Release prep 1.0.6pl4

SECURITY: Fixed several XSS vulns reported by Secunia, mostly in Private Messaging. Also backported CSRF protection API from 1.1.x, and protected Private Messaging and logout functions.

Retagged current-stable

Tagged release: 1.0.6pl3

Version bump to 1.0.6pl3 (the real release number)

Version bump to 1.0.6pl2

SECURITY: Fix SQL injection in banlist check

Tagged release: 1.0.6pl2

SECURITY: Multiple XSS in Special:ChangeStyle. Reported by Mesut Timur of Mavituna Security - thanks!

Fixed a couple non-security sanitizer and editor bugs

Updated current-stable tag

Stable release: Enano CMS 1.0.6pl1

Fixed lockup on unclosed HTML tags in wikiformat_process_block()

Version bumped to v1.0.6pl1

SECURITY: Comments: fix poor sanitization of subject on initial submit

Merging nighthawk and scribus branches

Fixed typo in function call to check for apache 2.2

Added license block to AmigaLink captcha engine and set this engine as the default; clarified licensing situation for this module in licenses/index.html

Updated current-stable tag

Re-merged 1.0.6 tag

Continuation of previous commit in admin CP; EditSidebar: updated strings to be more accurate (thanks again Vadi)

Pageutils: Also delete page-specific ACL rules when deleting a page (thanks Vadi)

SECURITY: Enforce denied history_view on previous revisions

Removed some crufty CSS classes in enano-shared (thanks Vadi)

Stable release: Enano CMS 1.0.6 (Roane)

Updated readme for Roane

Rebrand as v1.0.6 (Roane)

Merging branches

SECURITY: Fix XSS under IE in closing tags (shared sanitizer)

Minor fix to OS detection in install

Plugins can now register their own custom actions for $_GET["do"]. (Backport from unstable)

Stable release: Enano CMS 1.0.5 (Ferrishyn)

Remove some unused/obsolete release tags

[cosmetic only] lowercase release name in installer splash

Made UX for Windows patch more pleasant including external documentation. Breaking change to dynamic download script.

Updated readme for Ferrishyn

Fixed sanitization of full page IDs with accidental parse of escaped hex character in dirtify_page_id(). Thanks Asterion; see http://forum.enanocms.org/post/20/

Fixed IPv6 address match (the one from phpBB3 did not work)

Fixed SQL parse errors caused by conversion to \r\n by some FTP/zip clients (hackish workaround that isn't Enano's fault)

Forgot to update, merging heads from nighthawk and scribus

Redid tags to match version numbers; only latest release will be tagged as such from now on. Hopefully Mercurial registers this.

Upgrade from 1.0.4 -> 1.0.5 now tolerates errors in user -> user_id transition in tags table

Tagging revision 290 (72ecb951b313) as release, it was never done before.

Backported customizable 404 page from unstable (thanks Vadi); made customizable 404 page have a {STANDARD404} variable available to allow embedding the "default" 404 content.

RNG now uses /dev/urandom instead of /dev/random to fix slowdowns during login. Potentially not as secure, but speed problems on some servers were of blocker severity.

Merging scribus and nighthawk branches

Fixed jBox hover event reference to undefined object

Fixed E_STRICT under PHP 5 and 6 (reference operator in instanciation)

Merging in page['visible'] patch from unstable, pages marked as invisible should now be omitted from searches

Tagging latest revision as rebrand

Rebrand as 1.0.5 (Ferrishyn)

Fixed (again) the user -> user_id transition in enano_tags table

Fixed aclScopeSel control in Safari/KHTML

Added enforced warning about PHP4

Filled and updated out the README for 1.0.4

Backporting cron fixes from unstable

Allowed uppercase characters to be used in the database name (thanks Andrew)

Fixed PHP warning in Rijndael RNG code when open_basedir restriction in effect

Tagging latest revision as rebrand

Rebrand as 1.0.4 (Ellyyllon)

Fixed: RenderMan::getPage() failing with access denial when fetching template and view_source results in deny

Made all captcha fields case-insensitive (thanks pkeating)

Merging scribus and nighthawk branches

Fixed jBox menus failing to appear when window scrolled down

Fixed special pages being returned with subpage information inappropriately from $paths->get_pageid_from_url()

Fixed case where HTML comments were getting stripped when opening tag not followed by whitespace (<!--foo--> was stripped, <!-- foo --> was not, neither is stripped now)

Re-applying the revision with the comment fix (bad merge a couple revs back)

Fixed case where HTML comments were getting stripped when opening tag not followed by whitespace (<!--foo--> was stripped, <!-- foo --> was not, neither is stripped now)

Merging in a couple revisions from Nighthawk

Fixed case-sensitive file extensions

Fixed broken regenCaptcha() in Special:Register

Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

Removed all PostgreSQL support from the installer as per http://enanocms.org/News:1200114064; installer support for Postgres is available in the 1.1 branch now

PHP4 fix: sidebar missing in installer UI: problem was wrongly named constructor for templateIndividualSafe

Fix undefined E_STRICT under PHP 4; add PHP 4 deprecation notice in admin panel

Installer works again now (for MySQL only)

Adding a few stray files and removing the no-longer-needed Creative Commons Attribution 2.0 license (no more libraries under that license are included with Enano); adding hooks pageprocess_render_{head,tail} to be run before and after the final page render, respectively.

Integrating patch for PHP 6.0-dev compatibility

Fixed search indexer causing duplicate keys when two "words" of 64+ characters encountered and first 64 characters are the same (thanks Vadi); attempt to fix onunload confirmation during page editing

Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)

Fixed: $paths->page_id not set when the page doesn't exist; finally fixed garbled page names for IP addresses

Merging in a few stray changes from the MySQL branch

A number of updates to the graphing code (it should actually work now)

Many changes. Installer with PostgreSQL is broken badly and will be for some time.

Set Content-type on AJAX login key request to application/json to hopefully block ad injection

SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON

Stable release: Enano CMS 1.0.3 (Dyrad)

Tagging latest revision for rebrand

Rebrand as 1.0.3 (Dyrad)

SECURITY: CRITICAL: Fix SQL injection in admin CP page editor

Fixed focus of AJAX login form fields in IE; removed stale/unused call to $template->makeParserText() in paginate_array(); added hook page_create_request to possibly help control creation of pages of certain namespaces from plugins; fixed critical bug in user CP that prevented plugins from adding custom CP modules

Improved physical pages: they support comments and have their own dedicated namespace now. Still some consistency fixes to make.

Deprecated debugConsole and removed all calls to it. Added a lot of comments to common.php. Added support for "anonymous pages" that are created when the Enano API is loaded from an external script. Fixed missing border-bottom on Type 2 sidebar blocks in Oxygen.

Fixed: sanitation loop on ampersands in encodeAttribute() (this was MediaWiki's fault)

Stable release: Enano CMS 1.0.2 (Coblynau)

Dummy revision to artificially increment build number

Fix missing dependency on search.php in upgrade script

Detagging release due to stupid upgrade fix

Stable release: Enano CMS 1.0.2 (Coblynau)

How could I forget the TRADEMARK SIGN?

Updated artwork with finalized new/revised logo; finalized upgrade schema

Add installer pop-help topic for URL scheme, in response to http://forum.enanocms.org/viewtopic.php?f=5&t=19

Oops, never merged in updates from ee1fc84f12a8 (240)

Hopefully now all calls to escape() are replaced with ajaxEscape() in response to Tomasz's forum post; remove deprecated version of show_category_info() from functions.php

SECURITY: Tighten default allowed file types; make sure search index rebuild is performed on upgrade

Final development freeze for release: 1.0.2 (Coblynau); only critical bugs fixed until GA

Add warning in installer for PHP < 5.2.0; hopefully fix validation of e-mail addresses with dashes

Nothing special. ksort()ing list of allowed filetypes in the admin panel to make editing the list marginally easier

Added OpenDocument MIME types and extensions; make sql_report page show total time taken for SQL queries

Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long

A couple of minor tweaks to the upgrade schema; tests pending

The template-cache incompatibility bug has finally been isolated, so a function to clear the template cache was added into the upgrade script for 1.0.2