Enano CMS (1.1.x): Changelog

setConfig() will now delete config values if the second parameter is explicitly set to false

HMAC functions are now standards-compliant (not a security issue). This BREAKS 1.1.6-hg passwords!

Added a basic plugin/hook framework for Javascript

[minor] changed heading format in mainpage-default

Added color specifications on input fields for admin and oxygen

Blah. Wrong type for those getConfig values.

Fixed: no default values in for avatar upload settings

[Oops] removed debug message in install-cli

Damn, forgot to add the version insertion back into schema

Major redesign of rendering pipeline that separates pages saved with MCE from pages saved with the plaintext editor (full description in long commit message) - Pages are now stored with an extra metadata field called page_format which is "wikitext" or "xhtml" - New $flags parameter + RENDER_* constants added that control RenderMan::render() behavior - Several other changes: * Added a sprite API for Javascript and made editor use sprites when possible * Removed a number of config options from the default install schema, replaced with second parameter to getConfig() calls * MessageBox in editor mostly replaced with miniPrompt * A few bugfixes related to password changes (registration didn't even work) * Rewrote the bitfield compression algorithm used to serialize allowed MIME types * Fixed some typos in language files and strings * Fixed a Text_Wiki bug in Heading parser

Made all page_id and namespace columns consistent

Added Unicode support for usernames and passwords (this is probably best considered a JS crypto bug)

Fixed https urls not allowed in user_extra CPs; fixed nonworking password reset in admin CP

Added a few hooks to Admin:GeneralConfig (didn't I do this already?)

Merging Nighthawk (anti-spam work) and Scribus (AJAX work + debugging + CLI installer) branches

Replaced integer checks that used preg_match() to use ctype_digit() instead

Added (very basic) spam filtering plugin support. Plugins can mark a message as spam by hooking into the spam check API, which is documented in functions.php. No spam checking functionality is built-in.

AJAX core library: possible breaking change, readystatechange functions are now called with the XHR instance as the first parameter, to allow requests to run in parallel. This means much better stability but may break some applets (compatibility hack is included)

Oxygen: synced mint style

PageProcessor: fix not setting page_exists to true after create_page() success (todo: move to Namespace_*?); add $visible parameter to create_page()

Change config.new.php and .htaccess.new to have a single newline according to Fedora project guidelines

Installer: add RewriteBase to .htaccess to work properly under aliased Apache setups (generated 404s in QA)

A few bugfixes in CLI installer related to interactivity

SECURITY: Fix XSS under IE in closing tags (shared sanitizer)

Fixed login form being focused too early (caused page to scroll up)

Deprecated old grab_password_hash() functions in session

Whoops! Fixed an SQL injection vulnerability in the CLI installer. (Not like it's a huge deal because the vulnerability was only introduced last commit and if you make it to that stage you already know the database password)

Added already-installed check to cli-core

Added CLI installer. Supports interactive, command-line, and internal-call installation. Fixed a few bugs related to anti-SQL injection parser and plugin installation.

Added support for live re-auth and de-auth; fully AJAX, no page reload required, plus plugin-usable API.

JS core: whiteOutReportSuccess now has a sister whiteOutReportFailure(); both abstracted to function whiteOutDestroyWithImage(whitey, image_url)

DBAL: Fixed issues with die_json() and multiline responses from {mysql,pg_last}_error()

Plugin manager: added support for having specific install and uninstall blocks per DBMS

Special:Administration: fixed 404 on several Tigra tree menu images

jBox: When an anchor in a menu is clicked, menu is now hidden

Fix undefined variable in special namespace missing function handler

If there's an onlineupgrade.php, installer index.php will link to that instead of upgrade.php (future readiness ;))

Fix version number warning in installer common

Upgrades should work now.

Two big commits in one day I know, but redid password storage to use HMAC-SHA1. Consolidated much AES processing to three core methods in session that should handle everything automagically. Installation works; upgrades should. Rebranded as 1.1.6.

Major underlying changes to namespace handling. Each namespace is handled by its own class which extends Namespace_Default. Much greater customization/pluggability potential, at the possible expense of some code reusing (though code reusing has been avoided thus far). Also a bit better handling of page passwords [SECURITY].

Added a couple of hooks for the registration form.

Redid error handler (it was causing some problems with gzip enabled)

Small speed optimization to admin panel loader

Revamped main page default content

Several thematic enhancements to Oxygen including making the main page title an h1

Added support for re-auth on submit to rank manager when session goes bad; still more to come

Added dynamic reload-less re-auth to admin panel, so that if a session is lost it can be recovered without a reload. Support for hooking into form submits will be added in the future.

Updated URLs and strings to point to the new server (ktulu)

Fixed a few bugs with plugin management and importing of old plugin metadata

Added support for upgrades from Ferrishyn

Added paginator_goto() to function reverse map; fixed some missing component loads in pagination code

When will that stupid user -> user_id bug stop REARING ITS UGLY HEAD. DIE! DIE! DIE! DIE! DIE!

Fixed: autocomplete got broken somehow

Unstable alpha release: 1.1.5 (Caoineag alpha 5)

Added ajaxReverseDNS to function-to-script map.

Added spell-checking support for TinyMCE on user request (see: http://forum.enanocms.org/topic/11/)

Minor cosmetic change to installer: bumped down Continue button on payload page by 12px

Corrected a few issues with languages and client-side code

A few fixes to the most recently added feature: more efficiency tweaks, tweaked l10n to have beetter fetch-on-demand support to ensure that stubs are never returned

load_component() now accepts an array, and most JS components are loaded all in one request now. Totally modular baby. And failsafe too.

Upgraded TinyMCE to version 3.2.1.1

[Branding] New artwork swapped in for the old. See <http://enanocms.org/News:1228698725>.

Fixed a couple PostgreSQL bugs.

Minor string change to match other string changes in 1.1 installer

Squashed one last typo.

Fixed a couple typos in mod_rewrite detection (I'm really doing this blind, as the source tree used for testing is different than the one for editing)

Fixed: checked for win32 but not winnnt

Merged WINDOWS_MOD_REWRITE_WORKAROUNDS changes from stable.

Fixed timezone preference setting not fully implemented; added ability for users to select their own rank from a list of possible ranks based on group membership and user level

Fixed: update_plugins_cache() is now tolerant of write errors

Fixed: private keys were way too long in EnanoMath

template: Fixed undefined $from_internal in assign_bool(); theme.cfg now require()d on theme load

Added support for IPv6 IP ranges... ehh, not easy.

Removed obsolete JWS code from enano-shared

[Minor] Enabled anonymous user autocompletion in ACL tracer

Fixed: editor state was not unlocked after draft save

Removed the completely obsolete old Special:CreatePage function

External links in sidebar now work with manual port numbers and IPv6 addresses

Plugins can now register their own custom actions for $_GET["do"].

Added additionalwhere option (it was already documented) to custom search API

Fixed PostgreSQL incompatibility in new search API

Added a new search API that allows much easier registration of search results. Basically you give the engine a table, a few columns to look at, and tell it how to format the results and you're done.

Fixed sliders not working right with non-Oxygen themes

[minor] optimized loading comments a little bit

Removed Slide-In-Slide-Out-Ala-Digg, replaced with jQuery

Fixed an onload recursion issue if load_component() is called during global onload

Out with those confusing redistribution terms. That whole clause is much more simple now. (TODO: this needs to be seriously looked over by beta 1)

Fixed: Admin:PageGroups create form did not init properly

Added dependency checking in ACL tracer

Added makeSwitchable Dynano method for textareas; enabled support for makeSwitchable in comment runtime

[minor] snip some debugging code from autofill

Add some performance info to jsres

Added full all-namespace transclusion support in RenderMan

Polished up inline rename in oxygen (todo: make this script shared/core?)

Fixed: Special:Memberlist still used SpryEffects

Fixed DiffieHellman only half-implemented in user admin CP (changing passwords did not work)

Added ability to have alternate main page for members

Moved getElementsByClassName to functions.js (dependency issues)

Fixed minor formatting bug in sidebar editor

load_component() now uses wait cursor on document.body

Fixed exception handling from session->fetch_page_acl() in ACL trace server side

Merging with upstream

Fixed error-out when DiffieHellman not supported and respawn requested (part of OS X QA process)

Made defectivebydesign.org image local

Added config option to grant userpage rights to new users (defaults to on, as it was hardcoded on before)

[minor] fixed non-hidden next button in ACL trace view

Merging in the past three months' work on ACL tracing tools.

[minor] Login box shook too slowly on failure

JSON parse failures should spawn their own darkener layer now instead of reusing the main one if applicable

Fixed DiffieHellman being included twice when not supported and login fails

Fixed plugin manager not checking for plugin file existence before marking to load

[minor] $template->footer() no longer flushes output buffers, due to headers being sent prematurely

[minor] AboutEnano can detect Mac OS X now

Fixed filename not being sent through sanitize_page_id() during upload. Non-security.

Fixed attempt at gzip compression after headers sent; hopefully safely escape args to scale_image() instead of erroring out

Fixed system table list; added safeguard against twice prefixing the tables in $system_table_list

Fixed issue where login box was not obeying server orders to disable DiffieHellman. Increased quality of error handling for JS errors during login process.

Made template inclusion wikisyntax fully MediaWiki-compatible

Fixed SpecialAdmin setting theme and style way too late (thanks Andrew Kohnken)

Added ability to use hash marks in internal links

Fixed nonworking editor preview due to uninitialized template

Marked Text_Wiki's parse_internal_links() as deprecated.

SECURITY: Changed Diffie-Hellman parameters to prime and generator created through OpenSSL

Added initial support for DST. Rules are defined in constants.php and are extensible.

Fixed IPv6 address match (the one from phpBB3 did not work)

Fixing \r\n bug in SQL parser (see comment on rev. 7a7173c0f62f in stable)

Rewrote sidebar compilation code, caching is more stable now and things were cleaned up/separated into more functions/made plugin-expandable. In theory, plugins can add new sidebar block types now. I'd personally like to see a fully plugin-based sidebar editor that completely overhauls what Enano has now sometime now that this framework is in place.

Fixed userpage events being fired even when the tabs aren't there

Fixed reference to $() which should be $dynano() in SpecialAdmin

Fixed draft controls being shown in view source mode

More work on auto-completion - it auto-scrolls now and limits result divs to 300px height

Fixed minor (non-XSS) sanitization issue for main_page field in Admin:GeneralConfig

Fixed cdnPath being set even if config entry is blank

Autocomplete further stabilized. Made Special:PasswordReset and Special:Register prevent use if logged in.

Re-merging key_type fix from nighthawk

Removed Adobe Spry and replaced with jQuery. Please report any new bugs on the forums or via IRC. In a related note, auto-completion should work now at least for usernames. Still hacking away at page name completion...

Made upgrades from 1.1.4 -> 1.1.5 work if keyhash is not present

Revamped page deletion interface; fixed bug where page_meta cache was not being cleared upon restoration of deleted page.

Added ENANO_NO_PLUGINS optional switch to common_cli.

Couple of fixes (hacks) for Opera and the aftermath of that z-index change to darken() and enlighten() fadefilters; added ajaxOpenDirectACLRule() to placeholder list

Fixed that exception that was thrown on draft save in fx3

Changed namespace properties (including core identifier) for external pages that load the Enano API to be a uniform "API" namespace and "SystemAPI:" prefix.

Made login forms that use $session->aes_javascript() use new whiteOutForm() function

Fixed ACL_TYPE_PRESET pseudo-rules being shown in rule list

Fixed missing "print page" link in printable theme

Added customizable parameters for session length and the long-missing "remember me" option (or rather, the ability to turn it off and make sessions temporary)

Fixed some stale code in generic autofill schema

Tagging latest revision as rebrand

Rebranded as 1.1.5 (Caoineag alpha 5) and fixed a couple bugs related to CDN support in template_nodb and installerUI. Updated readme.

A few fixes in SpecialUserFuncs: made avatars have a +30-day expiry date and made full login form show encryption blurb even when user_level > USER_LEVEL_MEMBER. Added expanding user-info blocks in memberlist (experimental).

Fixed a couple bugs in the check-for-updates code.

Fixed System pages not being createable even with proper admin rights. This is hackish, it probably needs to have something implemented at the ACL level.

SECURITY: Full query is no longer shown on SQL injection attempt; silenced calls to mysql_unbuffered_query() due to some untraceable yet harmless errors

Fixed minor z-index bug in jBox

Added preliminary support for ACL presets. Yay!

Some tweaks to common, real minor stuff that's been waiting to be committed for a couple weeks at least

Improved miniPrompt and fadefilter to properly overlap parent modal windows. MessageBox() is next. Fixed pref_disable_js_fx not working due to wrong type (number instead of boolean).

Made customizable 404 page have a {STANDARD404} variable available to allow embedding the "default" 404 content.

[Demo Security] Fixed plugin manager ignoring lockdown settings in demo mode

Fixed tooltip in Powered By Enano button on the sidebar. It called $lang->get() without checking to see if languages were initted yet.

Added abutton_img class + supporting properties in miniPromptMessage to allow icons on abuttons

Added tab-based interface to userpage UI. Yes, it is plugin expansible, and yes, it breaks existing plugins that add code to the userpage (but that can be fixed with a "colspan=4")

Added hack to printable theme to allow exporting of a website into static files (thanks vadi for the request); source for this functionality will be released soon

Fixed non-localized buttons in navbar on user CP, top menu trigger buttons should act as links again

Fixed undefined REQUEST_URI/HTTP_HOST in ENANO_CLI mode in template var init

Added ability to have language strings send variables through filter functions. Operates based on predefined filters, expandable with a call to Language::register_filter at the hook lang_init

Fixed improperly set up gzencode() replacement; fixed bad regexp in scale_image() security check

Made cdnPath define conditionally; fixed common_cli not properly loading plugins

Fixed missing PRIMARY KEY definitions in postgresql_stage2

Fixed a couple missing functions in placeholder_list in enano-lib-basic

Separated St. Patty CSS files into color theme and CSS

Made grinding_halt() exit with status 1 for POSIX compatibility; jscompress.php utility now accepts non-CDN websites

Made Admin:LangManager purge caches properly when uninstalling a language

Made Admin:UserManager accept "username" as well as "user" on GET

Fixed unlocalized column names in SecurityLog

Fixed non-localized group names in theme-manager

Made admin theme use jsres instead of JS_{HEADER,FOOTER} because of incompatibilities with Runt

Fixed some unlocalized strings in installer

Fixed unused $admintitle variable in $template->fading_button code generation; fixed missing CDNPATH, JS_HEADER, and JS_FOOTER in template_nodb; localized onpage_lbl_page_external

Made lang.php stop dying due to no strings installed for current language [experimental]

Fixed installer path check in Admin:Home; made admin-menu more compatible with componentized JS

Fixed MiniPrompt message boxes causing the window to scroll up

Improved JSON validation and error interface when validation fails; made rank manager support custom CSS

Added CDN support: a URL to a CDN can now be specified and Enano will load all images, CSS, and javascript (except TinyMCE) from that server

Fixed typo (missing equals sign) in allow_anon param to autofill username

Fixed missing require() on search.php in Special:Autofill (damn, when is this going to end?)

Fixed autofill ignoring existing ID for text box parent node. (yes, again)

Fixed disabled buttons sometimes not being apparent in admin theme

Fixed autofill ignoring existing ID for text box parent node. Note that autofill is still in a nonworking state.

Another dummy commit that Nighthawk insists on

Dummy commit because Mercurial wants to merge.

Damn it, something always gets mixed up!

NOW we can tag the release.

Permissions mix-up on Nighthawk, straightening things out. Unstable alpha release: 1.1.4 (Caoineag alpha 4)

Tagging for latest release

Re-merge of c9ea830a211f (oops)

Unstable alpha release: 1.1.4 (Caoineag alpha 4)

Fixed a few more PostgreSQL bugs with insert_id() and an issue with setting SERIAL columns manually. May break things if installed into a database without first dropping tables.

Fixed up the save routine in PageManager a bit

Final readme revision for release 1.1.4

Made the rank editor actually refresh the ranks cache upon creating/editing/deleting a rank. It's 5 in the morning, I'm going to bed, release is first thing after breakfast and coffee.

Added KNOWN_BUGS file.

Added group_rank option in admin group manager and user_title option in admin user manager

Fixed DiffieHellman in UserManager and added rank selector

Added Gravatar support in UserManager in admin panel

Rank editor is now in a working (beautiful) state. More intuitive than a Mac.

Fixed a few more upgrader glitches and polished things a bit more.

Refined upgrade process a bit. Uses libenanoinstall (incomplete), and post stage added to flush caches and import new strings

Hopefully fixed user_timezone bug in PostgreSQL upgrade

Fixed bad ALTER command in PostgreSQL 1.1.2 -> 1.1.3 upgrade

Fixed language string loading in upgrader

Fixed another bad tinyMCE reference in editor.js

Added Gravatar support! And it's really configurable too.

Added "default" option for getConfig() and made setConfig() only set if the new value is different

Oops, somehow changed mysql_query() to pg_query() in MySQL DBAL

Fixed undefined group_rank_id in sessions

Fixed missing require() on search.php in rebuild_page_index()

Got the installer working. Fixed a few bugs including a nasty-to-debug issue where the lang_id was being hardcoded during installation, resulting in strings being inserted with the wrong lang_id causing an infinfinite loop with fetch() throwing a "no strings" error and using template (which calls fetch()) to complain

Fixed lack of str_replace() to runtime-patch cache_anon_sidebar

Got user registration working with the new componentized JS framework

Completed work (we hope) on CacheManager admin page

Made CLI version of common load cache manager properly

Sprited icons for admin panel applets

Fixed gzip output - no longer depends on ob_gzhandler(), uses gzencode() now with a failsafe available if gzencode() is not available. Public function gzip_output() remains unchanged.

Fixed a few places where page metadata cache should have been purged (there may be a few more commits like this)

Merging nighthawk and scribus branches (now that nighthawk isn't panicked anymore)

First stab at cache management backend. Everything seems to have been tested and working so far, but a number of things require a more specialized cache and can't go through the framework (e.g. user ranks which use references to map usernames to user IDs)