Improved vimperator compatibility in jBox

SECURITY: Various security enhancements to password resets. They are now rate-limited by username and IP, and it is possible to disable username autofill for guests.

Fixed CLI installer failing to set the DB version

Release: 1.1.8pl1

Release prep 1.1.8pl1

SECURITY: CSRF protection in Private Messaging, which is a really broken feature and should get the TinyMCE treatment. *sigh* Reported by Secunia.

SECURITY: Fixed XSS in post-login page redirection. Reported by Secunia.

Fixed installer (DB revision was wrong); make editor load jQuery, as the editor requires it now

Removed TinyMCE from licenses page

Removed TinyMCE.

Removed explicit TinyMCE support, replaced with support for arbitrary page_formats. The TinyMCE files will be removed in an upcoming commit.

Added database transaction API. (Untested with Postgres)

Fixed a typo in which()

ajax get_styles is now case insensitive with the theme_id

functions: HTML compressor: fixed handling of <script> blocks which consist only of whitespace

More comments in enanium header

Fixed some variable issues in emailer

ACL permissions viewer has better formatting now

Corrected a link

Added another AJAX editor hook after init is pretty much done

Added set_post() in Request_HTTP

Added some more hooks to the page editing pipeline. It should now be possible to add controls to the page editor, send the data from them out to the server, and process them on the server side.

Fixed a postgresql bug in the File namespace (reported by phirox - thanks)

AES: Fixed wrongfully hardcoded $return_format/$input_format (non-security)

Added conflict resolution for wikitext heading names

Some enhancements to the error handler. It replaces out ENANO_ROOT for security, and if the warning is from dbal.php and ENANO_DEBUG is set, prints out a much more verbose message.

Changed var_export() calls to use "true" as second parameter. Not sure which PHP version it was added in, but I could have sworn it wasn't there last time I checked.

Fixed syntax error in plugins/admin/PageManager.php

Fixed some rather severe issues when changing the urlname of uploaded files

Added FLAC to list of file types. (In other news: I'm an audiophile)

Updated tags

Fixed title[]= too.

Tagged 1.1.8 as current-unstable

Tagged release: 1.1.8

Added a notice to re-import language on 1.1.8 upgrade

Tagged release: 1.1.7pl2

SECURITY: Fix SQL injection in banlist check (1.1.7 branch)

editor: removed extraneous debug info; changed around the order by which the textarea is created and appended to the DOM

Fixed bad language installation docs in common

SECURITY: Fix SQL injection in banlist check

SECURITY: Fix path disclosure in Special:Captcha

common: log Enano upgrades

Added a new "hide-with-mce" CSS class in Dynano; all elements which have it will be hidden when TinyMCE is activated, and re-shown when it is destroyed.

ImageMagick check now notes that only directories in the PATH are checked.

Fixed a table_prefix omission in File namespace code.

Parser updates. Added the "styled" keyword to wikitables to allow them to be styled using the current theme's standard table skinning, and changes to how the image tag parser decides how to display an image (framed, inline or raw).

Added an editor hook that allows plugins to insert their own content right before the editor box.

Fixed a rather major bug with the external link parser: two links in one line now handled gracefully.

Fixed check for iPhone OS 3 - it now returns true on 3.0 or any later version including 4.x

Merged

Fixed password field in HTML login not being focused during >USER_LEVEL_MEMBER auth

Hide the "Create an account" button if registration is disabled (Enanium only, but there is a template boolean called "registration_disabled" so other themes can use it too)

Merged (again)

Converted inlinerename.js in enanium to tabs

So, grinding_halt() now finally uses the new default theme in template_nodb.

Fixed display of username in comments (ranks enabled)