| [ Index ] |
|
Code source de GeekLog 1.4.1 |
1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> 2 <html> 3 <head> 4 <title>Geeklog Documentation - Changes</title> 5 <link rel="stylesheet" type="text/css" href="docstyle.css" title="Dev Stylesheet"> 6 </head> 7 8 <body> 9 <table cellpadding="2" cellspacing="2" border="0" width="100%"> 10 <tr> 11 <td valign="top"><img src="images/newlogo.gif" alt="Geeklog Documentation" width="243" height="90" border="0"></td> 12 </tr> 13 <tr> 14 <td valign="top" class="menu"><a href="index.html">Geeklog Documentation</a> - Changes</td> 15 </tr> 16 </table> 17 18 <h1>Changes</h1> 19 20 <p>This document is intended to give a quick overview over the most important 21 and / or obvious changes. For a detailed list of changes, please consult the 22 <a href="history">ChangeLog</a>. The file <tt>docs/changed-files</tt> has a list 23 of files that have been changed since the last release.</p> 24 25 <h2><a name="changes141">Geeklog 1.4.1</a></h2> 26 27 <h3>New Features</h3> 28 29 <ul> 30 <li>Support for Microsoft SQL Server. Starting with this release, Geeklog can 31 now also be installed on Microsoft SQL Server, so it's no longer restricted 32 to just MySQL. The MS SQL support was developed by Randy Kolenko. 33 Thanks, Randy!<br> 34 Please note that any third-party plugins will have to offer support for 35 MS SQL before they can be installed on Microsoft SQL Server. The bundled 36 plugins (Calendar, Links, Polls, Spam-X, Static Pages) have already been 37 updated accordingly.</li> 38 <li><a href="calendar.html">Calendar plugin</a>. The formerly built-in calendar 39 and events have now been moved into a separate plugin. This complements the 40 move of the <a href="polls.html">polls</a> and <a href="links.html">links</a> sections into plugins in Geeklog 1.4.0 and makes Geeklog more modular as you 41 can now easily disable or replace functionality that you don't need for 42 your site.</li> 43 <li><a href="http://wiki.geeklog.net/wiki/index.php/Multi-Language_Support">Multi-language support</a>. It is now possible to build truly multi-linugal sites 44 with Geeklog where not only the navigation but also the content of the site 45 changes with the language.</li> 46 <li>Ships with <a href="http://fckeditor.net/">FCKeditor</a> 2.3.1, which once 47 again includes a file manager for uploading images.</li> 48 <li>A function for mass-deletion of old or inactive users. The list automatically 49 searches for users that have never logged in, only used the site for a very 50 short time or have not been online since a very long time. The time span can 51 be varied, and found users can be selectively deleted.</li> 52 </ul> 53 54 <h3>Security</h3> 55 56 <p>In the light of the security issues discovered in Geeklog 1.4.0 and earlier 57 versions, the Geeklog source code has undergone a code review. We have 58 identified and addressed several minor issues and introduced new measures to 59 enhance security in this release. As a welcome side effect, the code reviews 60 have also uncovered a few bugs and inconsistencies that we also fixed in this 61 release.</p> 62 63 <h3>Spam Protection</h3> 64 65 <p>With this release we are finally removing support for the <a href="http://www.geeklog.net/article.php/mt-blacklist-discontinued">discontinued</a> MT-Blacklist. In its place, we are now using a system called Spam Link Verification (SLV) run by Russ Jones at <a href="http://www.linksleeve.org/">www.linksleeve.org</a>. SLV could be described as a community-driven, automatically updated blacklist. See the documentation of the <a href="spamx.html" rel="nofollow">Spam-X plugin</a> for details.</p> 66 67 68 <h2><a name="changes140sr5-1">Geeklog 1.4.0sr5-1</a></h2> 69 70 <p>This release fixes display problems in the comment preview that were only 71 introduced in Geeklog 1.4.0sr5.</p> 72 73 74 <h2><a name="changes140sr5">Geeklog 1.4.0sr5</a></h2> 75 76 <p>JPCERT/CC informed us about a possible <a href="http://en.wikipedia.org/wiki/XSS" title="Click to look up 'XSS' on Wikipedia" style="text-decoration: none; color: black; border-bottom: 1px dotted black;">XSS</a> in the comment handling that we're fixing with this release.</p> 77 78 79 <h2><a name="changes140sr4">Geeklog 1.4.0sr4</a></h2> 80 81 <p>Two exploits have been released by "rgod" for insecure Geeklog installations and for a bug in the "mcpuk" file manager that we've been shipping as part of FCKeditor in all previous 1.4.0 releases.</p> 82 83 <ul> 84 <li>Some of the files outside of the public_html directory were not protected 85 against direct execution. If Geeklog was installed such that those files 86 were accessible from a URL (which has always been strongly discouraged in 87 the installation instructions) then those files could be used to load and 88 execute malicious code from a remote server. 89 <br><br> 90 More information: <a 91 href="http://www.geeklog.net/article.php/so-called-exploit">So-called 92 Geeklog "exploit" posted</a> 93 <br><br> 94 In this release, we've added the missing execution prevention for all files 95 outside of public_html. We would still, however, suggest that you fix your 96 Geeklog install if the files outside of public_html are accessible from a 97 URL (see our <a 98 href="http://www.geeklog.net/faqman/index.php?op=view&t=56">FAQ</a> for 99 details). 100 </li> 101 <li>The "mcpuk" file manager that we've integrated into FCKeditor allowed the 102 upload of arbitrary PHP code (even if FCKeditor was disabled in Geeklog's 103 config.php). Depending on your webserver's configuration, it was then 104 possible to execute that uploaded code. 105 <br><br> 106 More information: <a href="http://www.geeklog.net/article.php/exploit-for-fckeditor-filemanager">Exploit for FCKeditor's mcpuk file manager</a> 107 <br><br> 108 The file manager has been removed from this release. You will therefore no 109 longer be able to upload files, e.g. images, through FCKeditor. Future 110 versions of Geeklog will ship with an updated version of FCKeditor and its 111 included file manager. 112 </li> 113 </ul> 114 115 <p>Note: This release also includes the <a 116 href="http://www.geeklog.net/article.php/fighting-trackback-spam">updated 117 lib-trackback.php</a> for better protection against Trackback spam.</p> 118 119 120 <h2><a name="changes140sr3">Geeklog 1.4.0sr3</a></h2> 121 122 <p>This release addresses the following security issues:</p> 123 <ol> 124 <li>Possible SQL injection and authentication bypass in <tt>auth.inc.php</tt> 125 (reported by the Security Science Researchers Institute Of Iran).</li> 126 <li>Possible XSS in <tt>getimage.php</tt> 127 (reported by the Security Science Researchers Institute Of Iran).</li> 128 <li>Path disclosure in <tt>getimage.php</tt> and the <tt>functions.php</tt> of 129 some themes, e.g. the Professional theme 130 (reported by the Security Science Researchers Institute Of Iran).</li> 131 <li>Possible SQL injection in story submissions.</li> 132 </ol> 133 134 135 <h2><a name="changes140sr2">Geeklog 1.4.0sr2</a></h2> 136 137 <p>This release addresses the following security issues:</p> 138 <ul> 139 <li>Konstantin Dyakoff found an old bug in the session handling that would 140 allow anyone to log in as any user.</li> 141 <li>HTML was not stripped from the Location field in a user's profile.</li> 142 </ul> 143 144 145 <h2><a name="changes140sr1">Geeklog 1.4.0sr1</a></h2> 146 147 <p>This release addresses the following security issues:</p> 148 <ul> 149 <li>James Bercegay of GulfTech Security Research reported several issues with 150 Geeklog's cookie handling that made it vulnerable to SQL injections, 151 arbitrary file access, and even injection and execution of arbitrary 152 code.</li> 153 </ul> 154 155 156 <h2><a name="changes140">Geeklog 1.4.0</a></h2> 157 158 <p><small>(Geeklog 1.4.0 was originally supposed to be called 1.3.12, so any 159 references you may find to a version 1.3.12 apply to version 1.4.0)</small></p> 160 161 <h3>New Features</h3> 162 163 <ul> 164 <li>Geeklog now officially works with <code>register_globals = off</code>. 165 Please note that some plugins may still require it to be <code>on</code>, 166 though.</li> 167 <li>Added support for sending and receiving <a 168 href="http://en.wikipedia.org/wiki/Trackback">Trackback</a> and <a 169 href="http://en.wikipedia.org/wiki/Pingback">Pingback</a> comments. Both 170 are supported for stories, but there is also a new plugin API so that 171 plugins can use this feature, too. Trackback and Pingback can be disabled 172 in <tt>config.php</tt>.</li> 173 <li>Added the ability to "ping" weblog directory services to advertise site 174 updates (preconfigured to ping <a 175 href="http://pingomatic.com">Ping-o-Matic</a>). As with Trackback and 176 Pingback, this is supported for stories, but plugins can also make use of 177 this feature via the plugin API.</li> 178 <li>New syndication framework so that Geeklog can now <strong>read and 179 write</strong> feeds in different formats (currently supported: RSS, RDF, 180 and Atom).</li> 181 <li>New administrator controlled user status. Including banning and 182 administrator activation of accounts.</li> 183 <li>New Remote Authentication system to allow people with accounts on remote 184 services such as Blogger.com or LiveJournal.com to login to your site 185 without having to directly register on your site. (Remote accounts can be 186 banned as normal accounts).</li> 187 <li>The Admin sections have been revamped to provide a more consistent look and 188 sortable lists. "Command and Control" (<tt>moderation.php</tt>) now also 189 comes with a new set of icons and has one icon for every Admin section. 190 Furthermore, the Admin block and Command and Control can be <a 191 href="config.html#desc_sort_admin">sorted</a> alphabetically.</li> 192 <li>Ships with <a href="http://www.fckeditor.net/">FCKeditor</a> (WYSIWYG 193 editor). To <a href="config.html#desc_advanced_editor">enable</a>, set 194 <code>$_CONF['advanced_editor'] = true;</code> in your 195 <tt>config.php</tt>.</li> 196 <li>The search now only displays a specified amount of results per page to 197 avoid running into timeouts when searching through large databases.<br> 198 <b>Note:</b> Plugins will have to be updated to support the "paged" search. 199 Until then, Geeklog fakes the paged results for plugin searches, which 200 means that a plugin that hasn't been updated will still search through the 201 entire database, but Geeklog will only display the results for the current 202 result page.</li> 203 <li>Introduced an "Article Directory", providing an overview of all past 204 articles, sorted by year and month.</li> 205 <li>The default permissions for new objects (stories, topics, blocks, etc.) can 206 now be set in config.php.</li> 207 </ul> 208 209 <h3>Compatibility</h3> 210 211 <ul> 212 <li>Due to the changes, themes will have to be updated to work with Geeklog 213 1.4.0. See the <a href="theme.html#changes">list of theme changes</a> for 214 details.</li> 215 <li>The plugin API for comments has changed. Plugins using comments will have 216 to be updated to work with Geeklog 1.4.0.</li> 217 </ul> 218 219 <h3>More Information</h3> 220 221 <p>We have posted a series of stories on the Geeklog homepage that highlight and explain some of the new features:</p> 222 <ul> 223 <li><a href="http://www.geeklog.net/article.php/advanced-editor">Geeklog's Advanced Editor</a></li> 224 <li><a href="http://www.geeklog.net/article.php/remote-authentication">Remote Authentication</a></li> 225 <li><a href="http://www.geeklog.net/article.php/trackback-pingback">Trackback and Pingback</a></li> 226 <li><a href="http://www.geeklog.net/article.php/ping">Sending a Ping</a></li> 227 <li><a href="http://www.geeklog.net/article.php/comment-plugin-api">New Comment Plugin API</a></li> 228 </ul> 229 230 231 <h2><a name="changes1311sr7">Geeklog 1.3.11sr7</a></h2> 232 233 <p>JPCERT/CC informed us about a possible <a href="http://en.wikipedia.org/wiki/XSS" title="Click to look up 'XSS' on Wikipedia" style="text-decoration: none; color: black; border-bottom: 1px dotted black;">XSS</a> in the comment handling that we're fixing with this release.</p> 234 235 236 <h2><a name="changes1311sr6">Geeklog 1.3.11sr6</a></h2> 237 238 <p>This release addresses the following security issues:</p> 239 <ol> 240 <li>Possible SQL injection and authentication bypass in <tt>auth.inc.php</tt> 241 (reported by the Security Science Researchers Institute Of Iran).</li> 242 <li>Possible XSS in <tt>getimage.php</tt> 243 (reported by the Security Science Researchers Institute Of Iran).</li> 244 <li>Path disclosure in <tt>getimage.php</tt> and the <tt>functions.php</tt> of 245 some themes, e.g. the Professional theme 246 (reported by the Security Science Researchers Institute Of Iran).</li> 247 <li>Possible SQL injection in story submissions.</li> 248 </ol> 249 250 251 <h2><a name="changes1311sr5">Geeklog 1.3.11sr5</a></h2> 252 253 <ul> 254 <li>Konstantin Dyakoff found an old bug in the session handling that would 255 allow anyone to log in as any user.</li> 256 </ul> 257 258 259 <h2><a name="changes1311sr4">Geeklog 1.3.11sr4</a></h2> 260 261 <p>This release addresses the following security issues:</p> 262 <ul> 263 <li>James Bercegay of GulfTech Security Research reported several issues with 264 Geeklog's cookie handling that made it vulnerable to SQL injections, 265 arbitrary file access, and even injection and execution of arbitrary 266 code.</li> 267 </ul> 268 269 270 <h2><a name="changes1311sr3">Geeklog 1.3.11sr3</a></h2> 271 272 <p>This release addresses the following security issues:</p> 273 274 <ol> 275 <li>Provided you knew the story id, it was possible to submit comments for 276 stories even if you did not have access to those stories 277 (reported by LWC). The same problem also existed with poll comments.</li> 278 <li>Supplying an illegal start or end date to the advanced search resulted in a 279 warning message that disclosed the path to the Geeklog install on the 280 server (reported by r0t3d3Vil).<br> 281 It was <strong>not</strong> possible to use this for SQL injections.</li> 282 </ol> 283 284 <p>Also included in this release are bugfixes, e.g. for the problems editing 285 static pages when URL rewriting was enabled, that were introduced in 286 1.3.11sr2.</p> 287 288 289 <h2><a name="changes1311sr2">Geeklog 1.3.11sr2</a></h2> 290 291 <p>This release provides security enhancements and better spam protection 292 originally developed for Geeklog 1.3.12. It also addresses a few bugs where 293 the bugfix could be integrated with a reasonable amount of work (other bugfixes 294 will have to wait for the 1.3.12 release). 295 296 <h3>Security and Spam protection</h3> 297 <ul> 298 <li>There is now a speed limit for login attempts, defaulting to three tries 299 in a five minute period (<a 300 href="config.html#desc_login_attempts">configurable</a> in 301 <tt>config.php</tt>).</li> 302 <li>Linefeeds are filtered from the To:, From:, and Subject: fields of any 303 email sent through <code>COM_mail</code>.</li> 304 <li>When a new user account is created and the user submission queue is enabled 305 in <tt>config.php</tt>, Geeklog now ensures that the new account is properly 306 queued even in the unlikely event that the account creation fails halfway 307 through.</li> 308 <li>When a post is identified as spam, it now also triggers the speed limit 309 (ie. posters will have to wait for the speed limit to expire before they 310 can make another submission).</li> 311 <li>Spam posts now get a 403 "Forbidden" HTTP response code.</li> 312 <li>Spam checks are now done for comments, story, link, and event submissions, 313 the message sent with the "email story to a friend" option, and for the 314 contents of the user profile.</li> 315 <li><a href="http://www.geeklog.net/article.php/spam-x-1.0.2" 316 rel="nofollow">Spam-X plugin 1.0.2</a> included.</li> 317 </ul> 318 319 <p>Please note that MT-Blacklist (used by Spam-X) has recently been <a href="http://www.geeklog.net/article.php/mt-blacklist-discontinued">discontinued</a>. The 320 Spam-X plugin as included in this release is configured to get the last version 321 of the blacklist from geeklog.net, but there will be no more updates.</p> 322 323 <h3>Bugfixes</h3> 324 <ul> 325 <li>Fixed an error message thrown up by PHP 5.0.5 or later when viewing the 326 article page (bug #483).</li> 327 <li>Quote names in email addresses as soon as they contain any non-alphanumeric 328 characters, apart from the blank (bug #368). This should help when trying 329 to email users with special characters in their name.</li> 330 <li>Upgraded included kses class to version 0.2.2 which fixes problems with 331 Japanese and Thai characters (bugs #94 and #119).</li> 332 <li>Fixed SQL error when using the [staticpage:] autotag (bug #373).</li> 333 </ul> 334 <p>For a complete list of bugfixes, please see the Changelog.</p> 335 336 <h3>Improvements</h3> 337 <ul> 338 <li>Added support for a <code>custom_usercheck</code> function (for the 339 custom registration code). See the included <tt>lib-custom.php</tt> for 340 details.</li> 341 <li>Improved handling of the auto-archive option in <tt>index.php</tt>, which 342 should slightly improve page load times.</li> 343 <li>Includes several new and updated language files.</li> 344 <li>Includes updated PEAR classes.</li> 345 </ul> 346 347 348 <h2><a name="changes1311sr1">Geeklog 1.3.11sr1</a></h2> 349 <p>This release addresses the following security issue:</p> 350 <ul> 351 <li>Stefan Esser found an SQL injection that can, under certain circumstances, 352 be exploited to extract user data such as the user's password hash.</li> 353 </ul> 354 355 <h2><a name="changes1311">Geeklog 1.3.11</a></h2> 356 357 <p>Geeklog 1.3.11 is a <strong>bugfix and security release</strong> over Geeklog 1.3.10 and is meant to replace 1.3.10. The change in the version number was necessary since one of the bugfixes involves a change in the database.</p> 358 359 <h3>Security issues</h3> 360 <ol> 361 <li>It was possible to submit stories anonymously even if anonymous submissions 362 were turned off in <tt>config.php</tt> (reported by Barry Wong).<br> 363 These stories still ended up in the submission queue, though, unless you 364 disabled it in <tt>config.php</tt>.</li> 365 <li>Some of the parameters in link and event submissions weren't filtered, 366 leaving them open to potential SQL injections.</li> 367 <li>The links for the What's Related block were created from the unfiltered 368 story text, opening the possibility of XSS attacks (reported by Vincent 369 Furia).</li> 370 </ol> 371 372 <h3>Bugfixes</h3> 373 <ul> 374 <li>Fixes the length of the 'sid' field in the gl_comments table. Using story 375 IDs longer than 20 characters prevented comment posts from being associated 376 with the story.</li> 377 <li>Ensures compatibility with PHP 4.1.x (includes updated PEAR packages).</li> 378 <li>Fixes the archiving option being activated too early (bug #345).</li> 379 <li>Properly deletes comments and story images when deleting entire topics 380 (bug #339).</li> 381 <li>Deletes comments when deleting polls.</li> 382 <li>Fixes several bugs in the calendar and improves overall handling of both 383 the site calendar and the personal calendars (bugs #268, #336, #338, and 384 others).</li> 385 <li>Fixes "More by <i>author</i>" and "More from <i>topic</i>" links in 386 articles.</li> 387 <li>Various other fixes, see <tt>docs/history</tt> for details.</li> 388 </ul> 389 390 <p>We strongly advise users of Geeklog 1.3.10 to upgrade to 1.3.11 ASAP. Upgrading should be relatively painless, as there weren't any changes in the themes, language files, or config.php over 1.3.10.</p> 391 392 393 <h2><a name="changes1310">Geeklog 1.3.10</a></h2> 394 395 <h3>New Default Theme</h3> 396 397 <p>This release comes with a new default theme: We've chosen the Professional 398 theme, kindly provided by Victor B. Gonzalez (of <a href="http://aeonserv.com">Aeonserv</a> fame). The theme has been modified slightly and is now fully HTML 4.01 and CSS compliant.</p> 399 400 <p>We've also decided to remove the old set of themes (Classic, Clean, Digital Monchrome, Gameserver, Smooth Blue, XSilver, Yahoo) from the distribution. They are now available as a separate tarball.</p> 401 402 <h3>New Features</h3> 403 404 <ul> 405 <li><a href="spamx.html" rel="nofollow">Spam-X plugin</a> included. Tom Willet 406 has kindly provided his spam detection plugin, which is now part of the 407 default Geeklog install.<br> 408 The plugin has been modified slightly to store the blacklists in the 409 database. Users of the previous version of the plugin will have to import 410 their personal blacklist via the plugin's admin panel.</li> 411 <li>Story Archive feature: It is now possible to move stories to an "archive" 412 topic or have them deleted automatically at a given time.</li> 413 <!-- li>PDF support: Stories can be converted into PDFs (requires installation 414 of third-party software - see config.php for details).</li --> 415 <li>Customizable menu bar: The site's menu bar can now be <a 416 href="config.html#desc_menu_elements">configured</a> in config.php, i.e. 417 you can choose which entries should be displayed there and in which order. 418 It's also possible to add custom entries by providing a function in 419 lib-custom.php.</li> 420 <li>Clickable links in text postings: URLs in non-HTML postings are now 421 recognized by Geeklog and displayed as clickable links.</li> 422 <li>Editable story IDs: The IDs of stories can now be changed (like the IDs of 423 static pages) to provide more readable URLs (and further improve the 424 chances of being picked up by seach engines, especially when used with 425 URL rewriting).</li> 426 <li>Autolinks are a new form of links that can be used in stories and comments. 427 An autolink takes the form 428 <code>[<i>name</i>:<i>id</i> <i>link text</i>]</code> where <i>name</i> is 429 the tag name, <i>id</i> is the ID of an object the link should be pointing 430 to, and <i>link text</i> is used as the text of the link.<br> 431 Example: <code>[story:email-bug About the email bug]</code> would be 432 translated into <code><a href="http://example.com/article.php/email-bug">About the email bug</a></code><br> 433 For the built-in autotags, the <i>link text</i> is optional and Geeklog 434 will use the title of the object (story / event / static page) if it is not 435 given.<br> 436 Predefined autotags are <code>[story:]</code> to link to stories and 437 <code>[event:]</code> to link to events. Plugins can define their own 438 autotags to provide links to objects under their control. The Static Pages 439 plugin already provides a <code>[staticpage:]</code> autotag.</li> 440 <li>Customizable welcome email: The email that is sent out to users 441 registering with your site is now fully customizable by providing the 442 text in a text file (/path/to/geeklog/data/welcome_email.txt).</li> 443 <li>Timezone hack: The popular "<a 444 href="http://www.geeklog.net/forum/viewtopic.php?showtopic=40196">timezone 445 hack</a>" is now included. It lets you set the site's timezone for when 446 your server is located in another timezone.</li> 447 </ul> 448 449 <h3>Other Improvements</h3> 450 451 <ul> 452 <li>Various changes have been made to improve the overall performance.</li> 453 <li>On fresh installs, there is now an option to use InnoDB tables (instead of 454 MyISAM) if your MySQL version supports them (as of MySQL 4.0, or 3.x "Max" 455 builds). Existing databases can be converted to InnoDB by using the script 456 <tt>admin/install/toinnodb.php</tt>.<br> 457 <strong>Warning:</strong> Using InnoDB tables makes database backups 458 somewhat more complicated. Small and medium-sized sites should work just 459 fine with MyISAM tables, so if in doubt <em>don't</em> use InnoDB 460 tables.</li> 461 <li>The calendar's week can now either start on a Sunday or a Monday.</li> 462 <li>The Static Pages plugin now has an option to display a printer-friendly 463 version of a static page.</li> 464 </ul> 465 466 <h3>Comments</h3> 467 468 <ul> 469 <li>The comment code has undergone major changes to improve performance and 470 add improvements like the ability to link to individual comments, 471 paging comments, etc.</li> 472 <li>Users can now report abusive comments to the site admin.</li> 473 <li>The site admin can get an email notification when a new comment is 474 posted (similar to the notification emails for new stories, links, 475 events, and users).</li> 476 <li>The IP addresses of comment posters are now tracked and can be looked up 477 directly by linking to a Whois service (or you can install Tom Willet's 478 <a href="http://sf.net/project/showfiles.php?group_id=68255&package_id=95743">NetTools</a>, which include a Whois function).</li> 479 </ul> 480 481 <h3>Security-related fixes</h3> 482 483 <p><strong>Note:</strong> All of the following bugs were problems with 484 Geeklog's permissions system and fall into the "information leakage" category, 485 i.e. under certain circumstances, site content was visible to persons who 486 shouldn't be able to see it. None of these bugs were exploitable in the sense 487 that they could be used to gain privileges or cause damage to Geeklog or the 488 environment it's running in.</p> 489 490 <ul> 491 <li>Group Admins were able to list the members of all groups, even if they were 492 not members of those groups.</li> 493 <li>Group Admins were given a list of all the groups in the system, even if 494 they were not members of those groups (bug #280).</li> 495 <li>Story and Event Admins were always given a list of all the stories / all 496 the events, even when they didn't have read access to them (bug #269).</li> 497 <li>It was possible to request comments from stories even if the user didn't 498 have permission to read the story (provided you knew both the story and 499 the comment id).</li> 500 <li>Event permissions in the calendar's day and week view weren't checked 501 properly, so that events may have been visible to users who shouldn't 502 have been able to see them.</li> 503 <li>It was possible to add any event to the personal calender, even if you 504 didn't have permissions to see it in the site calendar (provided you knew 505 the event id).</li> 506 </ul> 507 508 <h3>Other bugfixes</h3> 509 510 <ul> 511 <li>Previewing and saving a story submission left the submitted story in the 512 submission queue, but did additionally save it as a new story.</li> 513 <li>Deleting an event from the personal calendar didn't work (bug #199).</li> 514 <li>Old userphotos weren't removed when the new photo had a different file 515 type, e.g. when changing from a .gif to a .jpg (bug #228).</li> 516 <li>Scaling images didn't work when the image exceeded the max. height but 517 not the max. width (bug #242).</li> 518 <li>Keeping an unscaled image wasn't possible when using gdlib to rescale 519 images (bug #197).</li> 520 <li>When using gdlib, GIF images were converted to PNG format, but Geeklog 521 was still trying to display the GIF version. Since the LZW patent has 522 now <a href="http://www.unisys.com/about__unisys/lzw">expired</a>, it is 523 safe to use GIF images again and the PNG conversion has been dropped.</li> 524 <li>The tarball also includes updated PEAR packages which should address the 525 email problems some users were having (bug #246).<br> 526 <strong>Note:</strong> These are the same PEAR packages that already 527 shipped with Geeklog 1.3.9sr2.</li> 528 </ul> 529 530 <p>Please note that there have also been <a href="theme.html#changes">theme 531 changes</a>, some of which are important to make the new features work (e.g. 532 the editable story IDs and the story archive options)!</p> 533 534 <p>This release contains various improvements provided by the Geeklog community 535 (see the <tt>docs/history</tt> file for proper credits). Thank you!</p> 536 537 <h2><a name="changes139sr3">Geeklog 1.3.9sr3</a></h2> 538 <p>This release addresses the following security issues:</p> 539 540 <ol> 541 <li>It was possible to submit stories anonymously even if anonymous submissions 542 were turned off in <tt>config.php</tt> (reported by Barry Wong).<br> 543 These stories still ended up in the submission queue, though, unless you 544 disabled it in <tt>config.php</tt>.</li> 545 <li>Some of the parameters in link and event submissions weren't filtered, 546 leaving them open to potential SQL injections.</li> 547 </ol> 548 549 550 <h2><a name="changes139sr2">Geeklog 1.3.9sr2</a></h2> 551 <p>This release addresses the following security issues:</p> 552 553 <ol> 554 <li>Fixed a cross site scripting vulnerability caused by using the variable 555 <code>$topic</code> in the language files (bug #293).</li> 556 <li>Prevent comment posts on stories or polls were comment posting has been 557 disabled.</li> 558 </ol> 559 560 <h3>Other fixes</h3> 561 <ul> 562 <li>Fixed <tt>lib-plugins.php</tt> to work properly with PHP 5.</li> 563 <li>The complete tarball also includes updated PEAR packaged that fix 564 some of the reported email problems.</li> 565 </ul> 566 567 568 <h2><a name="changes139sr1">Geeklog 1.3.9sr1</a></h2> 569 <p>This release addresses the following security issues:</p> 570 571 <ol> 572 <li>It was possible to post anonymous comments, even when anonymous comment 573 posting had been switched off in config.php.<br> 574 This bug was apparently exploited by spammers to send hundreds of spam 575 posts to certain Geeklog sites.</li> 576 <li>Added additional speed limit checks for comments and submissions.</li> 577 <li>If none of the topics were visible for anonymous users, the site's index 578 page may still have displayed some stories for anonymous users, depending 579 on the stories' permissions.</li> 580 <li>Users still got Daily Digest emails for topics from which they had been 581 removed (bug #178).</li> 582 <li>It was possible to subscribe to the Daily Digest for all topics, even if 583 the user did not have access to certain topics.</li> 584 <li>Comments to stories were sometimes listed in a user's profile, even if the 585 user viewing the profile didn't have permissions to access the story the 586 comments belonged to.</li> 587 </ol> 588 589 <h3>Other fixes</h3> 590 <ul> 591 <li>Fixed an SQL error in <code>COM_showTopics</code> if users excluded topics 592 from their preferences.</li> 593 <li>Fixed sporadic "Duplicate entry '...' for key 1." messages in error.log, 594 caused by the handling of pseudo-session ids for anonymous users.</li> 595 <li>Fixed incorrect author names in Daily Digest (bug #207).</li> 596 <li>The <code>plugin_profileblocksedit_<i>plugin-name</i></code> Plugin API 597 function wasn't working due to a missing piece of code in 598 usersettings.php.</li> 599 <li><code>COM_extractLinks</code> will now ignore anchor tags that do not 600 contain "<code>href</code>" (bug #183).</li> 601 </ul> 602 603 604 <h2><a name="changes139">Geeklog 1.3.9</a></h2> 605 606 <h3>New Features</h3> 607 608 <ul> 609 <li>Geeklog now uses PEAR::Mail to send all emails. This gives you the option 610 to send emails via PHP's built-in mail() function (as before), via 611 sendmail or via SMTP.</li> 612 <li>There is a new admin option called Content Syndication that lets you 613 create and configure (RSS) feeds. In addition to the standard feed 614 containing all the new stories, you can now create feeds per topic, for 615 upcoming events, and for links.<br> 616 This feature is extensible in that plugins can provide additional feeds. 617 It is also possible to provide feeds in formats other than RSS 0.91 by 618 providing additional feed classes.</li> 619 <li>Admins can change the block order easily from the list of blocks now.</li> 620 <li>There is an alternative interface to adding users to groups (requires 621 JavaScript).</li> 622 <li>Users in the Group Admin group can now only assign other users to groups 623 of which they themselves are a member.</li> 624 <li>Image upload can now also use the GD library to scale images.</li> 625 <li>Comments now use templates.</li> 626 <li>To accomodate strict webhosts who don't allow file uploads to the standard 627 image directory, you can now set a new configuration variable, 628 <code>$_CONF['path_images']</code> to point to a directory outside of your 629 webtree where article images and user profile pictures will be saved.</li> 630 <li>Geeklog now supports URL rewriting for story URLs, i.e. you can have URLs 631 like <tt>http://www.geeklog.net/article.php/20031229225326631</tt> which 632 are known to be picked up by Google.</li> 633 <li>Plugins can add their own section to Geeklog's What's New block.</li> 634 <li>All URL fields can now hold up to 255 characters (requires theme updates).</li> 635 </ul> 636 637 <p>Please see the <a href="theme.html#changes">themes documentation</a> for a 638 complete list of theme changes.</p> 639 640 <p>Also included is the <a href="staticpages.html">Static Pages plugin 1.4</a>, 641 which now has, among other improvements, a second option to include PHP in 642 static pages without having to use the PHP <code>return</code> statement.</p> 643 644 645 <h3>Bugfixes</h3> 646 647 <ul> 648 <li>Words from a search query are now properly highlighted in comments. Also 649 fixed a problem with highlighting when the search query contained '*' 650 characters.</li> 651 <li>Various fixes in the search class.</li> 652 <li>Fixed a bug that let users register with an empty username.</li> 653 <li>When batch-importing users, those users were all subscribed to the 654 Daily Digest automatically (uses the $_CONF['emailstoriesperdefault'] 655 setting instead now).</li> 656 <li>Fixed option to delete comments, which previously was only available to 657 users in the Root group (e.g. Admin). Now those users that have story.edit 658 permissions for the actual story can delete comments.</li> 659 <li>Deleting a group may have left orphaned entries in the group_assignments 660 table (this has been fixed now). When upgrading to 1.3.9, the install 661 script will remove any orphaned entries from the database.</li> 662 </ul> 663 664 <p>There have also been a lot of changes to improve security, especially 665 against SQL injections.</p> 666 667 668 <h2><a name="changes138-1sr6">Geeklog 1.3.8-1sr6</a></h2> 669 <p>This release addresses the following security issues:</p> 670 671 <ol> 672 <li>Fixed a cross site scripting vulnerability caused by using the variable 673 <code>$topic</code> in the language files (bug #293).</li> 674 <li>Prevent comment posts on stories or polls were comment posting has been 675 disabled.</li> 676 </ol> 677 678 679 <h2><a name="changes138-1sr5">Geeklog 1.3.8-1sr5</a></h2> 680 <p>This release addresses the following security issue:</p> 681 682 <ol> 683 <li>It was possible to post anonymous comments, even when anonymous comment 684 posting had been switched off in config.php.<br> 685 This bug was apparently exploited by spammers to send hundreds of spam 686 posts to certain Geeklog sites.</li> 687 </ol> 688 689 690 <h2><a name="changes138-1sr4">Geeklog 1.3.8-1sr4</a></h2> 691 <p>This release addresses the following security issues:</p> 692 693 <ol> 694 <li>It was possible for users in the Group Admin and User Admin groups to 695 become a member of the Root group (reported by Samuel M. Stone, 696 bug #135).</li> 697 <li>Being admin for a certain area (e.g. Story Admin for stories) made it 698 possible to delete all objects in that area (e.g. stories) even if the user 699 was not supposed to have access to them, provided the id of the object was 700 known.</li> 701 <li>It was possible to delete other people's personal events if you knew the 702 event ID.</li> 703 <li>It was possible to browse through the comments of a story even if the user 704 did not have access to the actual story (reported by Peter Roozemaal).</li> 705 <li>Due to an XSS issue, it was possible to change someone's account settings 706 (including the password) if you got them to click on a specially crafted 707 link (reported by Jelmer, fix suggested by Vincent Furia).</li> 708 <li>The comment display suffered from the possibility of an SQL injection 709 (reported by Jelmer).</li> 710 <li>It was possible to inject Javascript code in the calendar (reported by 711 Jelmer).</li> 712 <li>It was possible to execute (but not save) Javascript code in the comment 713 preview (reported by Jelmer).</li> 714 </ol> 715 716 717 <h2><a name="changes138-1sr3">Geeklog 1.3.8-1sr3</a></h2> 718 <p>This release addresses the following security-related issues:</p> 719 720 <ol> 721 <li>As "dr.wh0" pointed out, the category field for link submissions was not 722 filtered at all. Although you probably can't cause too much harm with 723 those 32 characters, this has now been fixed.</li> 724 <li>Vincent Furia found that the restrictions for the form to email users 725 could be circumvented and could even be used to spam users. 726 In addition to fixing theses issues, there is now also a speed limit 727 on that form (defaults to the speed limit for story submissions).</li> 728 <li>There was a way to post comments anonymously even when posting for 729 anonymous users had been disabled.</li> 730 <li>It was possible to post comments under someone else's username.</li> 731 </ol> 732 733 734 <h2><a name="changes138-1sr2">Geeklog 1.3.8-1sr2</a></h2> 735 736 <p>Jouko Pynnonen found a way to trick the new "forgot password" feature, introduced in 1.3.8, into letting an attacker change the password for <em>any</em> account. This release addresses this issue - there were no other changes.</p> 737 738 <p>Obviously, we strongly recommend to upgrade as soon as possible.</p> 739 740 741 <h2><a name="changes138-1sr1">Geeklog 1.3.8-1sr1</a></h2> 742 743 <p>The purpose of this release is to address some of the security issues reported in September and early October 2003. We strongly recommend upgrading to this version.</p> 744 745 <h3>Security issues</h3> 746 <ol> 747 <li>By including Ulf Harnhammar's <a href="http://sourceforge.net/projects/kses/" title="kses homepage">kses</a> HTML filter, this release addresses a variety of possible Javascript injection and CSS defacement issues.</li> 748 <li>Details of SQL errors will not be reported in the browser any more (but only in Geeklog's error.log file). This will avoid disclosing any sensitive information as part of the error message (which is so far the only problem we have found with the alleged SQL injection issues that have been reported). 749 </ol> 750 751 <p>Please note that at the moment we do <strong>not</strong> recommend to use Geeklog with MySQL 4.1 (which, at the time of this writing, is in alpha state and should not be used on production sites anyway). An upcoming release of Geeklog will include more thorough filtering of SQL injections attempts, thus also fixing the problems with MySQL 4.1.</p> 752 753 <h3>Other fixes</h3> 754 <ul> 755 <li>Fixed the auto-detection of the value for the <code>$_CONF['cookiedomain']</code> variable if the URL included a port number (such as <tt>example.com:8080</tt>). This will fix the login problems some users were reporting.</li> 756 <li>The full 1.3.8-1sr1 tarball also includes updated French (Canada) and Turkish language files.</li> 757 </ul> 758 759 760 <h2><a name="changes138-1">Geeklog 1.3.8-1</a></h2> 761 762 <p>Geeklog 1.3.8-1 is a bugfix release over Geeklog 1.3.8. It contains a 763 variety of (mostly minor) bugfixes. None of those fixes are security-related.</p> 764 765 <h3>Bugfixes</h3> 766 767 <ul> 768 <li>Fixes to the new search to restore pre-1.3.8 behavior (display search form 769 again if no results are returned, handling of 770 <tt>$_CONF['searchloginrequired']</tt>, etc.). Also fixed the search by 771 date.</li> 772 <li>Fixed problems in the install script when trying to identify the MySQL 773 version. The install script failed silently on PHP 4.0.4 and earlier 774 versions.</li> 775 <li>Fixed a problem with the What's Related block on stories that contain 776 images.</li> 777 <li>Skip user "Anonymous" when sending out the Daily Digest. 778 <li>Prevent admin from changing a user's email address to one that's already 779 used by another user.</li> 780 <li>Update RSS feed and Older Stories block when deleting a story.</li> 781 </ul> 782 783 <p>The full 1.3.8-1 tarball also includes new and updated language files 784 (see the Changelog for details).</p> 785 786 787 <h2><a name="changes138">Geeklog 1.3.8</a></h2> 788 789 <h3>New Features</h3> 790 791 <p>Geeklog 1.3.8 Includes the <strong>Static Pages 1.3 plugin</strong> which 792 replaces <em>both</em> the Static Pages 1.1 and 1.2 plugins. See the <a 793 href="staticpages.html">Static Pages documentation</a> for details.</p> 794 795 <ul> 796 <li>The search function has been rewritten. You can now search for the 797 exact phrase, all the words, or any of the words from a query. Search 798 words are also highlighted in stories. 799 <li>New Privacy options: Users can decide whether they want to receive 800 email from other users and/or admins and whether they want to show up in 801 the Who's Online block. 802 <li>You can now get a list of all users who are in a certain group (from the 803 Admin's group editor). 804 <li>When scaling is configured for images in stories, you can now keep the 805 unscaled image (has to be enabled in config.php first). In that case, the 806 scaled-down image in the story will serve as a thumbnail and link to the 807 unscaled image. 808 <li>You can now make one topic the default topic. The topic selection in the 809 story submission form will then default to that topic. However, when 810 browsing by topic (index.php?topic=Geeklog etc.) new story submissions will 811 default to the current topic. 812 <li>You can give your users the ability to change their username and delete 813 their account. Both features have to be enabled in config.php. 814 <li>Extended Plugin API: Plugins can now display content in Geeklog's 815 center area, add their own information to the user profile, and add 816 information to the site's header (<code><head></code> section). 817 <li>There's a new API for custom registration forms (see 818 <tt>lib-custom.php</tt> for sample code). 819 <li>There have been quite a few theme changes in order to move most larger 820 portions of hard-coded HTML to template files and to give theme designers 821 more control over the layout. Please consult the <a 822 href="theme.html#changes138">themes documentation</a> for a list of changes.</li> 823 </ul> 824 825 <h3>Bugfixes</h3> 826 827 <ul> 828 <li>The "forgot password" function has been rewritten. Instead of resetting 829 your old password and sending you a new one, you will now receive an 830 email with a unique link in it. If you follow this link, you can enter a 831 new password directly. Otherwise, you can simply ignore the email and your 832 old password will remain valid. 833 <li>Topic access was not always checked properly. If Story Admins report 834 getting access denied messages after upgrading to 1.3.8, check your topic 835 permissions carefully. 836 <li>The poll editor let you enter one answer too many (i.e. when the max. 837 number of answers was set to 10 you could actually enter 11). Please check 838 your existing polls or you may lose the last answer if you exceeded the 839 max. number of answers in a poll (adjust $_CONF['maxanswers'] accordingly, 840 if necessary). 841 <li>Geeklog should install and run again on old versions of MySQL 842 (specifically, 3.22.xx). Please note that some of these old versions aren't 843 even supported by MySQL AB any more and MySQL installs older than 3.23.54 844 are having security issues. 845 </ul> 846 847 848 <h2><a name="changes137sr5">Geeklog 1.3.7sr5</a></h2> 849 <p>This release addresses the following security issues:</p> 850 851 <ol> 852 <li>It was possible for users in the Group Admin and User Admin groups to 853 become a member of the Root group (reported by Samuel M. Stone, 854 bug #135).</li> 855 <li>Being admin for a certain area (e.g. Story Admin for stories) made it 856 possible to delete all objects in that area (e.g. stories) even if the user 857 was not supposed to have access to them, provided the id of the object was 858 known.</li> 859 <li>It was possible to delete other people's personal events if you knew the 860 event ID.</li> 861 <li>It was possible to browse through the comments of a story even if the user 862 did not have access to the actual story (reported by Peter Roozemaal).</li> 863 <li>Due to an XSS issue, it was possible to change someone's account settings 864 (including the password) if you got them to click on a specially crafted 865 link (reported by Jelmer, fix suggested by Vincent Furia).</li> 866 <li>The comment display suffered from the possibility of an SQL injection 867 (reported by Jelmer).</li> 868 <li>It was possible to inject Javascript code in the calendar (reported by 869 Jelmer).</li> 870 <li>It was possible to execute (but not save) Javascript code in the comment 871 preview (reported by Jelmer).</li> 872 </ol> 873 874 875 <h2><a name="changes137sr4">Geeklog 1.3.7sr4</a></h2> 876 <p>This release addresses the following security-related issues:</p> 877 878 <ol> 879 <li>As "dr.wh0" pointed out, the category field for link submissions was not 880 filtered at all. Although you probably can't cause too much harm with 881 those 32 characters, this has now been fixed.</li> 882 <li>Vincent Furia found that the restrictions for the form to email users 883 could be circumvented and could even be used to spam users.</li> 884 <li>There was a way to post comments anonymously even when posting for 885 anonymous users had been disabled.</li> 886 <li>It was possible to post comments under someone else's username.</li> 887 </ol> 888 889 890 <h2><a name="changes137sr3">Geeklog 1.3.7sr3</a></h2> 891 892 <p>The purpose of this release is to address some of the security issues reported in September and early October 2003. If you don't plan to upgrade to the latest version of Geeklog (1.3.8-1sr1, at the time of this writing), we strongly suggest you upgrade to at least 1.3.7sr3 instead.</p> 893 894 <h3>Security issues</h3> 895 <ol> 896 <li>By including Ulf Harnhammar's <a href="http://sourceforge.net/projects/kses/" title="kses homepage">kses</a> HTML filter, this release addresses a variety of possible Javascript injection and CSS defacement issues.</li> 897 <li>Details of SQL errors will not be reported in the browser any more (but only in Geeklog's error.log file). This will avoid disclosing any sensitive information as part of the error message (which is so far the only problem we have found with the alleged SQL injection issues that have been reported). 898 </ol> 899 900 <p>Please note that at the moment we do <strong>not</strong> recommend to use Geeklog with MySQL 4.1 (which, at the time of this writing, is in alpha state and should not be used on production sites anyway). An upcoming release of Geeklog will include more thorough filtering of SQL injections attempts, thus also fixing the problems with MySQL 4.1.</p> 901 902 903 <h2><a name="changes137sr2">Geeklog 1.3.7sr2</a></h2> 904 905 <h3>Security issues</h3> 906 907 <p>The purpose of this release is to fix the following security issues. 908 All users are <em>strongly</em> encouraged to upgrade to this version ASAP.</p> 909 <ol> 910 <li>It was possible to obtain valid session ids for every account on a Geeklog 911 site, including the Admin account (reported by SCAN Associates).</li> 912 <li>Using Internet Explorer, it was possible to upload an image with embedded 913 PHP code and execute it (reported by SCAN Associates).</li> 914 <li>Story permissions could override topic permissions, resulting in the display 915 of stories to users who shouldn't have access to them (reported by Andrew 916 Lawlor). This was already fixed with the new <tt>index.php</tt>, released 917 2003-05-15.</li> 918 <li>Added a warning in <tt>config.php</tt> that adding any of the following 919 tags to the list of allowable HTML can make the site vulnerable to 920 scripting attacks:<br> 921 <code><img> <span> <marquee> <script> 922 <embed> <object> <iframe></code><br> 923 (pointed out by Joat Dede).</li> 924 </ol> 925 926 <p>This update also includes fixes for the notorious "permission denied" 927 error messages that some users would get in the Admin area (e.g. when trying 928 to save a story and being "only" a user with Story Admin permissions).</p> 929 930 <p>The full 1.3.7sr2 tarball also includes various new and updated language 931 files (see the Changelog for details).</p> 932 933 934 <h2><a name="changes137sr1">Geeklog 1.3.7sr1</a></h2> 935 936 <h3>Security issues</h3> 937 938 <p>The main purpose of this release is to fix the following security issues. 939 All users are strongly recommended to upgrade to this version.</p> 940 <ol> 941 <li>Javascript code could be injected in the homepage field of a user's profile (reported by Jin Yean Tan).</li> 942 <li>Javascript code could be injected in certain URLs to be used in a cross-site scripting attack (reported by Jin Yean Tan).</li> 943 <li>Comments could be deleted by anybody if they knew the comment id (which is not normally visible).</li> 944 <li>A StoryAdmin could manipulate stories even if s/he did not have access to them (e.g. when s/he was not a member of a certain group). The same applied to Admins for events, links, polls, topics, and blocks (reported by Kobaz).</li> 945 </ol> 946 947 <h3>Other Bugfixes</h3> 948 949 <ul> 950 <li>Fixed possible causes for endless loops with the redirect in index.php: No redirect will be done if $HTTP_SERVER_VARS['HTTP_HOST'] is not set. Also, the comparison of the configured and actual server name is not case-sensitive any more.</li> 951 <li>Fixed image resizing when using ImageMagick.</li> 952 <li>The new user notification email (introduced in Geeklog 1.3.7) was always 953 sent out, even if 'user' was not listed in $_CONF['notification']. 954 <li>The Admin menu will now be displayed for users who have Admin access to plugins only, but not to one of the core Admin features.</li> 955 <li>The default for the daily digest is now back to "off", i.e. new users will not receive it automatically. To enable the daily digest for new users again, set $_CONF['emailstoriesperdefault'] = 1 in config.php.</li> 956 </ul> 957 958 <p>Documentation and hard-coded links (version check, link to Geeklog in a site's footer) have been updated to point to <a href="http://www.geeklog.net/">www.geeklog.net</a>.</p> 959 960 961 <h2><a name="changes137">Geeklog 1.3.7</a></h2> 962 963 <h3>New Features</h3> 964 965 <ul> 966 <li>A notification email can now be sent when a new story, link, or event 967 has been submitted or a new user has registered with the site (see the 968 <a href="config.html#submission">submission settings</a> for details).<br> 969 Please note that this feature doesn't tie in with Geeklog's security 970 features - it's really more of a hack, since many people asked for this 971 functionality.</li> 972 <li>Following the "X stories in last 24 hours" link in the What's New block 973 will now display just those new stories.</li> 974 <li>User photos are now resized, just like images in stories (if the use 975 of an image library is configured). The max. dimensions for user photos 976 can be set with a separate set of config variables in 977 <tt>config.php</tt>.</li> 978 <li>The plugin menu now lists all plugins which exist in the file system 979 but haven't been installed yet. It also provides a link to the install 980 script of those plugins for easy installation.</li> 981 <li>Several new config variables have been added to config.php (notification, 982 showfirstasfeatured, dateonly, timeonly, skip_preview, upcomingeventsrange, 983 emailstoryloginrequired, hideemailicon, hideprintericon, hidenewstories, 984 hidenewcomments, hidenewlinks, max_photo_width, max_photo_height, 985 max_photo_size). Please see the <a 986 href="config.html">config documentation</a> for details.</li> 987 <li>Theme changes: Please consult the <a href="theme.html#changes137">themes 988 documentation</a> for a list of changes.</li> 989 </ul> 990 991 992 <h3>Bugfixes</h3> 993 994 <ul> 995 <li>Added sanity checks in the Admin story editor to prevent the loss of all 996 stories when using an incomplete language file (or when manipulating the 997 URL).</li> 998 <li>Fixed a nasty bug in lib-security.php that let any user with UserAdmin 999 permissions change the Root user's password, thus effectively becoming 1000 root.</li> 1001 <li>Fixed problems with blocks disappearing when they were set to 1002 "homeonly".</li> 1003 <li>Fixed problems with multiple [code] ... [/code] sections in stories 1004 and comments.</li> 1005 <li>Fixed double line spacing in [code] sections and HTML-formatted comments 1006 on PHP 4.2.0 and up.</li> 1007 <li>Fixed problems with slashes and HTML entities in emails sent by 1008 Geeklog.</li> 1009 <li>Fixes and improvements to the plugin API.</li> 1010 </ul> 1011 1012 <p><strong>Contributors:</strong> Blaine Lang, Vincent Furia, and Kenn Osborne 1013 have contributed to this release. Thank you!</p> 1014 1015 <h3><a name="addindex">Speeding up Geeklog (a bit)</a></h3> 1016 1017 <p>If you're upgrading from 1.3.6 or older versions, you may want to run the 1018 script called <tt>addindex.php</tt> that you will find in the <tt>install</tt> 1019 directory. This script adds index fields to some of Geeklog's database tables 1020 which should improve overall access times a bit.</p> 1021 1022 <p>This has been implemented as a separate script (and not as part of the 1023 upgrade process of the install script) since it may take some time to run, 1024 depending on how many users / stories / etc. you have in your database. Some 1025 people may even run into timeouts, e.g. when their hosting service limits the 1026 execution time of PHP scripts. If that happens to you - <strong>Don't 1027 Panic</strong>. Simply run the script again (and again and ...) until it 1028 reports that it didn't add any fields to any tables.</p> 1029 1030 <p>Please note that you do <em>not</em> need to run this script if you're doing 1031 a fresh install of Geeklog 1.3.7. A database created during a fresh install 1032 already has the new index fields.</p> 1033 1034 1035 <h2><a name="changes136">Geeklog 1.3.6</a></h2> 1036 1037 <h3>New Features</h3> 1038 1039 <ul> 1040 <li>Images in articles can now be resized automatically during upload 1041 (provided you have either ImageMagick or netpbm installed). See the 1042 <a href="config.html#image">configuration description</a> for details.</li> 1043 <li>The contents of a static page entitled "Frontpage" will be displayed 1044 before the first story on the front page of a Geeklog site. If the static 1045 page additionally carries the label "nonews", then it will completely 1046 replace the news on the front page.</li> 1047 <li>User submission queue: When activated (in <tt><a 1048 href="config.html#submission">config.php</a></tt>), new users will need to 1049 be approved by an admin before they receive their password.</li> 1050 <li>The submission queues can be switched off separately, either completely 1051 (in <tt><a href="config.html#submission">config.php</a></tt>) or only for 1052 certain groups of users (by using the new features story.submit, 1053 links.submit, and event.submit).</li> 1054 <li>When posting source code (e.g. PHP, HTML, ...), you can now use the 1055 [code] ... [/code] pseudo tags to enclose those portions of your posting 1056 that should be reproduced verbatim.</li> 1057 <li>The links section now uses a categorized and paged display (can be 1058 <a href="config.html#links">switched off</a> separately and even back to the 1059 pre-1.3.6 style listing).</li> 1060 <li>Anonymous users can now be <a href="config.html#login">blocked</a> from 1061 almost every part of the site (e.g. links section, site stats, ...), if 1062 needed.</li> 1063 <li>A Geeklog site can now be disabled easily (e.g. for maintenance) by 1064 setting a flag in <tt><a href="config.html#site">config.php</a></tt>.</li> 1065 <li>Theme changes: Please consult the <a href="theme.html#changes136">themes 1066 documentation</a> for a list of changes.</li> 1067 </ul> 1068 1069 <h3>Bugfixes</h3> 1070 1071 <ul> 1072 <li>Several fixes have been made to ensure that permissions are taken into 1073 account properly (e.g. not revealing titles of stories that the user has no 1074 access to).</li> 1075 <li>Several fixes have been made to make sure that Geeklog can now be 1076 properly localized (provided you have a language file that is up to date 1077 and have chosen the proper <a href="config.html#locale">locale settings</a> 1078 for your country and language).</li> 1079 <li>The variable $_CONF['site_admin_url'] is now used properly so that you 1080 can rename Geeklog's <tt>admin</tt> directory if needed.</li> 1081 <li>New RDF parser will now import most (if not all) RDF news feeds 1082 properly</li> 1083 </ul> 1084 1085 <h3>Notes</h3> 1086 1087 <ul> 1088 <li>Since there are a lot of new variables in <tt>config.php</tt>, it is 1089 recommended you start with a fresh copy of that file instead of copying 1090 over your old <tt>config.php</tt> from your previous installation.</li> 1091 <li>Please note that currently only the English, German, Italian, Polish, 1092 and Japanese language files are up to date. Using one of the other 1093 language files may result in your Geeklog site not working properly.</li> 1094 </ul> 1095 1096 <p><strong>Contributors:</strong> Gene Wood, Blaine Lang, Tom Willet, and 1097 Roger Webster have contributed to this release. Thank you!</p> 1098 1099 <table border="0" width="100%" class="footer"> 1100 <tr valign="top"> 1101 <td colspan="2"><a href="http://wiki.geeklog.net">The Geeklog Documentation Project</a><br> 1102 All trademarks and copyrights on this page are owned by their respective owners. GeekLog is copyleft.</td> 1103 </tr> 1104 </table> 1105 1106 </body> 1107 </html>
titre
Description
Corps
titre
Description
Corps
titre
Description
Corps
titre
Corps
| Généré le : Wed Nov 21 12:27:40 2007 | par Balluche grâce à PHPXref 0.7 |
|
|