dirk] - Autotags can now be inserted directly into template files. (Feature #0001181) [Tom] - Plugins are able to control moderation and return a string to be displayed. (Feature #0000619 patch provided by jmucchiello) - Admin lists can now display a 0 in a column instead of being blank (bug #0001060 patch provided by jmucchiello) - Fixed "Show & Hide Boxes" option in My Account (reported by Pushkar) [Dirk] - Display the topic name (instead of the topic id) in the list of draft stories (bug #0001171) [Dirk] - Fixed COM_formatTimeString to correctly handle intervals bigger than 4 weeks (bug #0001158) [Dirk] - Call PLG_templateSetVars for the Advanced Search form [Dirk] - Make sure we keep the current status of the user's Advanced Editor option even when Advanced Editor is disabled for the site (Thanks, Markus) [Dirk] - Comment submissions for plugins were missing the type [Dirk] - In the Group Editor, hide the 'Apply "Default Group" change' option until the state of the "Default Group" checkbox changes (feature request #0001116, patch provided by Dushyant Tiwari) - Fixed handling of $LANG_DIRECTION in the install script (cf. bug #0000871) - Fixed query highlighting in articles - didn't work for queries that contained characters filtered by COM_applyFilter [Dirk] - Updated Japanese language file, provided by the Geeklog.jp group - New and updated French (France) language files, provided by Ben - Updated Hebrew language file for the Links plugin, provided by LWC Static Pages Plugin ------------------- - Call up the Advanced Editor when enabled (bug #0001147, patch provided by Samuel Leathers) - A Static Page can now be marked as a template and used by other Static Pages. (Feature #0001085) [Tom] May 9, 2010 (1.7.0) ----------- Geeklog 1.7.0 now supports PostgreSQL, implemented by Stan Palatnik during the 2009 Google Summer of Code. Changes since 1.7.0rc1: - Security: The autologin (using the long-term session cookie) was vulnerable to dictionary attacks. This issue was originally reported by Bookoo of the Nine Situations Group in one of his reports in April 2009 but apparently overlooked by the Geeklog Team. Thanks to geeklog.net user Jack for pointing this out. - Fixed a typo in the install check that prevented Geeklog from detecting if it was installed in a subdirectory (bug #0001148) [Dirk] - New and updated German language files, provided by Markus Wollschläger - New and updated Slovenian language files, provided by Mateja B. May 2, 2010 (1.7.0rc1) ----------- Changes since 1.7.0b1: - Fixed call to undefined function WS_makeId() when using very long story ids (bug #0001140) [Dirk] - Fixed cloning of a story (bug #0001127, patch provided by Eric Brisco) - The installation script now recommends setting permissions to 666 for files and 777 for directories that need to be writable (bug #0001126, patch provided by Eric Brisco) - Fixed dynamic renumbering of config items when an item is deleted (bug #0001074, patch provided by Eric Brisco) - Fixed COM_featuredCheck to ensure there's only one featured story on the front page [Tom] - Fixed Last 10 Comments display in user profiles [Tom] - Updated Estonian language file, provided by Artur Räpp - Updated Hebrew language files, provided by LWC - Updated Italian language files, provided by Rouslan Placella - Updated Japanese language files and documentation, provided by the Geeklog.jp group - Updated Slovak language files, provided by Miroslav Fikar Calendar Plugin --------------- - Added call to PLG_itemPreSave to support the CAPTCHA plugin (feature request #0001091) [Dirk] Links Plugin ------------ - Added call to PLG_itemPreSave to support the CAPTCHA plugin (feature request #0001091) [Dirk] - Fixed wrong speedlimit warning when not all required fields are filled in when submitting a link [Dirk] - Treat the pre-populated partial link URL "http://" as if no URL was submitted and prevent it from being used in the spam check [Dirk] Polls Plugin ------------ - Fixed MS SQL upgrade (bug #0001144) Spam-X Plugin ------------- - Removed 'admin_override' entry from language files (bug #0001114) Static Pages Plugin ------------------- - Fixed Page Title when Advanced Editor is enabled (bug #0001113) Apr 4, 2010 (1.7.0b1) ----------- - Fixed paths for image upload in FCKeditor (bug #0000931) and disabled Flash upload [Dirk] - Updated FCKeditor to version 2.6.6 [Dirk] - Raised minimum required PHP version to PHP 4.4.0 [Dirk] - Fixed an old bug that would create a new topic when you tried to change the topic ID [Stan, Dirk] - Introduced an optional page title for stories (feature request #0001096, patch provided by Vlad Voicu) - A new right called htmlfilter.skip allows user groups to skip any html filtering on posts (feature request #0000952) [Tom] - Allow empty database passwords only for local installs (bug #0000923, patch provided by Chetan) - New Plugin API PLG_getWhatsNewComment for adding comments from plugins to the Whats New Block and the User Profile page (feature request #0000835) [Tom] - Truncated stories in Feeds now will have any open html tags closed. (bug #0000749) [Tom] - Introduced a [user:] autotag that links to a user's profile (feature request #0001081, patch provided by Akeda Bagus) - The "Users" entry in the Admins block now displays the number of active users only, i.e. it only counts users that logged in at least once [Dirk] - Fixed display of list of allowed HTML tags and available autotags in advanced story editor mode (bug #0001020, patch provided by Chetan) - Fixed sort by date in search results (bug #0001002) [Sami] - Since we can now re-authenticate expired security tokens, we don't need to display the token expiry notice any longer. Exception: Users who logged in through OpenID can't re-authenticate and will still get the message [Dirk] - Block Names can no longer be empty [Dirk] - When you had more than 50 blocks per side, disabling a block on one page of the block list would also disable all blocks on all the other pages of the list (reported by cesar) On closer inspection, the same effect could also be triggered when using the list's search or dropdown to only display a certain amount of entries. The same problems also existed in the lists for Feeds, Plugins, and Weblog Directory Services. All fixed now [Dirk] - Fixed links to comment pages (bug #0001061) [Tom] - Improved comment readability by adding a paragraph tag around "Plain Old Text" comments and some padding in threaded mode (bug #0000833) [Dirk] - Hide the "Logout" link when editing a comment or comment submission (bug #0000893) [Dirk] - CR and LF are now removed from the submitted password when a user logs in (for bug #0000799) [Dirk] - Changed the label for the $_CONF['disable_autolinks'] config option to read "Disable Autotags" and updated the documentation (bug #0000912) [Dirk] - Allow Spam-X to skip filtering of submitted content from certain user groups (feature request #0001018) [Tom] - Changed the 'gravatar_rating' config option to a dropdown since it only supports four options anyway [Dirk] - For anonymous comment submissions, use "Your Name" instead of "Username" in the comment submission form (feature request #0001039) [Dirk] - CUSTOM_group_change() was being called with wrong parameters (bug #0001051) [Blaine] - Added clickjacking protection for the printer-friendly version of articles [Dirk] - When a login is required to view some part of the site, we now display a login form. This replaces the simple "Login required" message [Dirk] - Hide "New user" option from "Login required" form when new user registration is disabled (bug #0000933) [Dirk] - Show the block name in the list of blocks (feature request #0000819) [Dirk] - Added an option (under My Account > Layout & Language) for users to select whether they want to use the Advanced Editor or not. The option is on by default but only available when Advanced Editor has been enabled in the Configuration (feature request #0000984) [Dirk] - Added support for textarea input fields in the Configuration (feature request #0000905) [Dirk] - Blocks could not contain words in curly braces as they were mistaken for template variables (bug #0001057) [Dirk] - Allow groups to be marked as a Default Group. New users will automatically be added to all default groups (feature request #0000798) [Dirk] - Make sure all onclick events in the Configuration return false (bug #0001054) - Moved hard-coded sort direction indicator (asc/desc) for search results to the language files [Dirk] - Changed the 'default_perm_cookie_timeout' config option to a dropdown so that it's consistent with the "Remember me for" dropdown in My Account [Dirk] - Raised minimum required MySQL version to MySQL 4.0.18 [Dirk] - Fixed a non-feature where canceling out of the story editor would select that story's topic in the admin's list of stories [Dirk] - Fixed problem uninstalling plugins - missing globals (bug #0001048) - Added an option to create a copy of a story (feature request #0000811) [Dirk] - Prepare database for storing IPv6 addresses (feature request #0000971) [Dirk] - Implemented re-authentication when trying to submit a form with an expired security token. This will allow the user to save changes even when the token has expired [Dirk] - Hide meta tag entry fields from the Story and Topic editors when meta tag support is disabled [Dirk] - Fixed topic selection for the Daily Digest (bug #0001041, patch provided by Ben) - Changed the 'menu_elements' and 'notification' config options to dropdowns since there's only a fixed number of keywords that these two options recognize [Dirk] - Fixed delete option for dynamically added config options: Back in 1.5.1, we renamed our JavaScript remove() function to gl_cfg_remove() but forgot to update the dynamically created function calls (cf. bug #0000681) [Dirk] Calendar Plugin --------------- - Added support for a CAPTCHA in the submission form (bug #0001091, patch provided by tuxcanfly) - Fixed an old bug in the event submission form: The text of the "Submit" button must match the text $LANG12[8] to be recognized. Changed the form to always use that string instead of the one from the Calendar plugin's language file (originally reported by kokaku in 2006(!) and again by Tereso Ramos in 2010). Links Plugin ------------ - A link to an invalid Link Category could lead to an endless loop for users with Links Admin permissions (bug #0001090; reported and patch provided by Akeda Bagus) - Allow autotags in the Links and Link Category description (feature request #0001079, patch provided by Akeda Bagus) - Added support for a CAPTCHA in the submission form (bug #0001091, patch provided by tuxcanfly) - Added a link to "New category" from the Links editor [Dirk] - Fixed localization of "Root" category (bug #0001047) [Dirk] Polls Plugin ------------ - Added What's New Block Support for Polls and Poll comments (feature request #0000835) [Tom] - Poll Topics now have a created and a modified date (bug #0000761) [Tom] - Fixed display of the edit icon in the Poll block - didn't check for polls.edit permissions (but wouldn't let you edit the poll) [Dirk] - Fixed wrong "access denied" message when attempting to view comments on a poll that the user is not allowed to view (bug #0001044) [Dirk] - Fixed comment bar Refresh button (bug #0001044) [Dirk] - Hide meta tag entry fields from Polls editor when meta tag support is disabled [Dirk] Spam-X Plugin ------------- - Fixed "Edit IP of URL Blacklist" module (bug #0001102, reported and patch provided by Abhishek Shrivastava) - A new right called spamx.skip allows SPAM-X to skip filtering of submitted content from certain user groups (bug #0001018) [Tom] - Make sure the Notification Email config option can be disabled [Dirk] - List $_CONF['site_url'] as a non-editable entry in the SLV whitelist to indicate that the site's URL is whitelisted automatically [Dirk] Static Pages Plugin 1.6.2 ------------------- - Introduced an optional page title for static pages (feature request #0001096, patch provided by Vlad Voicu) - Fixed SQL error in the search when multi-language support was enabled (bug #0001099) [Dirk] - Added What's New Block Support for Static Page comments (feature request #0000835) [Tom] - Added modified date column. What's New Block Support for Static Page now allows you to use created or modified date [Tom] - Added clickjacking protection for the printer-friendly version [Dirk] - Fixed SQL compatibility with MS SQL (bug #0001050) - Added a draft flag (feature request #0000884) [Dirk] - Removed the sp_uid field since it's simply a duplicate of owner_id [Dirk] - Display number of comments in Static Page editor [Dirk] - Fixed wrong "access denied" message when attempting to view comments on a page that the user is not allowed to view (bug #0001043) [Dirk] - Fixed comment bar Refresh button (bug #0001043) [Dirk] - Hide meta tag entry fields from Static Page editor when meta tag support is disabled [Dirk] - Avoid a pair of empty brackets on the printer-friendly version for Static Pages which have comments disabled [Dirk] - Added a config option to define the default sort order for the admin's list of Static Pages (feature request #0000812) [Dirk] - Made the initial size of the Static Pages edit area (when using FCKeditor) larger (feature request #0001037) [Dirk] - If a page does not exist and the user has staticpages.edit rights, send them to the Static Page Editor (feature request #0000975) [Dirk] - Added a Comment Default config option (feature request #0000966) [Dirk] - Added support for query highlighting [Dirk] Jan 2, 2011 (1.6.1sr2) ----------- This release addresses the following security issue: Aung Khant of the YGN Ethical Hacker Group reported an XSS in the admin's configuration panel. May 9, 2010 (1.6.1sr1) ------------ This release addresses the following security issue: The autologin (using the long-term session cookie) is vulnerable to dictionary attacks. This issue was originally reported by Bookoo of the Nine Situations Group in one of his reports in April 2009 but apparently overlooked by the Geeklog Team. Thanks to geeklog.net user Jack for pointing this out. Nov 22, 2009 (1.6.1) ------------ Changes since 1.6.1rc1: - It wasn't possible to email a user via their profile page - checked the wrong field for '@' characters (cf. bug #0000992; reported by rayleigh) [Dirk] - Fixed use of wrong constant in unpacker.class.php [Blaine] - Updated the age-old help texts and added help files for comment and user submissions as well as the draft stories list [Dirk] - The success message at the end of the install recommended setting db-config.php and siteconfig.php to 755. These files don't need to be executable, so recommend 644 instead (bug #0001036) [Dirk] - Updated Estonian language files, provided by Artur Räpp - Updated German language files, provided by Markus Wollschläger - Updated Japanese language files, provided by the Geeklog.jp group Static Pages Plugin ------------------- - Content in curly braces in a static page was mistaken for template variables in the static pages editor (bug #0001038) [Dirk] - Added missing code to handle $_SP_CONF['includesearchcenterblocks'] and $_SP_CONF['includesearchphp'] options that was accidentally left out when merging Tom's patch [Dirk] - Removed reference to undeclared variable in SP_render_content (bug #0001032) [Dirk] Nov 8, 2009 (1.6.1rc1) ----------- Changes since 1.6.1b1: - Moved hard coded green color for the search result byline (when using "Google" style) to the stylesheet (new class "searchresult-byline") [Dirk] - "Refine search" lost the status of the "Titles Only" checkbox [Dirk] Note: This fix requires a change in search/searchform.thtml - Improved display of the "Sort by" and "Show n results" dropdowns on the search results page (feature request #0000910) [Sami, LWC] - The search results page used HTML
tags even when XHTML was requested (bug #0001022, patch provided by taca) - Fixed wrong path reported in case of a missing 'data' directory (reported by Markus Wollschläger) [Dirk] - When a plugin returns 0 items for its entry in the Admins Block, don't display that as 'N/A' (bug #0001025) [Dirk] - Fixed a bug in the Group Editor that didn't let you add groups to other groups unless your $_TABLES['groups'] happened to be called "groups" (bug #0000998) [Dirk] - Updated Hebrew language files, provided by LWC Links Plugin ------------ - When URL rewriting is enabled, return rewritten URLs for search results [Dirk] Static Pages Plugin ------------------- - Fixed use of wrong CSS class for the entries for the What's New block [Tom] Nov 1, 2009 (1.6.1b1) ----------- - The user's time zone selection (from My Account) is actually used now [Dirk] - Modernized the "timezone hack", made the config option a dropdown, and moved all timezone-related code into a new TimeZoneConfig class [Dirk] - Fixed an old bug that could cause SQL errors when a user changed their "Show & hide boxes" settings [Dirk] - Searching by author threw an error on PHP 4 (bug #0001008) [Dirk] - Moved the functionality of the toinnodb.php script into the Database Backups admin panel [Dirk] - Added an option to optimze tables to the Database Backups admin panel [Dirk] - Added a notice about the expiry time for the security token (and the potential loss of changes) to most editors. This is meant as an intermediate step until we get around to updating the editors and provide a more user friendly solution. [Dirk] - Fixed display of text excerpt for search results on PHP 4 (bug #0001004) [Dirk] - The comment speed limit was being ignored (bug #0001003) [Dirk] - Added an icon to make the plugin update option somewhat more obvious [Dirk] (icon "stock_update-data.png" taken from Gnome 2.18 icon theme set by AMAZIGH Aneglus, released under the GPL) - Allow bigger values for a topic's Sort Order field (feature request #0001011) [Dirk] - When a Story Admin did not have permission to edit a story, Geeklog threw a "call to a member function on a non-object" error when trying to display a proper "access denied" message (reported by Chase and Cesar) [Dirk] - Allow external apps to contribute to search results (feature request #0000985) [Sami] - Remember current sort/limit in search results (bug #0001007) [Sami] - Don't display the comment form for a story when comments aren't enabled for it (bug #0000994) [Dirk] - Fixed a long-standing quirk of the submission handling where the "Submissions" entry in the Admins Block wasn't updated after accepting / rejecting a submission [Dirk] - Fixed creation of multiple plugin groups in plugin autoinstall [Randy, Dirk] - Added new option $_CONF['article_comment_close_enabled'] to enable/disable automatically closing stories for comments after a certain amount of days (bug #0000959). Changed handling of comment_expire field in gl_stories such that 0 means the story is always open for comments [Dirk] - The "Admin Group" checkbox in the Group Editor didn't work (bug #0000995, reported & fix provided by Tsuchi) - Setting $_CONF['article_comment_close_days'] to a high value (to work around bugs with the "Disable Comments" option in 1.6.0) may result in values outside of the range of the year dropdown for that option, in which case it reverted to the previous(!) year and caused comments to be closed immediately [Dirk] - When viewing your own profile page, you now get an "edit" link that takes you to "My Account" [Dirk] - Additional checks in "Mail Story to a Friend", "Send mail to user", and "Mail Users" dialogs to make sure users don't enter email addresses into the name fields (bug #0000992) [Dirk] - Added an option to send a copy to self to the "Mail Story to a Friend" dialog and made the look of this and the "Send mail to user" dialogs more consistent [Dirk] - Display the number of stories in the current topic in the Topic Editor (feature request #0000806) [Dirk] - Call CUSTOM_userCheck from admin/user.php (bug #0000925) [Dirk] - You can now have one featured story per topic (feature request #0000750, patch provided by Tom Homer) - Changing the Post Mode in Advanced Editor mode selected the wrong tab (bug #0000980, patch provided by dengen) - Made the former $cc parameter for COM_mail an optional array of additional email headers (using a string for that parameter still works as CC:) [Dirk] - Fixed reply notification for the very first comment (bug #0000973) [dengen, Dirk] - When an anonymous commenter left a name, use it in the comment notification email (bug #0000960) [Dirk] - Removed the CSRF token from all links to edit a comment. We only need it in the actual comment editor and it caused problems on the moderation page [Dirk] - For anonymous comments, use the anonymous user's name from the database, not from the language file (cf. bug #0000960) [Dirk] - The session and password cookies are now created with the HttpOnly flag set to make it somewhat harder to read them from JavaScript (requires browser support) [Dirk] - Fixed visibility of the "Send Ping" links in the Story Admin's list of stories and the Story Options block [Dirk] - The install script was switching back to English in some upgrade scenarios (bug #0000969, patch provided by taca) - Added a workaround to not lose the XMLSitemap priorities for Locales where the comma is used as the decimal separator [Dirk] - Keep track of actual upper/lowercase spelling of plugin names in the XMLSitemap plugin [mystral-kk, Dirk] - Added support for a CUSTOM_renderMenu function when rendering the top menu (feature request #0000845) [Dirk] - In the install script, always open db-config.php and siteconfig.php in binary mode to avoid EOL character mixup on Windows (bug #0000730) [Dirk] - Avoid SQL error with certain db dumps during migration (bug #0000955) [Dirk] - Plugin migration was only called when the plugin also needed an upgrade (bug #0000947) [Dirk] - The Migrate option in the install script now also works on an existing database (feature request #0000945) [Dirk] - Comment notifications used the phrase "Read the full article" when pointing to the new comment post (bug #0000940) [Dirk] - Send correct content type and character set header in the install script (bug #0000964, patch provided by taca) - The "Remember Me For" option under My Account did not recognize the "(don't)" option any more (bug #0000961) [Dirk] - Send a notification when a comment goes into the submission queue [Dirk] - Added a link back to the story to the "Mail Story to a Friend" form [Dirk] - Only list [code], [raw] tags when story.* permissions are required [Dirk] - [page_break] was not listed when all HTML was allowed for Root users [Dirk] - Added support for meta tags and meta keywords, provided by Tom Homer - When an error occurs in bigdump.php (during migration) keep the selected language when sending the user back to migrate.php (bug #0000943) [Dirk] - Use COM_getUserDateTimeFormat, i.e. the user's preferred format, for displaying the date and time in search results [Dirk] - When disabling a feed, delete the feed file [Dirk] - Moved leftover hard-coded text from admin/sectest.php to the language files [Dirk] - When creating Pingback excerpts, convert the other site's content to our site's character set, when necessary [Dirk] - New function COM_getTextContent converts HTML into continuous text. Used for a more accurate "read more" count for articles and to improve the text excerpts for search results and pingbacks [Dirk] - Use COM_numberFormat to format the number of registered and anonymous users displayed in the Who's Online block [Dirk] - Use $LANG_ADMIN['na'] instead of hard-coding 'N/A' in several places [Dirk] - For Remote Users, display their service name in the User Editor [Dirk] Calendar Plugin 1.1.1 --------------- - Keep track of the user id for submitted events (bug #0000993) [Dirk] - Reintroduced {event_begin_anchortag} and {event_end_anchortag} variables in event.php [Dirk] - The number of hits for an event was reset when editing the event [Dirk] - When cloning an event, the number of hits for the clone should be 0 [Dirk] - Avoid triggering a false spam report when submitting an event with the default "http://" entry for the link still in place (bug #0000946) [Dirk] Links Plugin ------------ - Display the number of links in the current category in the Category Editor. Note: Does not (yet) count links in sub-categories [Dirk] - Link titles in autotags showed up with backslashes before quotes (bug #0000986) [Dirk] Polls Plugin ------------ - Fixed display of the Polls block when it only contained polls not visible for anonymous visitors (bug #0000996) [Dirk] - When upgrading from Geeklog 1.5.2, the length of the poll IDs was not extended to 40 characters - only fresh installs of Geeklog 1.6.0 and upgrades from older versions worked correctly (cf. feature request #0000754) [Dirk] - Added support for meta tags and meta keywords, provided by Tom Homer - Introduced [poll:], [poll_vote:], and [poll_result:] autotags, allowing to embed polls where autotags are allowed, provided by Tom Homer Static Pages Plugin 1.6.1 ------------------- - Certain types or all Static Pages can now be excluded from the search results (feature request #0000979, provided by Tom Homer) - New and updated Static Pages are now listed in the What's New block (feature request #0000908, provided by Tom Homer) - Fresh installs of the plugin in Geeklog 1.6.0 accidentally used a wrong name for the plugin's admin group. Silently fix that during the upgrade [Dirk] - Made the list of pages sortable by author (feature request #0000978) [Dirk] - List available autotags in the static pages editor [Dirk] - Added support for meta tags and meta keywords, provided by Tom Homer Aug 30, 2009 (1.6.0sr2) ------------ This release addresses the following security issue: - Unauthorized file uploads were possible through FCKeditor. Uploaded files still had to go through FCKeditor's filter, so it was not possible to upload scripts (and the integrity of the Geeklog site as such was not in danger). There were, however, reports that this was used to host malware. This update prevents use of the upload feature when FCKeditor is disabled and disables it for anonymous users. It also doesn't allow uploading of archive files any more. Furthermore, you need some sort of "edit" permission now to be able to upload files through FCKeditor (this is meant as an interim measure - we will probably introduce a separate "upload" permission in future Geeklog versions). Not security-related: - Fixed installation using InnoDB tables [Dirk] - Links plugin: Fixed wrong function name in the autoinstall.php file (bug #0000954) - Fixed an SQL error (due to a missing global declaration; not exploitable) when the commentcode field was auto-updated (reported by Jokke_K) [Dirk] This release also includes updated Hebrew (provided by LWC) and German language files. Jul 30, 2009 (1.6.0sr1) ------------ This release addresses the following security issues: - Gerendi Sandor Attila reported an XSS in the forms to email a user and to email a story to a friend. - The "Mail Story to a Friend" function didn't check story permissions, so that it was possible to email a story even if you didn't have the permissions to view it on the site. Not security-related: - Fixed an SQL error (due to a non-initialized variable; not exploitable) when the story submission queue was off (reported by Dieter Thomas) [Dirk] - Fixed calls to a nonexistent function COM_outputMessageAndAbort (should have been COM_displayMessageAndAbort) [Dirk] Jul 19, 2009 (1.6.0) ------------ Geeklog 1.6.0 incorporates the following projects implemented during the 2008 Google Summer of Code: + Site migration support and easier plugin installation, by Matt West + Improved search, by Sami Barakat + Comment moderation and editable comments, by Jared Wenerd Changes since 1.6.0rc2: - Updated language file for formal German, provided by Markus Wollschläger - Updated Japanese language file and documentation, provided by the Geeklog.jp group Jul 12, 2009 (1.6.0rc2) ------------ Changes since 1.6.0rc1: - Updated FCKeditor to version 2.6.4.1 [Dirk] - Fixed advanced search not using start and end dates (bug #0000924, patch provided by dengen) - Fixed auto-detection of table prefix during migration when the SQL dump contained CREATE TABLE IF NOT EXISTS requests (bug #0000922) [Dirk] - When an error occurs in bigdump.php (during migration) send the user back to migrate.php (bug #0000919) [Dirk] - Fixed warning in migration script when no backups are available (bug #0000918, patch provided by hiroron) - Updated Estonian language files, provided by Artur Räpp - Updated Hebrew language files, provided by LWC - Updated Japanese language files and documentation, provided by the Geeklog.jp group Jun 28, 2009 (1.6.0rc1) ------------ Changes since 1.6.0b3: - Fixed include path for db-config.php in bigdump.php (bug #0000915) [Dirk] - Improved detection of UTF-8 database dumps in migration (bug #0000916) [Dirk] - Fixed typos in the install script (bugs #0000913 and #0000914) [Dirk] Jun 21, 2009 (1.6.0b3) ------------ Changes since 1.6.0b2: - Fixed IE6 and Safari compatibility issue with sort and limit combo boxes in search results (part of bug #0000874) [Sami] - Fixed HTML in the Configuration (bug #0000907) [Dirk] - Added a more prominent reminder to remove the install script [Dirk] - Made the link to a comment's parent object from the comment bar work properly for plugins [Dirk] - Allow searching by topic (without a query string) again (reported by Markus Wollschläger) [Dirk] - Fixed handling of $_CONF['comment_close_rec_stories'] (bug #0000899) [Dirk] - Improved selection of text portion displayed in search results [Dirk] - Fixed an error that occured after deleting a trackback [Dirk] - Replace autotags in search results (bug #0000887) [Dirk] - Don't insist on an email address when editing a Remote User (bug #0000885) [Dirk] - Added a config option to send an X-FRAME-OPTIONS HTTP header to prevent "clickjacking" (requires browser support) [Dirk] - Prevent XSS in the install script (reported independently by Nemesis and MaXe) [Dirk] - Removed old plugin API function plugin_commentsupport from the Calendar, Polls, and Static Pages plugins [Dirk] - Updated Japanese language files and Japanese documentation, provided by the Geeklog.jp group Calendar plugin --------------- - Fixed leap year check [Sean Clark] Polls plugin ------------ - Implemented PLG_getCommentUrlId [Dirk] - Update polls comments when changing a poll's ID so the comments don't become orphaned (part of bug #0000901) [Dirk] Static Pages plugin ------------------- - Another attempt to fix a compatibility issue with PHP 4 (parse error) [Ben, Dirk] - Implemented PLG_getCommentUrlId [Dirk] - Update static pages comments when changing a page's ID so the comments don't become orphaned (part of bug #0000901) [Dirk] - When deleting a static page, also delete its comments (bug #0000901) [Dirk] XMLSitemap plugin ----------------- - Add the Polls plugin to the sitemap by default (part of bug #0000898) [Dirk] - When manually adding or removing plugins, automatically add/remove corresponding entries for priority and frequency (part of bug #0000898) [Dirk] May 31, 2009 (1.6.0b2) ------------ Changes since 1.6.0b1: - Various fixes to the new search (work in progress) [Sami] - The list of Comment Submissions now tries to provide a link to a comment's parent object (article, poll, ...). If not available, it displays an excerpt from the comment [Dirk] - Plugin comments lost their type when being saved in the comment submission queue (they were treated as comments on stories) [Dirk] - SQL errors now trigger the standard error handler ("Unfortunately, an error has occurred ..."). Details are available in error.log, as usual [Tony, Dirk] - Removed the $_CONF['search_no_data'] config option and moved the text to the language files (bug #0000873) [Dirk] - All bundled plugins now include a check to see if they support the DBMS the site is running on [Dirk] - A fresh install didn't check if the bundled plugins are compatible with the Geeklog version about to be installed [Dirk] - Users couldn't change their password or delete their account (reported by Tom Homer) [Dirk] - Fixed plugin postinstall from the install script [Dirk] - Made COM_createImage recognize https:// URLs (bug #0000881) [Dirk] - Fixed notices in the config class (reported by tgc and others) [Dirk] - Fixed empty entries in the "Type" dropdown on the Advanced Search page. Requires an updated search/searchform.thtml template (part of bug #0000874) - Ensure PLG_templateSetVars (and therefore CUSTOM_templateSetVars) is called properly when the "Skip Preview" option is disabled (bug #0000880) [Dirk] - Fixed handling of multi-byte encoded texts when limiting the content of feed entries to a certain amount of characters (reported by alank) [Dirk] - Added a verbose logging option to the search class and make it default to off [Dirk] - lib-custom.php was missing from the 1.6.0b1 tarball - Updated Spanish language file, provided by Juan Pablo Novillo Polls plugin ------------ - Display a message when a plugin comment is queued [Dirk] - If you knew a poll's ID, you could find out the poll's title even if you did not have access to the poll [Dirk] - Fixed (mostly) blank page when calling up a non-existing poll ID (reported by scarecrow) [Dirk] Static Pages plugin ------------------- - Display a message when a plugin comment is queued [Dirk] - Fixed handling of "entire page" centerblocks in a multi-language environment: Need to allow one per language (reported by Norbert Ortmann) [Dirk] - Fixed a typo that prevented the [staticpage:] autotag from working [Dirk] XMLSitemap plugin ----------------- - Added an option to exclude plugins from inclusion in the sitemap. Defaults to the Links plugin [Dirk] - Remove sitemap files when uninstalling the plugin [Dirk] - Don't include Links in the sitemap.xml automatically [Dirk] - Fixed "missing argument 2" error when changing config options (reported by Markus Wollschläger) [Dirk] May 1, 2009 (1.6.0b1) ----------- - New XMLSitemap plugin that creates a XML sitemaps file as supported by all major search engines, provided by mystral-kk - Don't allow to add/remove users to/from the All Users and Logged-in Users groups via the group editor (bugs #0000863 and #0000864) [Dirk] - Cosmetic changes to the form to add/remove users to/from groups, for consistency with the other admin panels [Dirk] - Document where CUSTOM_templateSetVars is actually called from (bug #0000862) [Dirk] - Added option to search by titles only (feature request #0000840) [Sami] - The "Plugins" entry in the Admins Block now displays the number of enabled plugins (previously included the disabled plugins) [Dirk] - Added a config option to enable/disable automatically turning URLs in text postings into clickable URLs [Dirk] - Changed some default settings [Dirk]: * Webservices are now disabled * Cronjob emulation is off * Default sort for topics is alphabetically * Default comment mode is nested These settings are _not_ changed when upgrading from an earlier version. - Experimental: Compress HTML output before sending it to the browser (disabled by default; has to be supported by both the browser and the webserver) [Dirk] - Added canonical link for article directory [Dirk] - Moved hard-coded texts from admin/sectest.php to the language files (bug #0000716) [Dirk] - Added an option to send a copy of the email to a user to self (feature request #0000771, based on a patch by Roshan Singh) - COM_checkList would use the table name for the name of the checkbox array in the HTML(!). Added a new parameter for the name (pointed out by Bookoo in the exploit for usersettings.php, cf. Geeklog 1.5.2sr4) [Dirk] - Fixed wrong use of COM_allowedHTML and COM_checkHTML in plugins: Functions were called without specific permissions, so they defaulted to 'story.edit'. I.e. as a Story Admin, you could use the admin_html set in events, but as a Calendar admin, you could not ... (bug #0000785) [Dirk] - Added missing finish() calls for some templates, e.g. header.thtml (bug #0000855) [Dirk] - Moved documentation to docs/english so that it can be translated (feature request #0000770) [Dirk] - New plugin API function PLG_pluginStateChange [Dirk] - Fixed dropdown for the "censor mode", which has more than the two options offered previously (bug #0000692) [Mike, Maciej Cupial] - Slightly faster template class (feature request #0000760, patches provided by dengen and mystral-kk) - Use a more efficient implementation of Story::hasContent (bug #0000858, patch provided by Maciej Cupial) - Make sure formerly optional config items can be disabled (bug #0000846) [Dirk] - New plugin API function PLG_getDocumentationUrl (feature request #0000848) [Dirk] - Fresh installs + MySQL only: Changed some tinyint fields that are only used as flags to tinyint(1) from tinyint(3) (bug #0000857) - Fixed one of the predefined date format strings (bug #0000854) - Replace Wiki-style formatting in the Daily Digest and when emailing a story to a friend (bug #0000837, patch provided by Pawel Szczur) - New plugin API function PLG_configChange (feature request #0000694) [Dirk] - Fixed layout of Batch Add and Batch Admin options of the User Manager [Dirk] - On a login failure, the user registration form showed up even when new user registration was disabled (bug #0000843) - The Wiki-style format broke national special characters, e.g. Japanese and German umlauts (bug #0000823) [Dirk] - Introduced new plugin API function PLG_migrate [Dirk] - Allow switching the DOCTYPE from the Configuration. Requires a theme that uses {doctype} instead of a hard-coded DOCTYPE declaration (feature request #0000745) [Dirk] - The notification email about new user submissions didn't include information about the remote service used (if any) [Dirk] - Define {xmlns} when using XHTML for XHTML compliance. Updated header.thtml and article/printable.thtml template files to include that variable [Dirk] - Fixed wrong use of '&' when sending a trackback (bug #0000825) - Removed incomplete PDF generator (never enabled in any shipped version) [Dirk] - Fixed a problem with words being merged together in newsfeeds when the article was written with CR as the line separator [Dirk] - Made url rewriting work on setups that only set $_SERVER['ORIG_PATH_INFO'] (bug #0000816) - Fixed duplicate plugin entries when a plugin has more than one entry for the admin or user menu (bug #0000820) - {contributedby_user} and {contributedby_fullname} weren't set in the story templates (bug #0000821) [Dirk] - Reinstated old definitions of the {start_contributedby_anchortag}, {end_contributedby_anchortag}, and {contributedby_author} variables, i.e. the two anchortag variables are set again and _author contains the name only (bug #0000821) [Dirk] - Auto-deleting a story didn't delete trackbacks for that story [Dirk] - Ensure consistent template variable names for the Permission Editor [Dirk] - Added new permission 'group.assign', now required to be able to assign a user to a group. Part of the Group Admin (not User Admin) permissions by default (feature request #0000190) [Dirk] - Raised minimum required PHP version to PHP 4.3.0 and removed all workarounds that ensured compatibility with PHP 4.1.0 [Dirk] - Added a filename mask config option for the names of the database backups [Dirk] - Removed $_CONF['pagetitle'] hack. Use COM_siteHeader('menu', $pagetitle) instead [Dirk] - Added canonical link for articles [Dirk] - Moved hard-coded "Reminders" column title to the language file (bug #0000817) - Hide archive option radiobutton from the story editor when no archive topic is defined (feature request #0000807) [Dirk] - Display group names with an uppercase first letter everywhere [Dirk] - Added an ISO 8601-ish format to the gl_dateformats table [Dirk] - Let users with user.mail permissions only email groups that they are in themselves [Dirk] - Gave the Groups and User editors a facelift. Requires a new template file, admin/lists/inline.thtml [Dirk] - Introduced list of "advanced HTML" tags that are allowed when FCKeditor is enabled. Needed for images (bug #0000757) [Blaine] - Add new permissions plugin.install and plugin.upload for more fine-grained control to the plugin admin panel (bug #0000637) [Dirk] - Introduced new plugin API function PLG_itemDeleted [Dirk] - Changed API for PLG_itemSaved to make it simpler and easier to use [Dirk] - Updated FCKeditor to version 2.6.4 [Blaine] - Usersettings.php - can not change password when custom membership is enabled. Modified CUSTOM_userCheck to return both a error message string and Error code. Updated users.php and usersettings,php (bug #0000776) [Blaine] - Implemented extended API for PLG_getItemInfo [mystral-kk, Dirk] - Fixed inconsistencies and various small mistakes when displaying "Access denied" messages on the admin pages [Dirk] - Added a print.css stylesheet to be used by the printable template files (feature request #0000766) [Dirk] - Re-introduced the path hints in the install script when it can't find db-config.php [Dirk] - Added a note about the max. dimensions of a userphoto in the About You pane of a user's My Account page (feature request #0000629) [Dirk] - Display a message when no topics exist and don't let the user enter the story editors (bug #0000738) [Dirk] - Added a configuration option to control the JPEG quality (Feature request #0000720) [Dirk] - Updated Hebrew language file for the install script, provided by LWC - New Serbian (Latin) language files, provided by Aleksandar Scepanovic Calendar plugin --------------- - Added migration support [Dirk] - Removed extra double quote from upcoming events block (bug #0000827) - Added auto installation support [Dirk] - Added support for PLG_getItemInfo, PLG_itemSaved, PLG_itemDeleted [Dirk] Links plugin ------------ - Added migration support [Dirk] - Added category default permissions [Dirk] - Added auto installation support [Dirk] - Added support for PLG_getItemInfo, PLG_itemSaved, PLG_itemDeleted [Dirk] - Introduced function LINKS_getCategorySQL and fixed visibility of link categories in the Top 10 Links list and site statistics [Dirk] - Added an option to allow opening external links in a new window (feature request #0000693). Use with care, please [Dirk] - Only external links are marked with class="ext-link" [Dirk] Polls plugin ------------ - Added migration support [Dirk] - Set the page title when viewing a poll [Dirk] - Added auto installation support [Dirk] - Added support for PLG_getItemInfo, PLG_itemSaved, PLG_itemDeleted [Dirk] - Extended length of poll IDs to 40 characters (feature request #0000754) [Dirk] Spam-X ------ - Added migration support [Dirk] - Added auto installation support [Dirk] Static Pages plugin ------------------- - Added migration support [Dirk] - The printable.thtml template file now uses the {xmlns} variable [Dirk] - Added canonical link [Dirk] - Added auto installation support [Dirk] - Added support for PLG_getItemInfo, PLG_itemSaved, PLG_itemDeleted [Dirk] - The printable.thtml template file uses the HTML Strict doctype and print.css now [Dirk] - Display "successfully saved" and "successfully deleted" messages, just like every other plugin and built-in function does (bug #0000644) [Dirk] May 9, 2010 (1.5.2sr6) ------------ This release addresses the following security issue: The autologin (using the long-term session cookie) is vulnerable to dictionary attacks. This issue was originally reported by Bookoo of the Nine Situations Group in one of his reports in April 2009 but apparently overlooked by the Geeklog Team. Thanks to geeklog.net user Jack for pointing this out. Jul 30, 2009 (1.5.2sr5) ------------ This release addresses the following security issues: - Gerendi Sandor Attila reported an XSS in the forms to email a user and to email a story to a friend. - The "Mail Story to a Friend" function didn't check story permissions, so that it was possible to email a story even if you didn't have the permissions to view it on the site. Apr 18, 2009 (1.5.2sr4) ------------ This release addresses the following security issue: Bookoo of the Nine Situations Group posted another SQL injection exploit, targetting an old bug in usersettings.php. As with the previous issues, this allowed an attacker to extract the password hash for any account and is fixed with this release. Apr 13, 2009 (1.5.2sr3) ------------ This release addresses the following security issue: Bookoo of the Nine Situations Group posted another SQL injection exploit, this time targetting the webservices API. As with the previous issue, this allowed an attacker to extract the password hash for any account and is fixed with this release. Not security-related: - Re-introduced function get_SPX_Ver in the install script, which is still needed when upgrading from old Geeklog releases (reported by Sheila) [Dirk] Apr 4, 2009 (1.5.2sr2) ----------- This release addresses the following security issue: Bookoo of the Nine Situations Group posted an SQL injection exploit for glFusion that also works with Geeklog. This issue allowed an attacker to extract the password hash for any account and is fixed with this release. Mar 30, 2009 (1.5.2sr1) ------------ This release addresses the following security issue: Fernando Munoz reported a possible XSS in the query form on most admin panels that we are fixing with this release (bug #0000841). Feb 8, 2009 (1.5.2) ----------- - The default replacement text for censored text was supposed to read "censored", not "censormode" [Dirk] - Fixed problem with extra backslashes appearing in a story's title during the story preview when magic_quotes_gpc = On (bug #0000790) [Mike, Dirk] - Added missing page title when viewing a single comment [Dirk] - Sort groups in the group dropdowns non-case sensitive [Dirk] - Display a message when sending the email to report an abusive comment failed [Dirk] - Display a message when sending the email for a new password failed [Dirk] - Updated Estonian language file for the Calendar plugin, provided by Artur Räpp - Updated Japanese language file, provided by the Geeklog.jp group Static Pages plugin ------------------- - Fixed parse error when saving a static page (reported by greenteagod). This problem was only introduced in 1.5.2rc1 [Dirk] Jan 24, 2009 (1.5.2rc1) ------------ - Fixed various issues with COM_makeClickableLinks (bug #0000767, #0000793, #0000796) [Sami] - The comment submission form didn't show the user's full name when $_CONF['show_fullname'] was enabled [Dirk] - Comments were always showing the username, even when $_CONF['show_fullname'] was enabled (reported and patch provided by mystral-kk, bug #0000800) - Fixed story preview losing the story when the sid already existed (bug #0000789) [Dirk] - Fixed wrong use of str_replace in STORY_extractLinks (bug #0000794) [Dirk] - Added "Send Pings" to the Story Options block (if enabled and allowed for the current user) [Dirk] - Don't let the user enable plugins when there's no functions.inc for the plugin [Dirk] - When the install script can't find db-config.php, that message was always displayed in English, i.e. you could not change the language for that screen [Dirk] - When upgrading from a Geeklog version prior to 1.5.0, the plugin config.php files are no longer renamed [Dirk] - Admin lists allowed non-sortable columns to be sortable (reported and patch provided by hiroron, bug #0000791) - Fixed STORY_getItemInfo - need to check the draft flag and for a publish date in the future [mystral-kk, Dirk] - Fixed wrong use of COM_isAnonUser in COM_getPermSQL (since 1.5.0) [Dirk] - When calling COM_getYearFormOptions with a $startoffset parameter, the list of years was off by one (bug #0000783; patch provided by hiroron) - Fixed updating feeds after changing topic permissions (bug #0000779) [Dirk] - The security token was missing from the trackback editor template file (reported and patch provided by hiroron, bug #0000778) - Removed rel="tag" from topic links in lib-story.php as that would indicate a Microformat with a slightly different meaning [Dirk] - Don't include X-Originating-IP header in emails sent from the site's admin area (bug #0000701) [Dirk] - Check if COM_errorLog exists before using it in the config class (for possible problems during installation, bug #0000768) [Dirk] - Fixed filling out the Site Email / No-Reply Email fields in the install script, which was overwriting the correct values from config.php during upgrades (bug #0000759) [Dirk] - Set language direction in templates for printable versions of articles and static pages. Also set $LANG_DIRECTION to 'ltr' now if the language file does not already define it (bug #0000762) [Dirk] - Removing an element from the middle of the censorlist caused the censoring to act up (bug #0000763) [Dirk] - Saving a story tried to update a feed of type 'geeklog' instead of 'article' (reported by Tom Homer) - Delete a feed's file when deleting a feed (bug #0000758) [Dirk] - When using gdlib, use imagecopyresampled instead or imagecopyresized to scale images. This should result in better image quality (part of Feature request #0000720) [Dirk] - The {start_storylink_anchortag} variable in the story templates was missing a '>' (reported by Michael Brusletten) [Dirk] - Display a "Service" column in the Admin's list of users when remote auth is activated [Dirk] - Introduced new function COM_showMessageText to display a free-form text in a "System Message" box (feature request #0000676) [Dirk] - Introduced new function COM_showMessageFromParameter for easy and consistent display of messages passed in the URL, including plugin messages (second attempt to fix bug #0000618) [Dirk] - Display confirmation message when emailing a story (feature request #0000689) [Dirk] - Implemented new function COM_renderWikiText to convert wiki-formatted text to (X)HTML (feature request #0000643) [Dirk] - Added support for CUSTOM_formatEmailAddress and CUSTOM_emailEscape functions (feature request #0000727) [Dirk] - Fixed 'cookiedomain' being reported as changed in the Configuration (bug #0000638) [Dirk] - Reverted fix for bug #0000618 (COM_showMessage automatically picking up a 'plugin' parameter) as it's causing problems when displaying more than one message on the same page [Dirk] - Added missing check for allowed IP addresses in downloader class (bug #0000709) [Dirk] - Force a refresh after uninstalling a plugin so that the plugin's entry disappears from the Admins block [Dirk] - Fixed an issue with story expiry dates on PHP 4/Windows (reported by zeb) [Mike] - Updated Hebrew language file for the install script and Spam-X plugin, provided by LWC - Updated Japanese language files, provided by the Geeklog.jp group - Updated Polish language files, provided by Robert Stadnik - Updated Slovenian language file for the Links plugin, provided by gape Calendar plugin --------------- - Fix for calendar plugin - unable to add personal event [Blaine] - Make {event_url} available in eventdetails.thtml [Dirk] Links plugin ------------ - Missing parentheses my have resulted in incorrect search results [Dirk] - Added urlencoded versions of {link_actual_url} and {link_name} [Dirk] - Prevent overwriting existing links when changing the link ID [Dirk] Polls plugin ------------ - Lowered the default number of questions per poll to 5 and the number of answers per question to 8 to avoid running into Suhosin's default post.max_vars limit (for new installs only) [Dirk] - Fixed SQL error when poll questions contained single quotes (bug #0000756) [Dirk] - Fixed handling of poll IDs in Polls editor (bug #0000753) [Dirk] Static Pages plugin ------------------- - The owner of a static page changed to the user who last edited it (bug #0000777) [Dirk] - Fixed call to WS_makeId when sp_id was longer than STATICPAGE_MAX_ID_LENGTH (found by Marc Maier) [Dirk] Sep 22, 2008 (1.5.1) ------------ - Fixed protection against direct execution in various include files which may have failed on non-case sensitive file systems (reported by Mark Evans) [Dirk] - Saving a story as someone other than the owner will revert the story to your ownership. (bug #0000742) [Mike] - Fixed searching for non-installed plugins when open_basedir restrictions are in effect (bug #0000741) - Fix for first change of password issue (bug #0000724) [Mike] - Fixed failure to switch language with new query highlighting URLs (bug #0000733) [Dirk] - Fixed bug with HTML Encoding of default comment title for articles (bug #0000737) [Mike] - Fixed another case where a duplicate of a story submission was left in the submission queue after approving the story [Mike] - Fixed problem with the MySQL class not recognizing UTF-8 when the character set name was written in uppercase (bug #0000731) [Dirk] - Updated Hebrew language files, provided by LWC - Updated Estonian language files, provided by Artur Räpp - Updated Japanese language files, provided by the Geeklog.jp group - Updated Slovenian language files, provided by gape Sep 7, 2008 (1.5.1rc1) ----------- - Added missing slash in the install script (bug #0000715) [Dirk] - CSRF token not passed to draft list (bug #0000726) [Ted Powell] - If root debugging is enabled, hide anything in the array stack that has a key containing 'cookie' or 'pass'. And added option to override this. (bug #0000722) [Mike] - Prevent direct execution of the FCKeditor upload script (reported by t0pP8uZz) [Dirk] - Renamed the "Restore" option in the Configuration to "Enable" [Dirk] - Provided better error handling for database backups (bug #0000714) [Mike] - Provided auto-detection of -left and -right overrides for any given block template. This allows any block to auto-style to left and right for themes without the need for the theme to work it out, or talk to the database. ("Bug" #0000684) [Mike] - Fixed handling of corrupted config value db entries, e.g. after importing Calendar event_types with the wrong character set (bug #0000690) [Dirk] - Fixed handling of HTML entities in the Configuration (bug #0000710) [Sami, Dirk] - Story image upload: Only add a link to the unscaled image if such an image actually exists [Dirk] - Removed unused code from lib-story.php [Dirk] - COM_siteFooter no-longer creates two sets of right blocks. (bug #0000698) [Mike] - Microsummaries work in topics, reported by Joe. [Mike] - Added DB_checkTableExists and changed INST_checkTableExists to use it. [Mike] - Changed REPLACE INTO for DB_save for MSSQL compat [Mike] - Re-introduced function get_SP_Ver in the install script, which is still needed when upgrading from old Geeklog releases (reported by libexec) [Dirk] - Fixed issue where you can post a comment to an unpublished story (bug #0000705) [mystral-kk/Mike] - Fixed make clickable links with quotes (bug #0000691) plus truncated long urls. [Sami] - Fixed table prefix issues with constraints (bug #0000702) [Mike/Sami] - Fixed error when attempting to highlight a search query that contained a slash [Dirk] - Updated FCKeditor to v2.6.3 [Blaine] - Moved remove() (config JavaScript) to gl_cfg_remove (bug #0000681) [Mike] - Change for CUSTOM_usercreate to support passing in $batchimport, set true if called via the Admin->Users Batch_Add [Blaine] - Fix for date formatting in RSS fields (bug #0000696) [mystral-kk] - A small tweak to the Professional theme's commentbar to make the "Post a comment" option easier to find [Dirk] - Renamed the syndication feed type "geeklog" to "article" since that's what they are nowadays [Dirk] - New option "All Frontpage Stories" for article feeds: skip stories that have the "Show only in topic" option set (feature request #0000652) [Dirk] - If there is a feed for a topic, there will now be a "Subscribe to ..." option in the Story Options block for every story for that topic (feature request #0000154) [Dirk] - Cop-out fix for bug #0000671: Don't display the icon for external links when the text direction is 'rtl' (e.g. Hebrew) [Dirk, Mike] - Keep letter case intact when highlighting a search query string (patch provided by Sami Barakat) - Provide nicer URLs to story search results when URL rewriting is enabled (bug #0000665, based on a patch by Sami Barakat) [Dirk] - Better support for plugin messages (bug #0000618) [Blaine] - Introduced new variable {page_title_and_site_name} for header.thtml so that we can have "Site Name - Site Slogan" in the frontpage's title again [Dirk] - Fixed SQL error(s) for story submissions by users with story.submit but no further Story Admin permissions (reported by Orion) [Dirk] - End a user's session when they are being banned [Dirk] - Signatures in HTML-formatted comments weren't XHTML compliant [Dirk] - Minor cleanups in style.css - no actual layout changes (bug #0000683) [Dirk] - Allow creation of banned users, i.e. ban the user on account creation [Dirk] - Minor improvements in the error handling, e.g. preventing Geeklog from creating error.log files outside the logs directory [Dirk] - Send a HTTP status code 503 "Service Unavailable" when the site is disabled [Dirk] - Hide the database password when the database backup failed and we're logging the mysqldump command [Dirk] - Disable OpenID login when new registrations are disabled [Dirk] - Allow to unset Configuration options again after they have been "restored", i.e. enabled (bug #0000664) [Dirk] - Adopted hack to allow multilingual blocks (bug #0000626) [Dirk] - Fixed SQL error in story submissions (reported by Chase) [Mike] - Stories with a publishing date in the future and stories with the draft flag set were accessible if you knew their story id (bug #0000678) [Mike] - Enabled siteconfig.php to override database config in core, primarily for rootdebug. [bug 0000673] [Mike] - Allow remote users to use the webservices (bug #0000640). Due to the authentication method it is not possible for OpenID users to use the webservices. Other remote users will have to use username@servicename for their username when logging in through the webservices [Dirk] - Fix to template.class to better handle full path being passed in [Blaine] - Updated PLG_uninstall to supress errors for table drop. [bug 0000668] [Mike] - Fixed INST_checkTableExists for MS SQL Support. [bug 0000668] [Mike] - Hardcode an ltr div around HTML tags in the allowed html tag list. Plus minor HTML compliance issues. [bug 0000669] [Mike] - Plaintext stories have nl2br applied in syndication feeds to provide correct formatting in feed readers. [bug 0000662] [Mike] - Changed SEC_createToken so that it will only return one token per page (effectively making it a singleton). This fixes the problem of not being able to delete comments when you also have trackbacks for the same article [Mike, Dirk] - Approving a story submission by saving it from the Admin's story editor left a duplicate in the submission queue, unless you changed the story ID at the same time [Dirk, Mark Evans] - Fixed user submission queue (reported by greenteagod) [Dirk] - Updated Hebrew language files, provided by LWC Calendar plugin --------------- - Fixed tags in the German language files for the Calendar [Dirk] - Fixed date comparison ("End date is before start date.", bug #0000703) [Dirk] - Fixed Admin delete links in day and week view (bug #0000680) [Dirk] - Search for an event's "author" didn't work [Dirk] - Calendar block now includes events from the current day (in progress or all day events, bug 0000604, patch from forums) (really) [Mike] Links plugin ------------ - Fixed passing the category on multi-page link lists [Dirk] - Fixed new category silently overwriting an existing category if they had the same id (part 2 of bug #0000659) [Dirk] - Fixed SQL error when trying to change a category id to an already existing id (part 1 of bug #0000659) [Dirk] Polls plugin ------------ - For multi-question polls, make the "Vote" button read "Start Poll" in the polls block (bug #0000633) [Dirk] - Fixed display of "Results" link while a poll is open [Dirk] Static Pages plugin ------------------- - Menu entries were not language-aware (in multi-language setups), i.e. all the menu entries were always displayed (bug #0000713) [Dirk] - Removed unused 'config_data' entry from the plugin uninstall function (bug #0000666) [Dirk] - Fixed printer friendly version of a static page not working when url_rewrite is enabled (bug #0000661) [Dirk] June 15, 2008 (1.5.0) ------------- Geeklog 1.5.0 incorporates the following projects implemented during the 2007 Google Summer of Code: + New user-friendly install script by Matt West + New Configuration GUI (replacing config.php) by Aaron Blankstein + New Webservices API based on the Atom Publishing Protocol by Ramnath R. Iyer Changes since 1.5.0rc2: - Users that used a different theme than the site default would see the site switch temporarily back to the site's default theme when changing a config option. This was a side effect of the fix for bug #0000648 [Dirk] - In a tradeoff between security and convenience, we decided to go with security: The install script will no longer display the database credentials from db-config.php. The downside is that you will have to enter them again when doing a database upgrade or re-running the install (reported by Mark Evans) [Dirk] - Links plugin: The word "Root" wasn't taken from the language file for the page title of the public list of links (reported by Markus Wollschläger) [Dirk] - Fixed remaining places where the Admin panels had inconsistent layouts: Calendar list of events, Polls editor (bug #0000650) [Dirk] - Updated Hebrew language file, provided by LWC - Updated German language files, provided by Markus Wollschläger - Some Korean language files had a mixture of CR/LF and LF as line separators (bug #0000655) [Dirk] June 8, 2008 (1.5.0rc2) ------------ Changes since 1.5.0rc1: - Hide the | separator for static pages with page format "blank page" (reported by Tetsuko Komma) [Dirk] - Hardcoded all URL entry fields in the templates and the date selection in the calendar plugin to dir="ltr" (reported by LWC) [Dirk] - Fixed handling of UTF-8 languages in the install script (reported by Tetsuko Komma) [Dirk] - Ensure consistent display of the admin lists (bug #0000650) [Dirk] - Sanitize the language in the install help (reported by Mark Evans) [Dirk] - Moved the hard-coded CSS for the System Message to the stylesheet [Dirk] - Added a workaround for the Yulup Atompub client that sometimes sends Text nodes within XHTML nodes [Dirk] - Made the Install / Upgrade buttons in the install script a bit wider to provide more space for the Japanese and German translations [Dirk] - Fixed bug #0000647: All modifications of usersettings should go through CUSTOM_usercheck [Blaine] - Removed hard-coded