# $Id: NEWS,v 1.134 2005/08/19 10:50:42 garvinhicking Exp $ Version 0.8.4 (August 19th, 2004) ------------------------------------------------------------------------ * Add HTML information about calendar arrows image size to bypass large sizing in Internet Explorer. Thanks to frodeste from the Forums! * Hide title of an entry in the frontend, if entry is draft and not displayed. Fixes Bug #1260667 (garvinhicking) * Unbundle Serendipity XML-RPC functions from the bundled distribution. You will now need to install the additional plugin "Post via XML-RPC" (serendipity_event_xmlrpc) to make entry posts via this interface. The ongoing security issues with this interface and the little usage of this functionality by the broad public have forced this move. After installing this plugin you can use the same URL and nothing will change for XML-RPC users. (garvinhicking) * Optionally allow using a local PEAR installation. Set $serendipity['use_PEAR'] = true in your serendipity_config_local.inc.php or serendipity_config.inc.php file. The required packages can be found in the bundled-libs/.current_version file. (garvinhicking) * Append the comment id to the mail that is sent to subscribers of an entry, so that they can jump to the submitted comment immediately. (garvinhicking) Version 0.8.3 (August 4th, 2004) ------------------------------------------------------------------------ * Upgraded bundled libs: Cache_Lite to 1.5.1 HTTP_Request to 1.2.4 Net_CheckIP to 1.1 Net_Socket to 1.0.6 Net_URL to 1.0.14 PEAR to 1.3.5 Text_Wiki to 0.25.0 XML_RPC to 1.3.3 Fixing several bugs and vulnerabilities. (nohn) * Fixed properly linking PDF files when no thumbnail was created (garvinhicking) * Make categories sidebar plugin show categories' description, not the name on mouse over (garvinhicking) * Added new config option "blogMail" that specifies the blog's used From: E-Mail address. If not given, falls back to not specifying From: field and using mailserver default ("wwwrun", "nobody", ...) (garvinhicking) * Fix possible exploit that sends comments to the blog owner and others with arbitrary mailheaders and a link to invalid entries. Thanks to Sebastian Raible! (garvinhicking) * Allow plugins to contain more than one HTML nuggets which can be WYSIWYGized. (garvinhicking) * Fix editing a draft article to be properly displayed as draft in PostgreSQL setups. Thanks to Penny Leach! (garvinhicking) * Fixed possible XSS in comment input validation, thanks to Ilia Alshanetsky * Full Korean language support available! Translations done for: - main language file - all core plugins - Kubrick template (wesley) * TEMPLATES: New core hook "frontend_footer" is introduced and is added to index.tpl: {serendipity_hookPlugin hook="frontend_footer"} (wesley) * TEMPLATES: Added plugin hooks "entries_header" and "entries_footer" to the files entries_archives.tpl and entries_summary.tpl: {serendipity_hookPlugin hook="entries_header"}
(wesley) Version 0.8.2 (June 29th, 2005) ------------------------------------------------------------------------ * fixed remote code execution vulnerability. Thanks to Gulftech Research for pointing out that bug and Stefan Esser for helping fix it (nohn) * Updated Spartacus to most recent version (nohn) * fixed serendipity_traversePath() - PHP5 issue with array_merge() Thanks to jdhawk for the fix (flotsam) * CSS does no longer emit cache-restricting headers, so that the stylesheets can be cached by the browser for followup-requests Thanks to Sencer for pointing this out! (garvinhicking) * Patch/Bug #1209410 by swiesinger: When using shortcut admin URL, use https:// when specified by user * Fix deleting categories when having privileges but not being administrator (Patch #1205347, many thanks to Penny Leach) * Increased level of output message from the Spartacus plugin (garvinhicking) * Patched XML-RPC functions, thanks to Tim Putnam. This should enable XML-RPC services to properly fetch existing articles and edit them. * Fix Plugin API call performing too many unneeded SQL queries (garvinhicking) * Fix missing authorname when previewing entry. Thanks to winkiller, aquatic, thomas, wurstprinz and hansi for fixing this! Version 0.8.1 (May 17th, 2005) ------------------------------------------------------------------------ * Fix missing PDF thumbnail creation (imagemagick only) (garvinhicking) * Fix possible arbitrary media file upload for editors (garvinhicking, sesser, nohn) * Fix possible XSS when using the templatedropdown or shoutbox plugins (garvinhicking) * Fix pagination of "Entries by Author" (garvinhicking) * Fix RSS 1.0 missing top-level namespace (garvinhicking) * Deactivated gzip compression by default, as in certain server setups it creates problem with double-encoding or missing ob_gzhandlers. (garvinhicking) * Allow the serendipity_event_trackback additional trackbacks plugin to send trackbacks even if your entry did not contain at least one link. Also fix not sending trackbacks containing "#" fragments (garvinhicking) * Do not display Sidebar titles if they are not set for the bundled default, kubrick and wp templates (sidebar.tpl) (garvinhicking) * Fix error "Warning: ob_start(): output handler 'ob_gzhandler' cannot be used after 'URL-Rewriter'" which can occur on installations where session.use_trans_sid is activated and Serendipity's gzip compression is used. (garvinhicking) * Adjusted checking for "convert" binary in installation for Windows servers. Thanks to BobRock! (garvinhicking) * BBCode plugin: Allow =, ~ and ! URL characters (garvinhicking) * Added romanian translation by Alexandru Szasz * Some IIS webserver compatibility for $_SERVER variables. This should ensure most basic operations. (garvinhicking) * RSS feed does no longer initialize a session and thus now causes proper cachability for Conditional Get (garvinhicking) * Fix issues on Windows installations: %T strftime-Option not known when saving a plugin and emitting timestamp (was empty), redirecting to a wrong URL for installation with '\' instead of '/' path indicators. Thanks to Hendy Irawan! (garvinhicking) Version 0.8 (April, 15th 2005) ------------------------------------------------------------------------ * Added icelandic translation by Örn Arnarson * Fixed a possible SQL injection issue in Tracking methods. Also fixed possible XSS exploit in BBCode markup, if enabled for comments. Thanks to ADZ Security Team for detecting this. Next time please give us more time to respond to your public announced exploits. ;) (garvinhicking) * Reverted more JavaScript-patches introduced in beta5 to make the extended body text visible when using WYSIWYG editor (garvinhicking) * Fix SQLite bug when fetching authorname in quicksearch. Thanks to Sven Oliver Moll! Version 0.8-beta6 (April 8th, 2005) ------------------------------------------------------------------------ * Remove unique constraint for url_idx on the referrer suppress table and replaced it by a simple index. Fixes fatal errors on postgresql (garvinhicking) * Fix inserting media manager items: Non-images were not properly detected (garvinhicking) * Fix broken SQL for inserting comments which showed in SQLite/PGSql and got introduced in beta5. (garvinhicking) * Reverted JavaScript-patches from nohn introduced in beta5 to make IE6 again show the category and extended entry toggle buttons (garvinhicking) Version 0.8-beta5 (April 1st, 2005) ------------------------------------------------------------------------ * Fix XMLRPC problems for getting existing posts. Thanks a lot to TimothyP from the forums! (garvinhicking) * Fix directory creation error; the mode 1777 failed on several setups, so we use 0777 again (garvinhicking) * Fix installer not being able to go above page 2 on special setups with register_globals On (garvinhicking) * Fixed buggy referrer tracking for MySQL (Bug #1170251) * Upgrade Smarty to v2.6.9 (tomsommer) * Added 'Cache-Control: no-cache' header to our CSS file; this may fix IE bugs where CSS was only loaded after 1-2 reloads. (TomSommer) * Fixed a XMLRPC problem for metaWeblog_newMediaObject() to properly save a binary file. Thanks to marco from the forums! (garvinhicking) * Fixed possible SQL-Injection in Pingbacks (nohn; reported by Stefan Esser) * Kubrick template: Fix comments always printed as 'Anonymous', put entry/extended parts not together (garvinhicking) * Fix installer: Serendipity does not run with magic_quotes_runtime set to on. Emit warning and try to switch off the directive. (garvinhicking) * Updated chinese language files, thanks to Andrew Huang Version 0.8-beta3/4 (March 15th, 2005) ------------------------------------------------------------------------ * Drop SQL index on comment's body. This was not used in our code, and caused trouble with large comments on pgsql and MySQL. (garvinhicking) * Monthly entry summary shows correct date header (garvinhicking) * RSS / Syndication plugin now offers to hide E-Mail adresses from XML feeds (garvinhicking) * After installing a plugin you will be either redirected to plugin config or to plugin overview, so that an accidental browser refresh does not install the plugin twice (garvinhicking) * Fixed wrong date format in portuguese and czech languages (garvinhicking) * Fix buggy wordfiltering of spamblock plugin (garvinhicking) * Fixed variable name for all markup plugins. They previously used localized versions like 'Extended entry' and now use a proper language independent string. The upgrader takes care of replacing the variables so that no options will get lost (garvinhicking) * Fixed bug with Markup plugins not getting their right settings under certain circumstances (only for autologin cookie users) (garvinhicking) * Correctly detect 500 Internal Server Error when installing (garvinhicking) * Emitting language headers only if no headers were sent yet. This fixes problems with embedded serendipity installations. (garvinhicking) * Fix postgresql query problem, when using the entryproperties plugin and browsing the calendar with category restriction(s). Thanks to Larry Rosenman for helping out with this! (garvinhicking) * Introduce "div.container_X" CSS class for sidebar plugin items. X is substituted with the plugin classname, like "serendipity_plugin_categories". This class is contained in the 'default' template and all templates based on the sidebar.tpl file. (garvinhicking) * Fixed broken category pagination for "Newspaper" template (garvinhicking) * Bundle Tom Sommer's port of the Kubrick template * Fix hardcoded "templates" directory reference inside the admin style selector. * Updated czech language files, thanks to Josef Klimosz * Updated persian language files, thanks to Omid Mottaghi * Do not display rotation/resize image manipulation methods for hotlinked images (garvinhicking) * Do not use "layout.php" in Default template for upgrading users who did not delete that file from their directory (because the upgrade may not have sufficient write privileges to remove the file) (garvinhicking) * Make RSS import parse ISO-8601 dates (like '2004-11-24T22:43:08-05:00'), as PHPs strtotime() does not parse that. (garvinhicking) Version 0.8-beta2 (March 5th, 2005) ------------------------------------------------------------------------ * Show "create entry" toolbar for plugins like the Emoticon Chooser also when WYSIWYG editor is enabled (garvinhicking) * Do not display template engines in the template selector (tomsommer) * Fix HTML escaping of special characters for comments (garvinhicking) * Fix wrong username displayed in RSS comment feeds (garvinhicking) * Fixed bug that may occur on few plugins executing other plugins, like serendipity_event_entrypaging [this is the only bundled or internal plugin affected by the issue] (garvinhicking) Version 0.8-beta1 (March 4th, 2005) ------------------------------------------------------------------------ * Added Persian language and template for RTL-Languages by Omid Mottaghi * Fixed Windows path problems when synching with media manager. Thanks to Thomas Klinger for helping! (garvinhicking) * Media files can now be hotlinked to foreign servers and thus not using bandwidth from your own server. Media files can now also be searched by name. Thanks to Chris Chan for this feature! * Added ability to define a real name for each author. This is the name seen by readers of the blog. The username is now only used for logging into the administration suite (tomsommer) * Added ability to toggle the amounts of comments per page within a dropdown instead of needing to edit a Serendipity core file. (garvinhicking) * New configuration directive to tell Serendipity if the baseURL shall be autodetected. This can be useful if you use multiple domainnames listening on one blog installation. (Note: This auto- detection was previously already enabled if using 'embedded mode') (garvinhicking) * Fixed bug for postgreSQL: Comments for entries within multiple categories showed up as many times as the entry was within multiple categories. Thanks to rickmans from the forums for detecting this. (garvinhicking) * Added configuration directive to allow visitor language negotiation via browser language. (garvinhicking) * Added native importers to migrate entries, comments, categories and authors for: - geeklog 1.3.11 - sunlog 0.4.4 - b2Evolution "Paris" - boastMachine 3.0 - Textpattern 1.0rc1 - pMachine Pro 2.4 - bBlog 0.7.4 - Nucleus 3.15 - WordPress 1.5 / 1.2 - phpBB (garvinhicking) * Remember last state of media library (sort order, files per page, directory, sortfield), via JavaScript+Cookies (garvinhicking) * The config option 'extCSS' has been removed. It is now re- commended to set external stylesheets in the template's index.tpl file, or to @import it within the templates style.css file. (garvinhicking) * Personal Configuration allows to set defaults for creating new entries (allow comments, moderate comments, publish/draft) (garvinhicking) * When deleting a comment with nested comments, move nested ones to the parent of the deleted comment (fixes Bug #1079349) (garvinhicking) * Spamblock plugin allows to moderate/reject comments made via APIs like wfw:commentApi or trackbacks, but still allow normal comments (garvinhicking) * Fixed SQL index key creation on fresh installation (garvinhicking) * Upgraded htmlarea WYSIWYG editor to latest version. Entering links now properly works, as finally does Copy+Paste from Mozilla! (garvinhicking) * New pretty URLs "/blog/serendipity.css" and "/blog/serendipity_admin.css" as links to the Stylesheets. (garvinhicking) * Chief users are not allowed to hide plugins installed by other users. (garvinhicking) * Forbid uploading of active content files (.php, .shtml, ...) as user without Administrator privileges (garvinhicking) * Allow searching of the blog with pretty URLs, allow pagination of searched entries (garvinhicking) * Added handling of CONVERT BREAKS-directive in MT-Importer. Do the whole importing process in a transaction to ensure either all or no entires are imported. (pilif) * Added hook for external authentication. First implementation draft of LDAP auth added to additional_plugins CVS (garvinhicking) * Added an extended property to disable nl2br() for specific entries (pilif) * Added korean language by Erich Iseli (garvinhicking) * Change RSS feed's