Unstable alpha release: 1.1.3 (Caoineag alpha 3)

Oops - had unneeded debug message in installer

[Security] made session manager have some degree of IP validation for session keys and upgrades

Fixed session validation bug in upgrade script; fixed non-object reference in template_nodb

Added safety against re-defining constants in dbal

Update readme for imminent 1.1.3 release

Hopefully completed rewrite and localization of rollback backend and interface

Added a cron task to sessions.php that deletes old admin keys once a week

Added $no_wrapper parameter to die_semicritical, useful for some upcoming PageProcessor tweaks.

Localized some remaining login bits

Fixed bad style update during theme uninstall.

Upgraded to TinyMCE 3.0.3; made editor auto-init again but only on Safari

Fixed $db->die_json(), should now produce standards-compliant output.

Changed TinyMCE init to run only on demand. Highly experimental.

Added modal dialog support for page editor; added customizability for breadcrumbs (thanks to Manoj for idea)

Implemented password reset (albeit hackishly) into the new login API; added dummy window.console object to hopefully reduce errors when Firebug isn't around; fixed the longstanding ACL dismiss/close button bug; fixed a couple undefined variables in mailer; fixed PHP error on attempted opening of /dev/(u)random in rijndael.php; clarified documentation for PageProcessor::update_page(); fixed some logic problems in theme ACL code; disabled CAPTCHA debug

Implemented all security features on theme disabling and ACLs; added clean_key mode to login API to clean unused encryption keys

[minor] fix version number on license block comment in common.php

Oops. Forgot to add the themepreview.png file which is a dummy icon for themes that don't include screenshots. Also in last commit several changes weren't documented, including: Moved several page manipulation functions from PageUtils to PageProcess. Fixed debug message in l10n.js. Started switchover to new rollback API and log_id column replacing time_id as key.

Fixed the fact that cron just didn't work at all (brain fart that day or something)

Modifed EnanoMath layer by segregating it into its own file; got support for big_int PHP extension backend working

Fixed improper serializing of IP that could allow reusing of key from multiple IP addresses.

Finished theme manager to the point where it's in a working state in Firefox and hopefully IE.

Documented includes/plugins.php to try and help plugin developers a little.

Fixed some bugs with $paths->getParam() and $paths->get_pageid_from_url() when slashes are in the namespace prefix. Result of testing on Windows Vista + Apache 2.2. Using TortoiseHG

Minor standards-compliance fix in Request_HTTP

Fixed a number of IE6 bugs

Merging in changes from Nighthawk

Upgraded tinyMCE to 3.0.1 in hopes of fixing IE race conditions. Fixed a couple minor syntax errors in Javascript objects declared in various places.

Merging fixes and updates from stable branch

Fixed: RenderMan::getPage() failing with access denial when fetching template and view_source results in deny

Made all captcha fields case-insensitive (thanks pkeating)

Merging scribus and nighthawk branches

Fixed special pages being returned with subpage information inappropriately from $paths->get_pageid_from_url()

Fixed jBox menus failing to appear when window scrolled down

Fixed case where HTML comments were getting stripped when opening tag not followed by whitespace (<!--foo--> was stripped, <!-- foo --> was not, neither is stripped now)

Re-applying the revision with the comment fix (bad merge a couple revs back)

Fixed case where HTML comments were getting stripped when opening tag not followed by whitespace (<!--foo--> was stripped, <!-- foo --> was not, neither is stripped now)

Merging in a couple revisions from Nighthawk

Fixed broken regenCaptcha() in Special:Register

Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

Removed all PostgreSQL support from the installer as per http://enanocms.org/News:1200114064; installer support for Postgres is available in the 1.1 branch now

Fixed case-sensitive file extensions

PHP4 fix: sidebar missing in installer UI: problem was wrongly named constructor for templateIndividualSafe

Fix undefined E_STRICT under PHP 4; add PHP 4 deprecation notice in admin panel

Installer works again now (for MySQL only)

Adding a few stray files and removing the no-longer-needed Creative Commons Attribution 2.0 license (no more libraries under that license are included with Enano); adding hooks pageprocess_render_{head,tail} to be run before and after the final page render, respectively.

Integrating patch for PHP 6.0-dev compatibility

Fixed wrong images being used in installer formutils

Fixed broken installer due to bad $plugins object

Enabled strong compression on pwstrength.js as it causes problems otherwise in Opera

Added support for Diffie-Hellman key exchange during login. w00t!

And might as well add theme-manager.js while I'm at it.

Merging a stray change from Nighthawk (probably release tagging)

Can't believe I forgot to add ThemeManager.php.

[retag] Unstable alpha release: 1.1.2 (Caoineag alpha 2)

Detagging last release revision to merge in theme manager from Scribus

Started (but disabled) work on the new theme manager, 1.1.2 is being released with this thing halfway done.

Unstable alpha release: 1.1.2 (Caoineag alpha 2)

Updated readme file for 1.1.2 release

Merging Nighthawk and Scribus branches

Modernized Special:CreatePage.

Fixed typo in ban logic

Some memory usage improvements, I think. PHP is being weird to me.

Merging changes from scribus

Fixed user -> user_id transition for enano_tags table

Optimized JS aggressive-compression list a little more

Re-enabled, debugged, and optimized Javascript compression code

Unsuccessful attempt at fixing "dismiss"/"close manager" buttons in ACL editor; non-breaking change to template API to allow plugins to add "normal" sidebar widgets in addition to the special "raw" block type, specified as the third parameter to $template->sidebar_widget(). Defaults to false, which is old behavior; new behavior (enabled by passing TRUE as the 3rd param) means that the content of the block is primarily block-level links.

Fixed version-set on migration code (see the comments in the source for why) and added post-upgrade hooks.

Edit summary should now be carried over when a draft is restored

[Minor] Fixed obsolete trigger upon attempt at page save after draft autosave

OOPS: forgot to add the "save draft" icon

Added "is_draft != 1" where appropriate in SQL queries to prevent drafts from being treated as real revisions.

Added autosave functionality and resurrected the old toolbar code that was added about a year ago but never uesd.

Tagging latest revision as rebrand

Rebrand as 1.1.2; made upgrade framework functional

Added upgrade schema files for 1.1.1 -> current (1.1.2-dev)

Removed unused schema files

Modified editor and rename functions to go through the API when rolling back. This causes rollbacks to be logged.

Mass-fixed all AJAX functions to also check the HTTP status code before parsing the response

Added some basic timezone support; DST support is still to come.

[minor] re-enabled ENANO_DANGEROUS on install.php (oops!); made textarea in page editor focus automatically

Made the form validation icons (check/X/?) more visually appealing. IE-friendliness is still on the TODO list.

Started on a Special:RecentChanges page, more to come.

Fixed some captcha bugs and made all captcha fields case-insensitive

Implemented a new CAPTCHA API; the frontend ($session->{make,get}_captcha) is API-compatible but the backend (the captcha class) is deprecated.

A few hacks to make the 1.1 demo plugin work

Cosmetic improvements to page editor; added demo mode checks in Admin:LangManager

Fixed some MySQL installation schema bugs, thanks to rainmain on the forums.

Added a heading "editing page" in page editor for visual appeal; removed use of alternate <?= ?> syntax in installer as it was causing problems on Win2k3 + PHP/FastCGI. (Experimentally using TortoiseHG's hgtk to commit)

Fixed some stray undefined-variable problems revealed as a result of testing on Windows Server '03, IIS6, PHP/FastCGI, and PostgreSQL 8.2.5.

Fixed splitting bug (really the same issue from stable) in get_pageid_from_url(); upgraded TinyMCE to version 3.0-stable

Fixed jBox menus failing to appear when window scrolled down

Unstable alpha release (1.1.1)

Updated readme file for 1.1.1

Localization is FINISHED, DAMN IT HELLAH YEAH! OVER WITH! Man, it feels to get that off my chest. Release is in under 48 hours, folks. And we're ready for it.

Fixed JSON parser error in installer (caused by magic_quotes_gpc, wouldn't you know) and re-enabled server-side l10n debugging

Merging Nighthawk and Scribus branches (and Scribus is back, yay!)

Localized stray string "list of registered members" in UCP

Rebranded source code as 1.1.1; added TinyMCE ACL rule as per Vadi's request: http://forum.enanocms.org/viewtopic.php?f=7&t=54

Fixed contentPath getting messed up because I forgot a slash or two in payload

payload.php stg_language_setup() should set default language now

Fixed bad column count in MySQL payload

Fixed SYSMSG tag in templates causing problems; commented out ENANO_DEBUG; fixed bad table prefix in installer payload logic

Profiling enabled for RenderMan's wikiformat routine; [minor] made HTML from profiler more pretty

Fixed case where HTML comments were getting stripped when opening tag not followed by whitespace (<!--foo--> was stripped, <!-- foo --> was not, neither is stripped now)

Updated acledit and comment templates on themes, as they weren't in sync with Oxygen; fixed some undefined index errors in SpecialAdmin and paths

Minor and hopefully non-breaking change to plugin loader to possibly double performance at hook points

Got Enano to load even if there are no plugins; added caching for decrypted session keys to significantly improve performance (in theory at least)

Removed stray debugging info from ACL editor success notification; added ability for guests to set language on URI (?lang=eng); added html_in_pages ACL type and separated from php_in_pages so HTML can be embedded but not PHP; rewote portions of the path manager to better abstract URL input; added Zend Framework into list of BSD-licensed libraries; localized some remaining strings; got the migration script working, but just barely; fixed display bug in Special:Contributions; localized Main Page button in admin panel

Finished (or nearly finished) the admin language CP

[minor] Trying to be a little more careful with values from users_extra in validate_session()

[minor] silenced errors to mysql_free_result() and pg_free_result()

[minor] silenced errors to ob_gzhandler()

A number of scattered changes. Profiler added and only enabled in debug mode (currently on), but awfully useful for fixing performance in the future. Started work on Admin:LangManager

Improved compatibility with PostgreSQL and fixed a number of installer bugs; fixed missing "meta" category declaration in language files

Localized registration errors and activation/COPPA e-mails

Localized the 404 page, w00t.

Finished localizing PageProcessor, we hope

Localized autosuggestion widgets

Localized Special:UploadFile and Special:DownloadFile

Localized Special:EditSidebar

Finished l10n on user CP

Re-merged rev 35ed07abc99e, apparently didn't go through the first time.

Started localization on User CP. Localized pagination, password strength, and various other small widgets. Fixed bug in path manager causing return of fullpage from get_page_id_from_url() even when namespace is Special.

PageUtils::createpage(): $name was being sanitized too strictly

Implemented (well stubbed) IP logging in non-AJAX comment interface

Implemented IP logging for comments and registration

Completed l10n on admin panel. Exception is Admin:ThemeManager, which is pending a rewrite.

Localized Admin:MassEmail

Localized Admin:COPPA

Fixed a coupla minor bugs with the template_nodb class wrongly referencing $lang

A few more installer tweaks / fixes. Initted upgrade script. Added migration schema from 1.0 to 1.1.

Dropping changes from revision 350 (dd7cbc97f681)

Enano's new installable installer, alpha 1. No upgrade and (in some parts) very little localization.

Initlogs stage of installer now working

Oops, search_index table was still registered and language and language_strings weren't

More progress on the installer. At this point it can install and import the language, but does not rename config files. Still much work to be done, most notably localization and creation of MySQL users and databases.

Welcome to the new Enano installer. Much distance still to be covered but the basics are there.

Localized and separated Admin:GroupManager

Oops, forgot to add in the rewritten Admin:PageEditor

WiP commit for admin panel localization. All modules up to Admin:UserManager (working down the list) are localized except Admin:ThemeManager, which is due for a rewrite

Merging in something from Nighthawk, can't seem to figure out what

Localized the first parts of the admin panel. As a consequence, also wrote a brand new Admin:PageManager that doesn't suck like the old one did.

Finished localization of SpecialUserFuncs

[Minor] fix stupid bad td width in privmsgs compose interface

Merging in the last couple of revisions from stable

Fixed search indexer causing duplicate keys when two "words" of 64+ characters encountered and first 64 characters are the same (thanks Vadi); attempt to fix onunload confirmation during page editing

Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)

Made CAPTCHA for guests' page editing work with the non-AJAX interface

Added ability to require CAPTCHA for guests when editing pages (AJAX INTERFACE ONLY)

Replaced TinyMCE 2.x with 3.0 beta 3. Supports everything but IE. Also rewrote the editor interface completely from the ground up.

More localization work. Resolved major issue with JSON parser not parsing files over ~50KB. Switched JSON parser to the one from the Zend Framework (BSD licensed). Forced to split enano.json into five different files.

Fix missing avatar-related columns in users table

[Minor] fix non-localized string in installer (install_stg_buildindex_*); fix wrong string_id in pophelp:url_schemes

NOW the installer should work.

A minor installer fix to get the installer to run again. TODO: fix bad call to $lang->get() in preinstallation environment set up by index.php

Added update-checking function (still a little rough around the edges); added support into admin user CP for changing avatars

Added initial avatar support. Currently rather feature complete except for admin controls for avatar.

The merge of acl.js failed so re-merged manually

Redid merge, the previous one had a few problems

Fixed: $paths->page_id not set when the page doesn't exist; finally fixed garbled page names for IP addresses

Merging in a few stray changes from the MySQL branch

A number of updates to the graphing code (it should actually work now)

Many changes. Installer with PostgreSQL is broken badly and will be for some time.

Set Content-type on AJAX login key request to application/json to hopefully block ad injection

SURPRISE! Preliminary PostgreSQL support added. The required schema file is not present in this commit and will be included at a later date. No installer support is implemented. Also in this commit: several fixes including <!-- SYSMSG ... --> was broken in template compiler; set fixed width on included images to prevent the thumbnail box from getting huge; added a much more friendly interface to AJAX responses that are invalid JSON

Stable release: Enano CMS 1.0.3 (Dyrad)

Tagging latest revision for rebrand

Rebrand as 1.0.3 (Dyrad)

SECURITY: CRITICAL: Fix SQL injection in admin CP page editor

Fixed focus of AJAX login form fields in IE; removed stale/unused call to $template->makeParserText() in paginate_array(); added hook page_create_request to possibly help control creation of pages of certain namespaces from plugins; fixed critical bug in user CP that prevented plugins from adding custom CP modules

Localized remainder of on-page tools and parts of PageProcess

Merging in changes from stable

Improved physical pages: they support comments and have their own dedicated namespace now. Still some consistency fixes to make.

Deprecated debugConsole and removed all calls to it. Added a lot of comments to common.php. Added support for "anonymous pages" that are created when the Enano API is loaded from an external script. Fixed missing border-bottom on Type 2 sidebar blocks in Oxygen.

Merging in a couple more revisions from stable

Fixed: sanitation loop on ampersands in encodeAttribute() (this was MediaWiki's fault)

Stable release: Enano CMS 1.0.2 (Coblynau)

Dummy revision to artificially increment build number

Fix missing dependency on search.php in upgrade script

Detagging release due to stupid upgrade fix

Merging in the newly stable Coblynau

Stable release: Enano CMS 1.0.2 (Coblynau)

How could I forget the TRADEMARK SIGN?

Updated artwork with finalized new/revised logo; finalized upgrade schema

Add installer pop-help topic for URL scheme, in response to http://forum.enanocms.org/viewtopic.php?f=5&t=19

Oops, never merged in updates from ee1fc84f12a8 (240)

Hopefully now all calls to escape() are replaced with ajaxEscape() in response to Tomasz's forum post; remove deprecated version of show_category_info() from functions.php

SECURITY: Tighten default allowed file types; make sure search index rebuild is performed on upgrade

Final development freeze for release: 1.0.2 (Coblynau); only critical bugs fixed until GA

Add warning in installer for PHP < 5.2.0; hopefully fix validation of e-mail addresses with dashes

Nothing special. ksort()ing list of allowed filetypes in the admin panel to make editing the list marginally easier

Added OpenDocument MIME types and extensions; make sql_report page show total time taken for SQL queries

Fixed highlighting in search results; changed search algorithm to give more score for terms found in page title; hopefully (hackishly) fixed login_key_cache getting too long

A couple of minor tweaks to the upgrade schema; tests pending

The template-cache incompatibility bug has finally been isolated, so a function to clear the template cache was added into the upgrade script for 1.0.2

Fixed a few major bugs with the upgrade script and the config file not getting loaded properly due to IN_ENANO_INSTALL

Hopefully once again fix scriptPath detection in dbal.php

Fix missing REPORT_URI variable in template_nodb

Fixed a number of issues with SQL query readability and some undefined index-ish errors; consequently the SQL report feature was added

Changed all urlname/page_id columns to varchar(255) because 63 characters just isn't long enough

Made the username validation regexp in install less picky since it was blacklisting two of the letters in my name. >.<

Feature freezing repository for Coblynau release

Entering feature freeze for Coblynau release

AJAX login box now briefly shows the message "success" when a login is successful

Fix minor typo in installer

Merging in updates and improvements from stable

Language fix in the install script; fix username regex in install script login page javascript validation

Deprecated and removed Oxygen css-simple/bleu.css

Re-sync Oxygen and Mint and Oxygen simple with Oxygen main; a couple improvements to the redirect-on-no-config code

Re-add search_results hook and changed column type of search_index.word to varchar(64) in installer schema

Merging in new search algo from Scribus

Minor fix for the password meter in Admin:UserManager

Searching sucks, and Enano's search algorithm was complete bullcrap. So I rewrote it. No, it does not use Google search technology. Like they have a patent for using the Arial font on search result pages anyway.

Merging in fixes and updates from stable

Major fixes to the ban system - large IP match lists don't slow down the server miserably anymore.

Fixed a couple of renaming issues in the installer

Hopefully managed to put enough hacks in there to make renaming the config file the last step, so if it fails, it can be done manually

Removed stray debug message in installer

Merging in fixes from stable

Some (not much) progress with localizing tooltips on the pagebar. Still aways to go and committing so as to merge changes from stable

Well I'm an idiot - the fulltext index on page_text was missing from a default installation. It didn't break searches but probably slowed them down tremendously. Also set engine to MyISAM on page_text to avoid cryptic error messages from MySQL.

Major improvements in the security of the CAPTCHA system (no SQL injection or anything like that); fixed denied form submission due to _af_acting on form object wrongly switched to true

Javascript validation for install DB info form didn't allow dashes

Changed default content for the main page to something a lot more user-friendly and helpful

Rewrote some security code in PageUtils::savepage to accommodate the ACL system better; there was an issue with non-admin users saving pages on which they have edit rights but wiki mode is turned off

Fixed: secure-cookie option is no longer set if $_SERVER['HTTPS'] is set but == "off"

Patched in dash-in-database-name fix from unstable

Merge in installer fixes from 204 (ba28d43a6b86)

Merging in all changes from revision 185 (90b7a52bea45)

Fixed a few (more) MySQL issues with the installer and dashes in the database name

Forgot a couple of strings in the installer

Fix schema bug: main page link isn't a link

Installer should now be fully localized, yay!

Merged in the low-level DBAL fix involving dashes in the database name from stable

Database name can now contain dashes (as per requested at http://forum.enanocms.org/viewtopic.php?f=5&t=14); corrected some installer behavior issues with connecting as root and setting up permissions resulting in logs not being flushed, configs not being inserted, and what have you.

Fully localized all of the installer except the install and finish pages

Merge in some minor fixes from stable

Fix that retarded copyright "code, graphics, and more code" notice

Cleaned up some HTML in the installer; corrected some phpDoc syntax errors

Merge changes from nighthawk and scribus back together

Localized installer database info page and finished localizing sysreqs page

Installer localization started. Welcome, License, and SysReqs pages are fully localized.

Merge changes back from Nighthawk

Trying to get lang import to work in the installer; it's not working ATM - cache file is generated with lang_id = 0. Syncing to Nighthawk.

Localized default sidebar; installer should work now including the lang import; l10n in installer to follow

Fix a comparison logic SQL error in lang.php; fix attempt to call mysql_real_escape_string() in install without a working DB connection

Merge in new installer framework from stable

Fix installation with MySQL root option

Out with the old, in with the new. Welcome to Enano's new installer framework!

Second try (need config.php to exist before the API can be started, duh)

Renaming config.php and .htaccess to *.new to allow tarbombing an Enano installation with no adverse effects; first attempt, may not work right.

"Fix" e-mail parse bugs in installer

Fix PHP4 compatibility (function def. of password_score)

Merge in scaling abstraction from stable

Alternate scaling using GD is implemented now; images will be scaled with ImageMagick if enabled and working; else, GD will be used. No UI changes to speak of, but a check in the installer will be added in a later commit

Merging in fixes and updates from d8156d18ac58

Merging in fixes and updates from 90b7a52bea45

Merging in fixes from rev. 207

Fixed the one FIXME in PageUtils regarding static HTML comment system's greeting line; fixed parsing of external links in template->tplWikiFormat

Merging in fixes from stable

Fixed: invalid smartform input to Admin:UserManager when errors present and changing own account; [demo mode] default user can no longer change password

F'ing private message message_read column...

Fixed: radiobutton state in Admin:GeneralConfig not remembered when registration disabled

Localized a good part, if not all, of the registration page and a couple other things.

Failsafe page maintenance applets in index.php localized

Failsafe ACL editor interface localized

Javascripted ACL editor interface localized

... properly this time. Nighthawk is giving me crap so I'm moving to the laptop for now.

Localized the dreaded not-authenticated message in the admin panel

Localized the sidebar

All on-page AJAX applets should be localized now

Localized history page and static HTML comment interface

Reworked comment system to not use HACKISH FIXES; AJAX comment framework is completely localized now

Completely localized admin tree menu and page toolbar

Added language export to JSON page and localization for Javascript using $lang.get(). Localized AJAX login interface.

Login page mostly localized

Merging in some leftover changes from stable

Merging in fixes from stable

Update ajax.php to use the new username completion algo

Localization low-level framework added

You know what folks, a lot of Mercurial merges failed, and I just now figured out why. So now all changes from stable are permanently synced in.

Slight HTTPS compatibility improvements

Nothing special at all. Unnamed sidebar blocks will show the text <Unnamed> instead of just showing nothing, thus making them renamable

[minor] added bottom margin for enanocms.org fading button

Nothing real special. The AJAX loading icon can be changed using the Javascript variable ajax_load_icon in header.tpl.

Fixing permissions

That merge did NOT go well.

Merging in changes from 9e205056f825

Merging in changes from 9b4279c25d33

Merging in changes from db8a849ad4c9

SECURITY: Fixed possible SQL injection in PageUtils page protection; general cleanup of PageUtils; blocked using Project: prefix for page URL strings

Merging in changes from stable

Implemented cron image into Oxygen and St Patty as promised; fixed way-outdated version numbers in plugins

Added a cron framework. Currently tasks will not be run; will implement into templates in next commit

Sidebar blocks can be renamed now (untested except in Fx2)

Automatic set of state on Oxygen sidebar portlets should work now; reimplemented parts of the template parser (again) to workaround some PHP/PCRE issues and add support for parser plugins

SECURITY: Fix failure to log login failure on no row match

Sync from stable

Merge between Scribus and Nighthawk

Coupla cheap hacks in St. Patty to make developing more color themes easier

Replaced autocompleting username with a much more efficient algorithm and caching system

Fixed some regular expressions in HTML optimization algorithm; regex page groups can be edited now (oops)

Fixed the security hole (really, I'm a moron - used $failed > $threshold instead of $failed >= $threashold) and patched up some...erm... math issues

Upgrade UI should work now (upgrades still don't work); do not pull this revision as there is a security hole in the lockout system pending a fix

Sync changes in from Nighthawk

[F] Added support for account lockouts. User is locked out or required to complete a CAPTCHA after specified threshold for specified period.

Merging in latest changes from stable

Upgrade should work (untested)

More minor Ux improvements

AJAX login box is now used in userprefs panel; Spry shake effect and general UX on auth fail is smoother now; added ajaxLoginNavTo() JS function

SECURITY: remove debug message in session manager; implemented alternate MediaWiki syntax for template embedding; added Adobe Spry for "shake" effect on unsuccessful login

Let's hope it worked this time.

Fudge, this dun work

.hgtags change?

Minor text change + link to docs for "about keep-alive" help dialog

"Perhaps you were looking for" box now only shows if strlen($q) >= 4

Dummy commit to (hopefully) revert merge of unstable code

Added tag rebrand for changeset d53cc29308f4

Rebrand as 1.1.1; everything should now be bumped to "unstable" status

Fixed external links in tplWikiFormat to use my monster HTTP request regex

Fixed comment stripping in sanitize_html()

Improvements and fixes (hacks?) for HTML sanitization

Major revamps to the template parser. Fixed a few security holes that could allow PHP to be injected in untimely places in TPL code. Improved Ux for XSS attempt in tplWikiFormat. Documented many functions. Backported much cleaner parser from 2.0 branch. Beautified a lot of code in the depths of the template class. Pretty much a small-scale Extreme Makeover.

Fixed text colors on pages when dark system themes are used (bug could be seen using MurrinaNightOrange on an Ubuntu system)

Fixed: wiki mode edit notice should be shown on fallback editor now

Fixed: RenderMan::parse_internal_links() problems with prepending Project: instead of Site_name: to project page alias-namespace links

SECURITY: tightened up validation for rollbacks

Creating pages doesn't insert that crappy javascript hack anymore

Feature add: new page group type: regular expression match (PCRE)

Oops forgot to update common.php version

Added tag rebrand for changeset 42c6c83b8a00

Crap, that didn't work. Remerge of 42c6c83b8a00 and 824821224153

Merging branches from Scribus and Nighthawk

Added a new Javascript variable, aclDisableTransitionFX, that will switch off effects on message boxes and the ACL editor when set to true

Added tag rebrand for changeset 42c6c83b8a00

Rebrand for 1.0.2 (again, lol)

Added tag rebrand for changeset 0b5244001799

Sync from stable (Coblynau beta)

Added tag rebrand for changeset 6f0bbf88c325

Rebrand for 1.0.2b1

Improved response time for username autofill; fix JS login box in Safari (bug surfaced only after 1.0.1)

Added tag rebrand for changeset ca9118d9c0f2

Rebrand as 1.0.2 (Coblynau); internal links are now parsed by RenderMan::parse_internal_links()

SECURITY: Anonymous user can't be edited now; user accounts could be deleted even if errors detected; user CP saving disabled for demo mode

Revamped the administrator's user CP, big time. The admin module now uses a smart form and enables all profile fields, including users_extra, to be changed. Passwords are encrypted when sent. The whole CP has been split off into a different file to accomodate the large amount of code.

Sync Oxygen Bleu and Mint; fixed list-style-image ref and ordered lists getting bulleted

SECURITY: Fix unescaped SQL in paths.php rebuild_page_index()

Fix: textarea tags got stripped naked by the HTML optimizer, now no longer

Fix: internal links parsed with RenderMan::parse_internal_links() did not get namespaces prepended; added Project: alias namespace for internal links

Enano should now fully support UTF-8 usernames; newly registered users are now granted automatic edit access to their user pages (admins can still use protection on the page)

Oops - forgot to add pwstrength.js

Fully implemented password complexity enforcement; added encryption for passwords on registration form; some baby steps taken towards supporting international usernames - this is not working very well, we might need a hackish fix; TODO: implement password strength meter into installer UI and get international usernames 100% working

[sync only] Minor display change in Special:About_Enano; added initial PHP function for password strength testing

Fix: activation e-mails were signed by Anonymous :-)

Fixed unwanted sanitization in Admin:PageManager form submit

Rebranded as 1.0.1.1; fixed category page drawing bug; updated link to GPL in the about page to the GPLv2

Improved ban control page and allowed multiple entries/IP ranges; changed some parameters on jBox; user level changes are logged now

Vastly improved UX for a login to an inactive account

Merging Nighthawk and Scribus repositories

Fixed some rather major bugs in the registration system, this will need a release followup

Added tag release for changeset 8df3abef6647

Fixed the two known issues in the release notes; tarballs will be updated accordingly

Fixed the two known issues in the release notes; tarballs will be updated accordingly

1.0.1 Loch Ness stable release

PROPOSED RELEASE: 1.0.1 (Loch Ness)

Merging Scribus and Nighthawk repositories

Added keep-alive function to admin panel (had been planned for some time) and a new hook, template_var_init_end

Bugfix in Special:AllPages; fixed tinyMCE under Opera (finally!)

Made most special pages "visible"; fixup for non-existent special page redirect in paths.php; rewrote Special:AllPages to have pagination (WiP, Special:SpecialPages is possibly next, depending on whether paginate_array works or not)

Fixed the obnoxious issue with forms using GET and index.php?title=Foo URL scheme (this works a whole lot better than MediaWiki now

Nothing special, just syncing to Scribus, several bugs have been found with GET forms and a fix is in the works

Oops - fixed small glitch in delvote_ips converter code

Rewrote all code related to delvote_ips column to use serialize()

Added registration date column to members list

Removed a few stale debug messages

Added a ton of new log points for administrator actions; restructured security log view and enabled pagination for security logs; string change in ajax.php for RDNS operation failure

Implemented some extra functionality for friends/foes in comments; fixed lack of table_prefix in stats.php line 63

Synched installation schema to upgrade schema for delvote_ips

Second attempt at making delvote_ips work under MySQL 5.0.45 and 5.0.41

Added search function for memberlist

Added ACL rule preventing guests from viewing the memberlist (by request from Neal Gompa <ngompa13 at gmail>)

Several major improvements: Memberlist page added (planned since about beta 2), page group support added for non-JS ACL editor (oops!), and attempting to view a page for which you lack read permissions will get you logged.

[comments] fixed edit button (source wasn't getting filled) [editor] fixed issue with PHP execution and preview (PHP code is executed now, ACL-permitting) [admin] added checkbox to toggle account activation status in user manager (thanks Manoj)

Dramatically cleaned up HTML in registration form; cheat code to activate Bill Gates easter egg is now "William Henry Gates III"... OOPS!! hehe

Fixed: highlighting issue in search results renderer when the search query was comprised entirely of one quoted term

Added a few low-level checks in config.php for changes of search algorithm and AES cipher parameters

Fixed non-object reference in databaseless template, added locking for Javascript paginator, made comments on AES key size more clear in constants, and disallowed "anonymous" and IP addresses for admin username in install.php; Loch Ness release candidate

Fallback non-JS wiki mode switch is now implemented (doh!)

Fixed: when going beta 4 or earlier -> RC1 or later, default ACL rule for admins was not created, causing possibly confusing lockouts

Changed style of copyright in St. Patty; first attempt at fixing some upgrade issues from beta 3 or so

Fixed delvote_ips bug with MySQL 5.0.45 - see http://forum.enanocms.org/viewtopic.php?f=5&t=8

Redirections to the main page use the redirect() function now

Fixed stupid redirect bug that referenced $paths without importing it, gah...

Added ability to detag deleted pages

Fixed yet another minor XSS hole, this time in search results

Fixed XSS vulnerability in admin panel page manager

Fixed missing table_prefix in u_1_0_RC3_make_users_extra() in upgrade.php

Redid stupid fading button code and fixed several RC2 bugs in the upgrade schema; 1.0.1 release candidate

Finished pagination code (was incomplete in previous revision) and added a few hacks for an upcoming theme

AJAX comments are now paginated; plugin manager can now show system plugins; typo in installer corrected; links in oxygen/stpatty/admin footers changed to "About Enano" page; 1.0.1 release candidate

Now using a CSS hack for IE's "filter" attribute to prevent CSS warnings in Firefox

Tag cloud is now implemented

Fixed IE6 + Admin theme, version typo in installer, and paginator + IE6

Replaced the menu in the admin theme with something much more visually pleasureable; minor fix in Special:UploadFile; finished patching a couple of XSS problems from Banshee; finished Admin:PageGroups; removed unneeded code in flyin.js; finished tag system (except tag cloud); 1.0.1 release candidate

Improved and enabled HTML optimization algorithm; enabled gzip compression; added but did not test at all the tag cloud class in includes/tagcloud.php, this is still very preliminary and not ready for any type of production use

Admin theme now uses a collapsable sidebar instead of that ugly menu (WiP)

Modified Text_Wiki parser to fully support UTF-8 strings; several other UTF-8 fixes, international characters seem to work reasonably well now

Stale data in config.php, don't know how that happened, passwords have been changed

Work started on page tags, still aways to go, but syncing to Nighthawk

Oops, forgot to add PageGroups.php in plugins/admin/

Various bugfixes and cleanups, too much to remember... see the diffs for what got changed :-)

Made the move to Loch Ness, and got some basic page grouping functionality working. TODO: fix some UI issues in Javascript ACL editor and change non-JS ACL editor to work with page groups too

Fixed a few presentation bugs in installer, made installer more "legally binding", and fixed global permissions inheritance in $session->fetch_page_acl()

Pseudo-commit: Merging Scribus and Nighthawk repos

Pseudo commit: 1.0 final (Banshee) release version

Removed KNOWN_BUGS and TODO and added README; fixed file permissions yet again

Fixed stupid typo in template.php that made the fading button not work...

Made raw images + internal/external links work right

Added "raw" option to embedded images to make complex clickables easier

Last-minute change to width/height on embedded images

Fixed typo in RC3->1.0 upgrade schema

Fixed recursive template inclusion and spaces in template tags ({{Foo template}})

Redirect pages actually work stable-ish now; critical extraneous debug message removed (oops!)

I fixed the statistics!!! YAY!!

Changed administration login request to use the AJAX login form; made high-level authentication more apparent in the AJAX box; recompiled Oxygen Mint

Minor IE4 compatibility fix; template parser now properly handles external links in the sidebar

Merging Scribus and Nighthawk repositories... Mercurial saves the day...again :-)

Vastly improved compatibility with older versions of IE, particularly 5.0, through the use of a kill switch that turns off all AJAX functions

Fixed stupid ADMIN_SID_AUTO usage in admin template link to Main Page

Fixed problems with $paths->getParam() on Win2k Server/IIS

Bugfixes: Login system properly handles blank password situation (returns ""); fading button now works right with relative URLs

Enano CMS Project button can fade now

St. Patty now works correctly in IE7

Fixed even more bugs in the upgrade schema (there may be a number of commits like this, as we are testing the upgrade script on a temp server)

Fixed several more bugs in the upgrade schema

Fixed typo in upgrade schema (1.0RC3 -> 1.0)

E-mail address mask engine non-Javascript fallback now picks random substitutions for @ and . to make address more unreadable by bots

OK, that last commit only made things worse...it's fixed now.

Fixed minor userpage issue where comments posted by guests under the same name as the username being displayed were shown on that user's userpage

Oops - memory leak in urandom reader

$aes->gen_readymade_key() now uses /dev/urandom when possible

Fixed weird unimportant security issue in admin panel + demo mode

I dunno how many times I'm gonna have to fix the "problem seems to be the hex conversion" bug, but this is at least the fourth try.

Pseudo-commit: database freeze milestone for Banshee

Fixed a lot of bugs with Safari and Konqueror; improved Opera compatibility

Changed animation on flying message boxes; bugfix for "Array" response in theme changer; added diff CSS to enano-shared; allowed spaces in username during install

Fixed user pages + the new .xx page URL format

More image tag parser fixes

Added "page hint" on search page; deprecated "www." on EnanoCMS.org links

Finally implemented the new image tag code

Removing Box Art and Connections themes from main repo

No code changes - trying once again to get rid of execute permissions on non-directories

Finished everything on the TODO list (yay!); several CSS cleanups; tons more changes in this commit - see the patch for details

Finished Special:Preferences/Profile page! Only the wikitext parser cleanup left, yay!

COPPA support added

Rewrote change theme dialog; a few minor stability fixes here and there; fixed IE + St Patty background image

Deleting pages now requires a reason

Converting all tables on new installations to UTF-8; this may break MySQL 4.0 compatibility; several minor cosmetic fixes; set Powered button under Links to "on" by default

...again

Fixed invalid HTML caused by wikitext processor on non-templated pages

Fixed tons of bugs relating to non-templated pages

At last, I fixed all those phased-out enano.homelinux.org links!

More preliminary l10n work; userpage portal style basics implemented

Updated all version numbers back to Banshee; a few preliminary steps towards full UTF-8 support in page URLs

Demo mode: security logs are now recorded but not publicly displayed

Added demo mode functionality to various parts of Enano (unlocked only with a plugin) and fixed groups table

Upgrades (RC2->RC3) should now work

Version upgrade in common.php

Emergency version change to 1.0rc3 to fix XSS vulnerabilities

Fixed complicated SQL injection vulnerability in URL handler, updated license info for Tigra Tree Menu, and killed one XSS vulnerability

Security: NUL characters are now stripped from GPC; several code readability standards changes

Installer actually works now on dev servers; minor language change in template.php; code cleanliness fix in sessions.php

Fixed problems with installer and config file (chdir and error-connecting-to-MySQL issues)

Finalized permissions on files and directories; adding PHP shutoff button (actual shutoff not implemented)

Added option in installer to not let admins embed PHP

Following fixes: admin theme supports <button> tag now, PageProcessor can eval now, and SpecialAdmin.php plugin can no longer be disabled

Stop making test changes\!