1 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
4 <title>Geeklog Documentation - Changes</title>
5 <link rel="stylesheet" type="text/css" href="../docstyle.css" title="Dev Stylesheet">
9 <p><a href="http://www.geeklog.net/" style="background:transparent"><img src="../images/newlogo.gif" alt="Geeklog" width="243" height="90"></a></p>
10 <div class="menu"><a href="index.html">Geeklog Documentation</a> - Changes</div>
14 <p>This document is intended to give a quick overview over the most important
15 and / or obvious changes. For a detailed list of changes, please consult the
16 <a href="../history">ChangeLog</a>. The file <tt>docs/changed-files</tt> has a
17 list of files that have been changed since the last release.</p>
19 <h2><a name="changes161">Geeklog 1.6.1</a></h2>
21 <h3>New Features and Improvements</h3>
24 <li>Geeklog now lets you enter meta descriptions and meta keywords for the main
25 page, for stories, topics, static pages, and polls. Please note that these
26 meta tags <a href="http://www.mattcutts.com/blog/keywords-meta-tag-in-web-search/">may not be used</a> by some search engines.</li>
27 <li>You can now have one featured story per topic (for stories set to "Show
29 <li>New autotags now allow you to embed polls in stories and everywhere else
30 where autotags are allowed.</li>
31 <li>The Migrate option in the install script can now also be applied to an
32 existing database (i.e. you don't need to import a database dump to update
33 your URLs and paths).</li>
34 <li>The Database Backup admin panel now includes options to optimize the
35 database and convert tables to InnoDB (MySQL only).</li>
36 <li>Minor security enhancements:
38 <li>"Important" cookies (like the session cookies) are now created with
39 the HttpOnly flag set. This will help avoid some XSS attacks,
40 provided your browser supports this flag.</li>
41 <li>Template errors will now trigger the <a href="http://www.geeklog.net/faqman/index.php?op=view&t=65">standard error handler</a> instead of
42 exposing the template path.</li>
43 <li>Fixed inclusion protection for some of the Spam-X class files.</li>
47 <p>Please also see the list of <a href="theme.html#changes">theme changes</a>.</p>
52 <li>Fixed automatic <a href="config.html#desc_article_comment_close_enabled">closing of stories for comments</a> after a certain amount of days. If you need to
53 re-open comments on stories that were closed due to this bug, you can use
55 <code style="margin-left:2em">UPDATE gl_stories SET commentcode = 0, comment_expire = 0 WHERE commentcode = 1;</code></li>
56 <li>The comment speed limit was being ignored.</li>
57 <li>The admin group for the Static Pages plugin was created with a wrong name
58 in Geeklog 1.6.0 (fresh installs only).</li>
61 <h2><a name="changes160sr2">Geeklog 1.6.0sr2</a></h2>
63 <p>This release addresses the following security issue:</p>
65 <li>Unauthorized file uploads were possible through FCKeditor.<br>
66 Uploaded files still had to go through FCKeditor's filter, so it was not possible to upload scripts (and the integrity of the Geeklog site as such was not in danger). There were, however, reports that this was used to host malware.<br>
67 This update prevents use of the upload feature when FCKeditor is disabled and disables it for anonymous users. It also doesn't allow uploading of archive files any more. Furthermore, you need some sort of "edit" permission now to be able to upload files through FCKeditor (this is meant as an interim measure - we will probably introduce a separate "upload" permission in future Geeklog versions).</li>
72 <li>Fixed installation using InnoDB tables.</li>
73 <li>Fixed a (non-exploitable) SQL error when auto-updating a story's
74 commentcode field.</li>
75 <li>Fixed a wrong function name in the Links plugin.</li>
79 <h2><a name="changes160sr1">Geeklog 1.6.0sr1</a></h2>
81 <p>This release addresses the following security issues:</p>
83 <li>Gerendi Sandor Attila reported an XSS in the forms to email a user and to
84 email a story to a friend.</li>
85 <li>The "Mail Story to a Friend" function didn't check story permissions, so
86 that it was possible to email a story even if you didn't have the
87 permissions to view it on the site.</li>
92 <li>Fixed an SQL error when submitting a story and the story submission queue
94 <li>Fixed calls to a nonexistent function <code>COM_outputMessageAndAbort</code>.</li>
98 <h2><a name="changes160">Geeklog 1.6.0</a></h2>
100 <h3>Results from the Summer of Code</h3>
102 <p>This release incorporates the following projects implemented during the
103 the 2008 Google Summer of Code:</p>
106 <li>Site migration support and easier plugin installation, by Matt West</li>
107 <li>Improved search, by Sami Barakat</li>
108 <li>Comment moderation and editable comments, by Jared Wenerd</li>
111 <h3>Other changes</h3>
114 <li>The minimum PHP version required by Geeklog is now <strong>PHP 4.3.0</strong>. Given that the PHP team ended support for PHP 4 in August 2008, you should be
115 looking into upgrading to PHP 5 anyway.</li>
116 <li>Includes <a href="http://www.fckeditor.net/">FCKeditor</a> 2.6.4.1</li>
117 <li>Includes a new plugin, <a href="http://wiki.geeklog.net/index.php/XMLSitemap_Plugin">XMLSitemap</a>, that automatically generates a <a
118 href="http://www.sitemaps.org/">XML sitemap file</a>, as supported by all
119 major search engines. Plugin written and provided by mystral-kk.</li>
120 <li>Several <a href="http://wiki.geeklog.net/index.php/New_Plugin_API_Functions_in_Geeklog_1.6.0">new plugin API functions</a> have been added and existing
121 functions have been extended.</li>
122 <li>The included documentation has been moved to <tt>docs/english</tt> to allow
123 for translations. Links to the documentation from within Geeklog will link
124 to existing translations for the current language automatically (or fall
125 back to the English documentation if no suitable translation can be found).</li>
126 <li>There were a variety of <a href="theme.html#changes">theme changes</a> to
127 support new functionality and fix inconsistencies in the layout.</li>
130 <p>This release also includes a number of patches and improvements made by
131 students applying for participation in the Google Summer of Code 2009. Thank
135 <h2><a name="changes152sr5">Geeklog 1.5.2sr5</a></h2>
137 <p>This release addresses the following security issues:</p>
139 <li>Gerendi Sandor Attila reported an XSS in the forms to email a user and to
140 email a story to a friend.</li>
141 <li>The "Mail Story to a Friend" function didn't check story permissions, so
142 that it was possible to email a story even if you didn't have the
143 permissions to view it on the site.</li>
147 <h2><a name="changes152sr4">Geeklog 1.5.2sr4</a></h2>
149 <p>Bookoo of the Nine Situations Group posted another SQL injection exploit, targetting an old bug in usersettings.php. As with the previous issues, this allowed an attacker to extract the password hash for any account and is fixed with this release.</p>
152 <h2><a name="changes152sr3">Geeklog 1.5.2sr3</a></h2>
154 <p>Bookoo of the Nine Situations Group posted another SQL injection exploit, this time targetting the webservices API. As with the previous issue, this allowed an attacker to extract the password hash for any account and is fixed with this release.</p>
157 <h2><a name="changes152sr2">Geeklog 1.5.2sr2</a></h2>
159 <p>Bookoo of the Nine Situations Group posted an SQL injection exploit for glFusion that also works with Geeklog. This issue allowed an attacker to extract the password hash for any account and is fixed with this release.</p>
162 <h2><a name="changes152sr1">Geeklog 1.5.2sr1</a></h2>
164 <p>Fernando Muñoz reported a possible <a href="http://en.wikipedia.org/wiki/XSS" title="Click to look up 'XSS' on Wikipedia" style="text-decoration: none; color: black; border-bottom: 1px dotted black;">XSS</a> in the query form on most admin panels that we are fixing with this release.</p>
167 <h2><a name="changes152">Geeklog 1.5.2</a></h2>
172 <li>Fixed a bug in the story preview where the story content was lost when
173 previewing a story with a duplicate story ID.</li>
174 <li>Fixed another bug in the story preview that caused extra backslashes to
175 appear in the story's title.</li>
176 <li>The Trackback editor didn't work since the security token was missing from
177 the editor template.</li>
178 <li>Fixed issues with clickable links in plain text postings.</li>
179 <li>Fixed various problems with updating feeds, e.g. when changing topic
183 <h3>Fixes in the bundled Plugins</h3>
186 <li>Calendar: You couldn't add a new event to your personal calendar.</li>
187 <li>Links: Changing a link's ID to one that was already in use overwrote the
189 <li>Polls: Changing a poll's ID created a new poll. Also fixed an SQL error
190 when the poll question contained single quotes.</li>
191 <li>Static Pages: Saving a static page changed the owner to the user who saved
195 <h3>Other Changes</h3>
198 <li>Improved image quality when using gdlib to rescale uploaded images.</li>
199 <li>Theme changes are documented in the <a href="theme.html#changes">theme
200 documentation</a>, as usual. There are 4 bugfixes (one of which is in the
201 templates for the Polls plugin) that should be applied to all themes for
202 the 1.5.x series.</li>
206 <h2><a name="changes151">Geeklog 1.5.1</a></h2>
208 <p>Geeklog 1.5.1 is mostly a bugfix release and a recommended upgrade for users
209 of Geeklog 1.5.0. There were also a few minor feature additions.</p>
213 <h4>Security related</h4>
216 <li>The upload script for FCKeditor could be <a
217 href="http://www.geeklog.net/article.php/file-uploads">called directly</a>
218 to upload various media files (but not executable scripts), as reported
220 <li>The protection in various include files against direct execution did not
221 work properly on non-case sensitive file systems, e.g. on Windows
222 (reported by Mark Evans).</li>
223 <li>It was possible to view stories with a publication date in the future and
224 stories that had the draft flag set if you knew their story ID.</li>
225 <li>It was possible to post comments on unpublished stories if you knew their
227 <li>When a database backup fails, the database password is no longer logged to
228 <tt>error.log</tt>.</li>
231 <h4>Other Bugfixes</h4>
234 <li>All right-side blocks were rendered twice, which not only took more time
235 than necessary, but could also affect the functionality of add-ons like
236 the Chatterblock or Shoutbox.</li>
237 <li>Fixed handling of security tokens (for CSRF protection) that prevented
238 you from deleting comments on a story that had trackbacks.</li>
239 <li>Other fixes were applied to the user submission queue, story submissions,
240 the list of draft stories and the support for MS SQL.</li>
243 <h4>Fixes in the bundled Plugins</h4>
246 <li>Calendar: Fixed display of events in the Upcoming Events block for the
247 current day (really this time ...).</li>
248 <li>Links: Fixed SQL error when trying to change a category and fixed new
249 categories silently overwriting existing categories with the same ID.</li>
250 <li>Static Pages: Fixed printer friendly version when <tt>url_rewrite</tt> is
254 <h3>New Features and Improvements</h3>
257 <li>Includes <a href="http://www.fckeditor.net/">FCKeditor</a> 2.6.3</li>
258 <li>In multi-language setups, blocks can now also be multi-lingual.</li>
259 <li>New "Subscribe to ..." feed story option when there is a separate feed for
260 a story's topic.</li>
261 <li>New option "All Frontpage Stories" for article feeds (skip stories that have
262 the "Show only in topic" option set).</li>
263 <li>Allow to unset Configuration options again after they have been "restored",
264 e.g. after accidental activation.</li>
265 <li>Configuration options can now be overwritten in <tt>siteconfig.php</tt>.
266 This is mostly useful for the <code>$_CONF['rootdebug']</code> option.</li>
267 <li>Remotely authenticated users can now use the webservices (they need to use
268 <tt>username@servicename</tt> for their username).<br>
269 <strong>Note:</strong> OpenID users can <em>not</em> use the webservices,
270 due to technical issues with the authentication method.</li>
271 <li>Improved compatibility of the webservices (i.e. AtomPub).</li>
274 <h3>Theme Changes</h3>
276 <p>There was one mandatory theme change: The template file for configuration
277 items, <tt>admin/config/config_element.thtml</tt> has to be updated (copy
278 from the Professional theme). All other theme changes in this release are
279 optional - see the <a href="theme.html#changes">theme documentation</a> for
283 <h2><a name="changes150">Geeklog 1.5.0</a></h2>
285 <h3>Results from the Summer of Code</h3>
287 <p>This release incorporates the following projects implemented during the
288 the 2007 Google Summer of Code:</p>
291 <li>New user-friendly install script by Matt West</li>
292 <li>New Configuration GUI (replacing config.php) by Aaron Blankstein</li>
293 <li>New Webservices API based on the Atom Publishing Protocol by Ramnath R. Iyer</li>
296 <h3>Other New Features and Improvements</h3>
299 <li>OpenID support: You can now allow users to log into your site using an
300 OpenID, so that they don't need to create a new account with your site but
301 still get all the benefits of a normal registered user.</li>
302 <li>New LDAP remote authentication module.</li>
303 <li>The Links plugin now has hierarchical (sub-)categories.</li>
304 <li>Updated <a href="http://www.fckeditor.net/">FCKeditor</a> to version 2.6.</li>
305 <li>Rewrite of the underlying story code. Amongst other things, this should
306 finally resolve all outstanding issues with the handling of special
307 characters, HTML entities, etc. in stories. Also introduces a new
308 <code>[raw]</code> tag as an inline complement to <code>[code]</code> when
309 you want to post pieces of code (e.g. HTML) "as is", so that they are not
311 <li>Comments can now be closed, i.e. existing comments will still be displayed
312 but no new comment can be posted.</li>
313 <li>The Polls plugin now allows for multiple questions per poll.</li>
314 <li>The Static Pages plugin now supports comments.</li>
315 <li>The database backup admin panel now lets you delete and download
317 <li>The default Professional theme is now HTML 4.01 Strict compliant. Geeklog
318 now also <a href="theme.html#xhtml">supports XHTML</a> (given an XHTML
319 compliant theme).</li>
325 <li>Geeklog now includes protection against <a href="http://www.geeklog.net/article.php/csrf">cross-site request forgery</a> attacks.</li>
326 <li>Lukasz Pilorz reported <a href="http://www.geeklog.net/article.php/kses">security issues in kses</a>, the HTML filter we're using in Geeklog.</li>
330 <h2><a name="changes141">Geeklog 1.4.1</a></h2>
332 <h3>New Features</h3>
335 <li>Support for Microsoft SQL Server. Starting with this release, Geeklog can
336 now also be installed on Microsoft SQL Server, so it's no longer restricted
337 to just MySQL. The MS SQL support was developed by Randy Kolenko.
339 Please note that any third-party plugins will have to offer support for
340 MS SQL before they can be installed on Microsoft SQL Server. The bundled
341 plugins (Calendar, Links, Polls, Spam-X, Static Pages) have already been
342 updated accordingly.</li>
343 <li><a href="calendar.html">Calendar plugin</a>. The formerly built-in calendar
344 and events have now been moved into a separate plugin. This complements the
345 move of the <a href="polls.html">polls</a> and <a href="links.html">links</a> sections into plugins in Geeklog 1.4.0 and makes Geeklog more modular as you
346 can now easily disable or replace functionality that you don't need for
348 <li><a href="http://wiki.geeklog.net/wiki/index.php/Multi-Language_Support">Multi-language support</a>. It is now possible to build truly multi-lingual sites
349 with Geeklog where not only the navigation but also the content of the site
350 changes with the language.</li>
351 <li>Ships with <a href="http://www.fckeditor.net/">FCKeditor</a> 2.3.1, which once
352 again includes a file manager for uploading images.</li>
353 <li>A function for mass-deletion of old or inactive users. The list automatically
354 searches for users that have never logged in, only used the site for a very
355 short time or have not been online since a very long time. The time span can
356 be varied, and found users can be selectively deleted.</li>
361 <p>In the light of the security issues discovered in Geeklog 1.4.0 and earlier
362 versions, the Geeklog source code has undergone a code review. We have
363 identified and addressed several minor issues and introduced new measures to
364 enhance security in this release. As a welcome side effect, the code reviews
365 have also uncovered a few bugs and inconsistencies that we also fixed in this
368 <h3>Spam Protection</h3>
370 <p>With this release we are finally removing support for the <a href="http://www.geeklog.net/article.php/mt-blacklist-discontinued">discontinued</a> MT-Blacklist. In its place, we are now using a system called Spam Link Verification (SLV) run by Russ Jones at <a href="http://www.linksleeve.org/">www.linksleeve.org</a>. SLV could be described as a community-driven, automatically updated blacklist. See the documentation of the <a href="spamx.html" rel="nofollow">Spam-X plugin</a> for details.</p>
373 <h2><a name="changes140sr6">Geeklog 1.4.0sr6</a></h2>
375 <p>MustLive pointed out a possible <a href="http://en.wikipedia.org/wiki/XSS" title="Click to look up 'XSS' on Wikipedia" style="text-decoration: none; color: black; border-bottom: 1px dotted black;">XSS</a> in the form to email an article to a friend that we're fixing with this release.</p>
378 <h2><a name="changes140sr5-1">Geeklog 1.4.0sr5-1</a></h2>
380 <p>This release fixes display problems in the comment preview that were only
381 introduced in Geeklog 1.4.0sr5.</p>
384 <h2><a name="changes140sr5">Geeklog 1.4.0sr5</a></h2>
386 <p>JPCERT/CC informed us about a possible <a href="http://en.wikipedia.org/wiki/XSS" title="Click to look up 'XSS' on Wikipedia" style="text-decoration: none; color: black; border-bottom: 1px dotted black;">XSS</a> in the comment handling that we're fixing with this release.</p>
389 <h2><a name="changes140sr4">Geeklog 1.4.0sr4</a></h2>
391 <p>Two exploits have been released by "rgod" for insecure Geeklog installations and for a bug in the "mcpuk" file manager that we've been shipping as part of FCKeditor in all previous 1.4.0 releases.</p>
394 <li>Some of the files outside of the public_html directory were not protected
395 against direct execution. If Geeklog was installed such that those files
396 were accessible from a URL (which has always been strongly discouraged in
397 the installation instructions) then those files could be used to load and
398 execute malicious code from a remote server.
401 href="http://www.geeklog.net/article.php/so-called-exploit">So-called
402 Geeklog "exploit" posted</a>
404 In this release, we've added the missing execution prevention for all files
405 outside of public_html. We would still, however, suggest that you fix your
406 Geeklog install if the files outside of public_html are accessible from a
408 href="http://www.geeklog.net/faqman/index.php?op=view&t=56">FAQ</a> for
411 <li>The "mcpuk" file manager that we've integrated into FCKeditor allowed the
412 upload of arbitrary PHP code (even if FCKeditor was disabled in Geeklog's
413 config.php). Depending on your webserver's configuration, it was then
414 possible to execute that uploaded code.
416 More information: <a href="http://www.geeklog.net/article.php/exploit-for-fckeditor-filemanager">Exploit for FCKeditor's mcpuk file manager</a>
418 The file manager has been removed from this release. You will therefore no
419 longer be able to upload files, e.g. images, through FCKeditor. Future
420 versions of Geeklog will ship with an updated version of FCKeditor and its
421 included file manager.
425 <p>Note: This release also includes the <a
426 href="http://www.geeklog.net/article.php/fighting-trackback-spam">updated
427 lib-trackback.php</a> for better protection against Trackback spam.</p>
430 <h2><a name="changes140sr3">Geeklog 1.4.0sr3</a></h2>
432 <p>This release addresses the following security issues:</p>
434 <li>Possible SQL injection and authentication bypass in <tt>auth.inc.php</tt>
435 (reported by the Security Science Researchers Institute Of Iran).</li>
436 <li>Possible XSS in <tt>getimage.php</tt>
437 (reported by the Security Science Researchers Institute Of Iran).</li>
438 <li>Path disclosure in <tt>getimage.php</tt> and the <tt>functions.php</tt> of
439 some themes, e.g. the Professional theme
440 (reported by the Security Science Researchers Institute Of Iran).</li>
441 <li>Possible SQL injection in story submissions.</li>
445 <h2><a name="changes140sr2">Geeklog 1.4.0sr2</a></h2>
447 <p>This release addresses the following security issues:</p>
449 <li>Konstantin Dyakoff found an old bug in the session handling that would
450 allow anyone to log in as any user.</li>
451 <li>HTML was not stripped from the Location field in a user's profile.</li>
455 <h2><a name="changes140sr1">Geeklog 1.4.0sr1</a></h2>
457 <p>This release addresses the following security issues:</p>
459 <li>James Bercegay of GulfTech Security Research reported several issues with
460 Geeklog's cookie handling that made it vulnerable to SQL injections,
461 arbitrary file access, and even injection and execution of arbitrary
466 <h2><a name="changes140">Geeklog 1.4.0</a></h2>
468 <p><small>(Geeklog 1.4.0 was originally supposed to be called 1.3.12, so any
469 references you may find to a version 1.3.12 apply to version 1.4.0)</small></p>
471 <h3>New Features</h3>
474 <li>Geeklog now officially works with <code>register_globals = off</code>.
475 Please note that some plugins may still require it to be <code>on</code>,
477 <li>Added support for sending and receiving <a
478 href="http://en.wikipedia.org/wiki/Trackback">Trackback</a> and <a
479 href="http://en.wikipedia.org/wiki/Pingback">Pingback</a> comments. Both
480 are supported for stories, but there is also a new plugin API so that
481 plugins can use this feature, too. Trackback and Pingback can be disabled
482 in <tt>config.php</tt>.</li>
483 <li>Added the ability to "ping" weblog directory services to advertise site
484 updates (preconfigured to ping <a
485 href="http://pingomatic.com">Ping-o-Matic</a>). As with Trackback and
486 Pingback, this is supported for stories, but plugins can also make use of
487 this feature via the plugin API.</li>
488 <li>New syndication framework so that Geeklog can now <strong>read and
489 write</strong> feeds in different formats (currently supported: RSS, RDF,
491 <li>New administrator controlled user status. Including banning and
492 administrator activation of accounts.</li>
493 <li>New Remote Authentication system to allow people with accounts on remote
494 services such as Blogger.com or LiveJournal.com to login to your site
495 without having to directly register on your site. (Remote accounts can be
496 banned as normal accounts).</li>
497 <li>The Admin sections have been revamped to provide a more consistent look and
498 sortable lists. "Command and Control" (<tt>moderation.php</tt>) now also
499 comes with a new set of icons and has one icon for every Admin section.
500 Furthermore, the Admin block and Command and Control can be <a
501 href="config.html#desc_sort_admin">sorted</a> alphabetically.</li>
502 <li>Ships with <a href="http://www.fckeditor.net/">FCKeditor</a> (WYSIWYG
503 editor). To <a href="config.html#desc_advanced_editor">enable</a>, set
504 <code>$_CONF['advanced_editor'] = true;</code> in your
505 <tt>config.php</tt>.</li>
506 <li>The search now only displays a specified amount of results per page to
507 avoid running into timeouts when searching through large databases.<br>
508 <b>Note:</b> Plugins will have to be updated to support the "paged" search.
509 Until then, Geeklog fakes the paged results for plugin searches, which
510 means that a plugin that hasn't been updated will still search through the
511 entire database, but Geeklog will only display the results for the current
513 <li>Introduced an "Article Directory", providing an overview of all past
514 articles, sorted by year and month.</li>
515 <li>The default permissions for new objects (stories, topics, blocks, etc.) can
516 now be set in config.php.</li>
519 <h3>Compatibility</h3>
522 <li>Due to the changes, themes will have to be updated to work with Geeklog
523 1.4.0. See the <a href="theme.html#changes">list of theme changes</a> for
525 <li>The plugin API for comments has changed. Plugins using comments will have
526 to be updated to work with Geeklog 1.4.0.</li>
529 <h3>More Information</h3>
531 <p>We have posted a series of stories on the Geeklog homepage that highlight and explain some of the new features:</p>
533 <li><a href="http://www.geeklog.net/article.php/advanced-editor">Geeklog's Advanced Editor</a></li>
534 <li><a href="http://www.geeklog.net/article.php/remote-authentication">Remote Authentication</a></li>
535 <li><a href="http://www.geeklog.net/article.php/trackback-pingback">Trackback and Pingback</a></li>
536 <li><a href="http://www.geeklog.net/article.php/ping">Sending a Ping</a></li>
537 <li><a href="http://www.geeklog.net/article.php/comment-plugin-api">New Comment Plugin API</a></li>
541 <h2><a name="changes1311sr7">Geeklog 1.3.11sr7</a></h2>
543 <p>JPCERT/CC informed us about a possible <a href="http://en.wikipedia.org/wiki/XSS" title="Click to look up 'XSS' on Wikipedia" style="text-decoration: none; color: black; border-bottom: 1px dotted black;">XSS</a> in the comment handling that we're fixing with this release.</p>
546 <h2><a name="changes1311sr6">Geeklog 1.3.11sr6</a></h2>
548 <p>This release addresses the following security issues:</p>
550 <li>Possible SQL injection and authentication bypass in <tt>auth.inc.php</tt>
551 (reported by the Security Science Researchers Institute Of Iran).</li>
552 <li>Possible XSS in <tt>getimage.php</tt>
553 (reported by the Security Science Researchers Institute Of Iran).</li>
554 <li>Path disclosure in <tt>getimage.php</tt> and the <tt>functions.php</tt> of
555 some themes, e.g. the Professional theme
556 (reported by the Security Science Researchers Institute Of Iran).</li>
557 <li>Possible SQL injection in story submissions.</li>
561 <h2><a name="changes1311sr5">Geeklog 1.3.11sr5</a></h2>
564 <li>Konstantin Dyakoff found an old bug in the session handling that would
565 allow anyone to log in as any user.</li>
569 <h2><a name="changes1311sr4">Geeklog 1.3.11sr4</a></h2>
571 <p>This release addresses the following security issues:</p>
573 <li>James Bercegay of GulfTech Security Research reported several issues with
574 Geeklog's cookie handling that made it vulnerable to SQL injections,
575 arbitrary file access, and even injection and execution of arbitrary
580 <h2><a name="changes1311sr3">Geeklog 1.3.11sr3</a></h2>
582 <p>This release addresses the following security issues:</p>
585 <li>Provided you knew the story id, it was possible to submit comments for
586 stories even if you did not have access to those stories
587 (reported by LWC). The same problem also existed with poll comments.</li>
588 <li>Supplying an illegal start or end date to the advanced search resulted in a
589 warning message that disclosed the path to the Geeklog install on the
590 server (reported by r0t3d3Vil).<br>
591 It was <strong>not</strong> possible to use this for SQL injections.</li>
594 <p>Also included in this release are bugfixes, e.g. for the problems editing
595 static pages when URL rewriting was enabled, that were introduced in
599 <h2><a name="changes1311sr2">Geeklog 1.3.11sr2</a></h2>
601 <p>This release provides security enhancements and better spam protection
602 originally developed for Geeklog 1.3.12. It also addresses a few bugs where
603 the bugfix could be integrated with a reasonable amount of work (other bugfixes
604 will have to wait for the 1.3.12 release).
606 <h3>Security and Spam protection</h3>
608 <li>There is now a speed limit for login attempts, defaulting to three tries
609 in a five minute period (<a
610 href="config.html#desc_login_attempts">configurable</a> in
611 <tt>config.php</tt>).</li>
612 <li>Linefeeds are filtered from the To:, From:, and Subject: fields of any
613 email sent through <code>COM_mail</code>.</li>
614 <li>When a new user account is created and the user submission queue is enabled
615 in <tt>config.php</tt>, Geeklog now ensures that the new account is properly
616 queued even in the unlikely event that the account creation fails halfway
618 <li>When a post is identified as spam, it now also triggers the speed limit
619 (ie. posters will have to wait for the speed limit to expire before they
620 can make another submission).</li>
621 <li>Spam posts now get a 403 "Forbidden" HTTP response code.</li>
622 <li>Spam checks are now done for comments, story, link, and event submissions,
623 the message sent with the "email story to a friend" option, and for the
624 contents of the user profile.</li>
625 <li><a href="http://www.geeklog.net/article.php/spam-x-1.0.2"
626 rel="nofollow">Spam-X plugin 1.0.2</a> included.</li>
629 <p>Please note that MT-Blacklist (used by Spam-X) has recently been <a href="http://www.geeklog.net/article.php/mt-blacklist-discontinued">discontinued</a>. The
630 Spam-X plugin as included in this release is configured to get the last version
631 of the blacklist from geeklog.net, but there will be no more updates.</p>
635 <li>Fixed an error message thrown up by PHP 5.0.5 or later when viewing the
636 article page (bug #483).</li>
637 <li>Quote names in email addresses as soon as they contain any non-alphanumeric
638 characters, apart from the blank (bug #368). This should help when trying
639 to email users with special characters in their name.</li>
640 <li>Upgraded included kses class to version 0.2.2 which fixes problems with
641 Japanese and Thai characters (bugs #94 and #119).</li>
642 <li>Fixed SQL error when using the [staticpage:] autotag (bug #373).</li>
644 <p>For a complete list of bugfixes, please see the Changelog.</p>
646 <h3>Improvements</h3>
648 <li>Added support for a <code>custom_usercheck</code> function (for the
649 custom registration code). See the included <tt>lib-custom.php</tt> for
651 <li>Improved handling of the auto-archive option in <tt>index.php</tt>, which
652 should slightly improve page load times.</li>
653 <li>Includes several new and updated language files.</li>
654 <li>Includes updated PEAR classes.</li>
658 <h2><a name="changes1311sr1">Geeklog 1.3.11sr1</a></h2>
659 <p>This release addresses the following security issue:</p>
661 <li>Stefan Esser found an SQL injection that can, under certain circumstances,
662 be exploited to extract user data such as the user's password hash.</li>
665 <h2><a name="changes1311">Geeklog 1.3.11</a></h2>
667 <p>Geeklog 1.3.11 is a <strong>bugfix and security release</strong> over Geeklog 1.3.10 and is meant to replace 1.3.10. The change in the version number was necessary since one of the bugfixes involves a change in the database.</p>
669 <h3>Security issues</h3>
671 <li>It was possible to submit stories anonymously even if anonymous submissions
672 were turned off in <tt>config.php</tt> (reported by Barry Wong).<br>
673 These stories still ended up in the submission queue, though, unless you
674 disabled it in <tt>config.php</tt>.</li>
675 <li>Some of the parameters in link and event submissions weren't filtered,
676 leaving them open to potential SQL injections.</li>
677 <li>The links for the What's Related block were created from the unfiltered
678 story text, opening the possibility of XSS attacks (reported by Vincent
684 <li>Fixes the length of the 'sid' field in the gl_comments table. Using story
685 IDs longer than 20 characters prevented comment posts from being associated
687 <li>Ensures compatibility with PHP 4.1.x (includes updated PEAR packages).</li>
688 <li>Fixes the archiving option being activated too early (bug #345).</li>
689 <li>Properly deletes comments and story images when deleting entire topics
691 <li>Deletes comments when deleting polls.</li>
692 <li>Fixes several bugs in the calendar and improves overall handling of both
693 the site calendar and the personal calendars (bugs #268, #336, #338, and
695 <li>Fixes "More by <i>author</i>" and "More from <i>topic</i>" links in
697 <li>Various other fixes, see <tt>docs/history</tt> for details.</li>
700 <p>We strongly advise users of Geeklog 1.3.10 to upgrade to 1.3.11 ASAP. Upgrading should be relatively painless, as there weren't any changes in the themes, language files, or config.php over 1.3.10.</p>
703 <h2><a name="changes1310">Geeklog 1.3.10</a></h2>
705 <h3>New Default Theme</h3>
707 <p>This release comes with a new default theme: We've chosen the Professional
708 theme, kindly provided by Victor B. Gonzalez (of <a href="http://aeonserv.com">Aeonserv</a> fame). The theme has been modified slightly and is now fully HTML 4.01 and CSS compliant.</p>
710 <p>We've also decided to remove the old set of themes (Classic, Clean, Digital Monochrome, Gameserver, Smooth Blue, XSilver, Yahoo) from the distribution. They are now available as a separate tarball.</p>
712 <h3>New Features</h3>
715 <li><a href="spamx.html" rel="nofollow">Spam-X plugin</a> included. Tom Willet
716 has kindly provided his spam detection plugin, which is now part of the
717 default Geeklog install.<br>
718 The plugin has been modified slightly to store the blacklists in the
719 database. Users of the previous version of the plugin will have to import
720 their personal blacklist via the plugin's admin panel.</li>
721 <li>Story Archive feature: It is now possible to move stories to an "archive"
722 topic or have them deleted automatically at a given time.</li>
723 <li>Customizable menu bar: The site's menu bar can now be <a
724 href="config.html#desc_menu_elements">configured</a> in config.php, i.e.
725 you can choose which entries should be displayed there and in which order.
726 It's also possible to add custom entries by providing a function in
728 <li>Clickable links in text postings: URLs in non-HTML postings are now
729 recognized by Geeklog and displayed as clickable links.</li>
730 <li>Editable story IDs: The IDs of stories can now be changed (like the IDs of
731 static pages) to provide more readable URLs (and further improve the
732 chances of being picked up by seach engines, especially when used with
734 <li>Autolinks are a new form of links that can be used in stories and comments.
735 An autolink takes the form
736 <code>[<i>name</i>:<i>id</i> <i>link text</i>]</code> where <i>name</i> is
737 the tag name, <i>id</i> is the ID of an object the link should be pointing
738 to, and <i>link text</i> is used as the text of the link.<br>
739 Example: <code>[story:email-bug About the email bug]</code> would be
740 translated into <code><a href="http://example.com/article.php/email-bug">About the email bug</a></code><br>
741 For the built-in autotags, the <i>link text</i> is optional and Geeklog
742 will use the title of the object (story / event / static page) if it is not
744 Predefined autotags are <code>[story:]</code> to link to stories and
745 <code>[event:]</code> to link to events. Plugins can define their own
746 autotags to provide links to objects under their control. The Static Pages
747 plugin already provides a <code>[staticpage:]</code> autotag.</li>
748 <li>Customizable welcome email: The email that is sent out to users
749 registering with your site is now fully customizable by providing the
750 text in a text file (/path/to/geeklog/data/welcome_email.txt).</li>
751 <li>Timezone hack: The popular "<a
752 href="http://www.geeklog.net/forum/viewtopic.php?showtopic=40196">timezone
753 hack</a>" is now included. It lets you set the site's timezone for when
754 your server is located in another timezone.</li>
757 <h3>Other Improvements</h3>
760 <li>Various changes have been made to improve the overall performance.</li>
761 <li>On fresh installs, there is now an option to use InnoDB tables (instead of
762 MyISAM) if your MySQL version supports them (as of MySQL 4.0, or 3.x "Max"
763 builds). Existing databases can be converted to InnoDB by using the script
764 <tt>admin/install/toinnodb.php</tt>.<br>
765 <strong>Warning:</strong> Using InnoDB tables makes database backups
766 somewhat more complicated. Small and medium-sized sites should work just
767 fine with MyISAM tables, so if in doubt <em>don't</em> use InnoDB
769 <li>The calendar's week can now either start on a Sunday or a Monday.</li>
770 <li>The Static Pages plugin now has an option to display a printer-friendly
771 version of a static page.</li>
777 <li>The comment code has undergone major changes to improve performance and
778 add improvements like the ability to link to individual comments,
779 paging comments, etc.</li>
780 <li>Users can now report abusive comments to the site admin.</li>
781 <li>The site admin can get an email notification when a new comment is
782 posted (similar to the notification emails for new stories, links,
783 events, and users).</li>
784 <li>The IP addresses of comment posters are now tracked and can be looked up
785 directly by linking to a Whois service (or you can install Tom Willet's
786 <a href="http://sf.net/project/showfiles.php?group_id=68255&package_id=95743">NetTools</a>, which include a Whois function).</li>
789 <h3>Security-related fixes</h3>
791 <p><strong>Note:</strong> All of the following bugs were problems with
792 Geeklog's permissions system and fall into the "information leakage" category,
793 i.e. under certain circumstances, site content was visible to persons who
794 shouldn't be able to see it. None of these bugs were exploitable in the sense
795 that they could be used to gain privileges or cause damage to Geeklog or the
796 environment it's running in.</p>
799 <li>Group Admins were able to list the members of all groups, even if they were
800 not members of those groups.</li>
801 <li>Group Admins were given a list of all the groups in the system, even if
802 they were not members of those groups (bug #280).</li>
803 <li>Story and Event Admins were always given a list of all the stories / all
804 the events, even when they didn't have read access to them (bug #269).</li>
805 <li>It was possible to request comments from stories even if the user didn't
806 have permission to read the story (provided you knew both the story and
807 the comment id).</li>
808 <li>Event permissions in the calendar's day and week view weren't checked
809 properly, so that events may have been visible to users who shouldn't
810 have been able to see them.</li>
811 <li>It was possible to add any event to the personal calender, even if you
812 didn't have permissions to see it in the site calendar (provided you knew
816 <h3>Other bugfixes</h3>
819 <li>Previewing and saving a story submission left the submitted story in the
820 submission queue, but did additionally save it as a new story.</li>
821 <li>Deleting an event from the personal calendar didn't work (bug #199).</li>
822 <li>Old userphotos weren't removed when the new photo had a different file
823 type, e.g. when changing from a .gif to a .jpg (bug #228).</li>
824 <li>Scaling images didn't work when the image exceeded the max. height but
825 not the max. width (bug #242).</li>
826 <li>Keeping an unscaled image wasn't possible when using gdlib to rescale
827 images (bug #197).</li>
828 <li>When using gdlib, GIF images were converted to PNG format, but Geeklog
829 was still trying to display the GIF version. Since the LZW patent has
830 now <a href="http://www.unisys.com/about__unisys/lzw">expired</a>, it is
831 safe to use GIF images again and the PNG conversion has been dropped.</li>
832 <li>The tarball also includes updated PEAR packages which should address the
833 email problems some users were having (bug #246).<br>
834 <strong>Note:</strong> These are the same PEAR packages that already
835 shipped with Geeklog 1.3.9sr2.</li>
838 <p>Please note that there have also been <a href="theme.html#changes">theme
839 changes</a>, some of which are important to make the new features work (e.g.
840 the editable story IDs and the story archive options)!</p>
842 <p>This release contains various improvements provided by the Geeklog community
843 (see the <tt>docs/history</tt> file for proper credits). Thank you!</p>
845 <h2><a name="changes139sr3">Geeklog 1.3.9sr3</a></h2>
846 <p>This release addresses the following security issues:</p>
849 <li>It was possible to submit stories anonymously even if anonymous submissions
850 were turned off in <tt>config.php</tt> (reported by Barry Wong).<br>
851 These stories still ended up in the submission queue, though, unless you
852 disabled it in <tt>config.php</tt>.</li>
853 <li>Some of the parameters in link and event submissions weren't filtered,
854 leaving them open to potential SQL injections.</li>
858 <h2><a name="changes139sr2">Geeklog 1.3.9sr2</a></h2>
859 <p>This release addresses the following security issues:</p>
862 <li>Fixed a cross site scripting vulnerability caused by using the variable
863 <code>$topic</code> in the language files (bug #293).</li>
864 <li>Prevent comment posts on stories or polls were comment posting has been
870 <li>Fixed <tt>lib-plugins.php</tt> to work properly with PHP 5.</li>
871 <li>The complete tarball also includes updated PEAR packaged that fix
872 some of the reported email problems.</li>
876 <h2><a name="changes139sr1">Geeklog 1.3.9sr1</a></h2>
877 <p>This release addresses the following security issues:</p>
880 <li>It was possible to post anonymous comments, even when anonymous comment
881 posting had been switched off in config.php.<br>
882 This bug was apparently exploited by spammers to send hundreds of spam
883 posts to certain Geeklog sites.</li>
884 <li>Added additional speed limit checks for comments and submissions.</li>
885 <li>If none of the topics were visible for anonymous users, the site's index
886 page may still have displayed some stories for anonymous users, depending
887 on the stories' permissions.</li>
888 <li>Users still got Daily Digest emails for topics from which they had been
889 removed (bug #178).</li>
890 <li>It was possible to subscribe to the Daily Digest for all topics, even if
891 the user did not have access to certain topics.</li>
892 <li>Comments to stories were sometimes listed in a user's profile, even if the
893 user viewing the profile didn't have permissions to access the story the
894 comments belonged to.</li>
899 <li>Fixed an SQL error in <code>COM_showTopics</code> if users excluded topics
900 from their preferences.</li>
901 <li>Fixed sporadic "Duplicate entry '...' for key 1." messages in error.log,
902 caused by the handling of pseudo-session ids for anonymous users.</li>
903 <li>Fixed incorrect author names in Daily Digest (bug #207).</li>
904 <li>The <code>plugin_profileblocksedit_<i>plugin-name</i></code> Plugin API
905 function wasn't working due to a missing piece of code in
906 usersettings.php.</li>
907 <li><code>COM_extractLinks</code> will now ignore anchor tags that do not
908 contain "<code>href</code>" (bug #183).</li>
912 <h2><a name="changes139">Geeklog 1.3.9</a></h2>
914 <h3>New Features</h3>
917 <li>Geeklog now uses PEAR::Mail to send all emails. This gives you the option
918 to send emails via PHP's built-in mail() function (as before), via
919 sendmail or via SMTP.</li>
920 <li>There is a new admin option called Content Syndication that lets you
921 create and configure (RSS) feeds. In addition to the standard feed
922 containing all the new stories, you can now create feeds per topic, for
923 upcoming events, and for links.<br>
924 This feature is extensible in that plugins can provide additional feeds.
925 It is also possible to provide feeds in formats other than RSS 0.91 by
926 providing additional feed classes.</li>
927 <li>Admins can change the block order easily from the list of blocks now.</li>
928 <li>There is an alternative interface to adding users to groups (requires
930 <li>Users in the Group Admin group can now only assign other users to groups
931 of which they themselves are a member.</li>
932 <li>Image upload can now also use the GD library to scale images.</li>
933 <li>Comments now use templates.</li>
934 <li>To accomodate strict webhosts who don't allow file uploads to the standard
935 image directory, you can now set a new configuration variable,
936 <code>$_CONF['path_images']</code> to point to a directory outside of your
937 webtree where article images and user profile pictures will be saved.</li>
938 <li>Geeklog now supports URL rewriting for story URLs, i.e. you can have URLs
939 like <tt>http://www.geeklog.net/article.php/20031229225326631</tt> which
940 are known to be picked up by Google.</li>
941 <li>Plugins can add their own section to Geeklog's What's New block.</li>
942 <li>All URL fields can now hold up to 255 characters (requires theme updates).</li>
945 <p>Please see the <a href="theme.html#changes">themes documentation</a> for a
946 complete list of theme changes.</p>
948 <p>Also included is the <a href="staticpages.html">Static Pages plugin 1.4</a>,
949 which now has, among other improvements, a second option to include PHP in
950 static pages without having to use the PHP <code>return</code> statement.</p>
956 <li>Words from a search query are now properly highlighted in comments. Also
957 fixed a problem with highlighting when the search query contained '*'
959 <li>Various fixes in the search class.</li>
960 <li>Fixed a bug that let users register with an empty username.</li>
961 <li>When batch-importing users, those users were all subscribed to the
962 Daily Digest automatically (uses the $_CONF['emailstoriesperdefault']
963 setting instead now).</li>
964 <li>Fixed option to delete comments, which previously was only available to
965 users in the Root group (e.g. Admin). Now those users that have story.edit
966 permissions for the actual story can delete comments.</li>
967 <li>Deleting a group may have left orphaned entries in the group_assignments
968 table (this has been fixed now). When upgrading to 1.3.9, the install
969 script will remove any orphaned entries from the database.</li>
972 <p>There have also been a lot of changes to improve security, especially
973 against SQL injections.</p>
976 <h2><a name="changes138-1sr6">Geeklog 1.3.8-1sr6</a></h2>
977 <p>This release addresses the following security issues:</p>
980 <li>Fixed a cross site scripting vulnerability caused by using the variable
981 <code>$topic</code> in the language files (bug #293).</li>
982 <li>Prevent comment posts on stories or polls were comment posting has been
987 <h2><a name="changes138-1sr5">Geeklog 1.3.8-1sr5</a></h2>
988 <p>This release addresses the following security issue:</p>
991 <li>It was possible to post anonymous comments, even when anonymous comment
992 posting had been switched off in config.php.<br>
993 This bug was apparently exploited by spammers to send hundreds of spam
994 posts to certain Geeklog sites.</li>
998 <h2><a name="changes138-1sr4">Geeklog 1.3.8-1sr4</a></h2>
999 <p>This release addresses the following security issues:</p>
1002 <li>It was possible for users in the Group Admin and User Admin groups to
1003 become a member of the Root group (reported by Samuel M. Stone,
1005 <li>Being admin for a certain area (e.g. Story Admin for stories) made it
1006 possible to delete all objects in that area (e.g. stories) even if the user
1007 was not supposed to have access to them, provided the id of the object was
1009 <li>It was possible to delete other people's personal events if you knew the
1011 <li>It was possible to browse through the comments of a story even if the user
1012 did not have access to the actual story (reported by Peter Roozemaal).</li>
1013 <li>Due to an XSS issue, it was possible to change someone's account settings
1014 (including the password) if you got them to click on a specially crafted
1015 link (reported by Jelmer, fix suggested by Vincent Furia).</li>
1016 <li>The comment display suffered from the possibility of an SQL injection
1017 (reported by Jelmer).</li>
1018 <li>It was possible to inject Javascript code in the calendar (reported by
1020 <li>It was possible to execute (but not save) Javascript code in the comment
1021 preview (reported by Jelmer).</li>
1025 <h2><a name="changes138-1sr3">Geeklog 1.3.8-1sr3</a></h2>
1026 <p>This release addresses the following security-related issues:</p>
1029 <li>As "dr.wh0" pointed out, the category field for link submissions was not
1030 filtered at all. Although you probably can't cause too much harm with
1031 those 32 characters, this has now been fixed.</li>
1032 <li>Vincent Furia found that the restrictions for the form to email users
1033 could be circumvented and could even be used to spam users.
1034 In addition to fixing theses issues, there is now also a speed limit
1035 on that form (defaults to the speed limit for story submissions).</li>
1036 <li>There was a way to post comments anonymously even when posting for
1037 anonymous users had been disabled.</li>
1038 <li>It was possible to post comments under someone else's username.</li>
1042 <h2><a name="changes138-1sr2">Geeklog 1.3.8-1sr2</a></h2>
1044 <p>Jouko Pynnonen found a way to trick the new "forgot password" feature, introduced in 1.3.8, into letting an attacker change the password for <em>any</em> account. This release addresses this issue - there were no other changes.</p>
1046 <p>Obviously, we strongly recommend to upgrade as soon as possible.</p>
1049 <h2><a name="changes138-1sr1">Geeklog 1.3.8-1sr1</a></h2>
1051 <p>The purpose of this release is to address some of the security issues reported in September and early October 2003. We strongly recommend upgrading to this version.</p>
1053 <h3>Security issues</h3>
1055 <li>By including Ulf Harnhammar's <a href="http://sourceforge.net/projects/kses/" title="kses homepage">kses</a> HTML filter, this release addresses a variety of possible Javascript injection and CSS defacement issues.</li>
1056 <li>Details of SQL errors will not be reported in the browser any more (but only in Geeklog's error.log file). This will avoid disclosing any sensitive information as part of the error message (which is so far the only problem we have found with the alleged SQL injection issues that have been reported).
1059 <p>Please note that at the moment we do <strong>not</strong> recommend to use Geeklog with MySQL 4.1 (which, at the time of this writing, is in alpha state and should not be used on production sites anyway). An upcoming release of Geeklog will include more thorough filtering of SQL injections attempts, thus also fixing the problems with MySQL 4.1.</p>
1061 <h3>Other fixes</h3>
1063 <li>Fixed the auto-detection of the value for the <code>$_CONF['cookiedomain']</code> variable if the URL included a port number (such as <tt>example.com:8080</tt>). This will fix the login problems some users were reporting.</li>
1064 <li>The full 1.3.8-1sr1 tarball also includes updated French (Canada) and Turkish language files.</li>
1068 <h2><a name="changes138-1">Geeklog 1.3.8-1</a></h2>
1070 <p>Geeklog 1.3.8-1 is a bugfix release over Geeklog 1.3.8. It contains a
1071 variety of (mostly minor) bugfixes. None of those fixes are security-related.</p>
1076 <li>Fixes to the new search to restore pre-1.3.8 behavior (display search form
1077 again if no results are returned, handling of
1078 <tt>$_CONF['searchloginrequired']</tt>, etc.). Also fixed the search by
1080 <li>Fixed problems in the install script when trying to identify the MySQL
1081 version. The install script failed silently on PHP 4.0.4 and earlier
1083 <li>Fixed a problem with the What's Related block on stories that contain
1085 <li>Skip user "Anonymous" when sending out the Daily Digest.
1086 <li>Prevent admin from changing a user's email address to one that's already
1087 used by another user.</li>
1088 <li>Update RSS feed and Older Stories block when deleting a story.</li>
1091 <p>The full 1.3.8-1 tarball also includes new and updated language files
1092 (see the Changelog for details).</p>
1095 <h2><a name="changes138">Geeklog 1.3.8</a></h2>
1097 <h3>New Features</h3>
1099 <p>Geeklog 1.3.8 Includes the <strong>Static Pages 1.3 plugin</strong> which
1100 replaces <em>both</em> the Static Pages 1.1 and 1.2 plugins. See the <a
1101 href="staticpages.html">Static Pages documentation</a> for details.</p>
1104 <li>The search function has been rewritten. You can now search for the
1105 exact phrase, all the words, or any of the words from a query. Search
1106 words are also highlighted in stories.
1107 <li>New Privacy options: Users can decide whether they want to receive
1108 email from other users and/or admins and whether they want to show up in
1109 the Who's Online block.
1110 <li>You can now get a list of all users who are in a certain group (from the
1111 Admin's group editor).
1112 <li>When scaling is configured for images in stories, you can now keep the
1113 unscaled image (has to be enabled in config.php first). In that case, the
1114 scaled-down image in the story will serve as a thumbnail and link to the
1116 <li>You can now make one topic the default topic. The topic selection in the
1117 story submission form will then default to that topic. However, when
1118 browsing by topic (index.php?topic=Geeklog etc.) new story submissions will
1119 default to the current topic.
1120 <li>You can give your users the ability to change their username and delete
1121 their account. Both features have to be enabled in config.php.
1122 <li>Extended Plugin API: Plugins can now display content in Geeklog's
1123 center area, add their own information to the user profile, and add
1124 information to the site's header (<code><head></code> section).
1125 <li>There's a new API for custom registration forms (see
1126 <tt>lib-custom.php</tt> for sample code).
1127 <li>There have been quite a few theme changes in order to move most larger
1128 portions of hard-coded HTML to template files and to give theme designers
1129 more control over the layout. Please consult the <a
1130 href="theme.html#changes138">themes documentation</a> for a list of changes.</li>
1136 <li>The "forgot password" function has been rewritten. Instead of resetting
1137 your old password and sending you a new one, you will now receive an
1138 email with a unique link in it. If you follow this link, you can enter a
1139 new password directly. Otherwise, you can simply ignore the email and your
1140 old password will remain valid.
1141 <li>Topic access was not always checked properly. If Story Admins report
1142 getting access denied messages after upgrading to 1.3.8, check your topic
1143 permissions carefully.
1144 <li>The poll editor let you enter one answer too many (i.e. when the max.
1145 number of answers was set to 10 you could actually enter 11). Please check
1146 your existing polls or you may lose the last answer if you exceeded the
1147 max. number of answers in a poll (adjust $_CONF['maxanswers'] accordingly,
1149 <li>Geeklog should install and run again on old versions of MySQL
1150 (specifically, 3.22.xx). Please note that some of these old versions aren't
1151 even supported by MySQL AB any more and MySQL installs older than 3.23.54
1152 are having security issues.
1156 <h2><a name="changes137sr5">Geeklog 1.3.7sr5</a></h2>
1157 <p>This release addresses the following security issues:</p>
1160 <li>It was possible for users in the Group Admin and User Admin groups to
1161 become a member of the Root group (reported by Samuel M. Stone,
1163 <li>Being admin for a certain area (e.g. Story Admin for stories) made it
1164 possible to delete all objects in that area (e.g. stories) even if the user
1165 was not supposed to have access to them, provided the id of the object was
1167 <li>It was possible to delete other people's personal events if you knew the
1169 <li>It was possible to browse through the comments of a story even if the user
1170 did not have access to the actual story (reported by Peter Roozemaal).</li>
1171 <li>Due to an XSS issue, it was possible to change someone's account settings
1172 (including the password) if you got them to click on a specially crafted
1173 link (reported by Jelmer, fix suggested by Vincent Furia).</li>
1174 <li>The comment display suffered from the possibility of an SQL injection
1175 (reported by Jelmer).</li>
1176 <li>It was possible to inject Javascript code in the calendar (reported by
1178 <li>It was possible to execute (but not save) Javascript code in the comment
1179 preview (reported by Jelmer).</li>
1183 <h2><a name="changes137sr4">Geeklog 1.3.7sr4</a></h2>
1184 <p>This release addresses the following security-related issues:</p>
1187 <li>As "dr.wh0" pointed out, the category field for link submissions was not
1188 filtered at all. Although you probably can't cause too much harm with
1189 those 32 characters, this has now been fixed.</li>
1190 <li>Vincent Furia found that the restrictions for the form to email users
1191 could be circumvented and could even be used to spam users.</li>
1192 <li>There was a way to post comments anonymously even when posting for
1193 anonymous users had been disabled.</li>
1194 <li>It was possible to post comments under someone else's username.</li>
1198 <h2><a name="changes137sr3">Geeklog 1.3.7sr3</a></h2>
1200 <p>The purpose of this release is to address some of the security issues reported in September and early October 2003. If you don't plan to upgrade to the latest version of Geeklog (1.3.8-1sr1, at the time of this writing), we strongly suggest you upgrade to at least 1.3.7sr3 instead.</p>
1202 <h3>Security issues</h3>
1204 <li>By including Ulf Harnhammar's <a href="http://sourceforge.net/projects/kses/" title="kses homepage">kses</a> HTML filter, this release addresses a variety of possible Javascript injection and CSS defacement issues.</li>
1205 <li>Details of SQL errors will not be reported in the browser any more (but only in Geeklog's error.log file). This will avoid disclosing any sensitive information as part of the error message (which is so far the only problem we have found with the alleged SQL injection issues that have been reported).
1208 <p>Please note that at the moment we do <strong>not</strong> recommend to use Geeklog with MySQL 4.1 (which, at the time of this writing, is in alpha state and should not be used on production sites anyway). An upcoming release of Geeklog will include more thorough filtering of SQL injections attempts, thus also fixing the problems with MySQL 4.1.</p>
1211 <h2><a name="changes137sr2">Geeklog 1.3.7sr2</a></h2>
1213 <h3>Security issues</h3>
1215 <p>The purpose of this release is to fix the following security issues.
1216 All users are <em>strongly</em> encouraged to upgrade to this version ASAP.</p>
1218 <li>It was possible to obtain valid session ids for every account on a Geeklog
1219 site, including the Admin account (reported by SCAN Associates).</li>
1220 <li>Using Internet Explorer, it was possible to upload an image with embedded
1221 PHP code and execute it (reported by SCAN Associates).</li>
1222 <li>Story permissions could override topic permissions, resulting in the display
1223 of stories to users who shouldn't have access to them (reported by Andrew
1224 Lawlor). This was already fixed with the new <tt>index.php</tt>, released
1226 <li>Added a warning in <tt>config.php</tt> that adding any of the following
1227 tags to the list of allowable HTML can make the site vulnerable to
1228 scripting attacks:<br>
1229 <code><img> <span> <marquee> <script>
1230 <embed> <object> <iframe></code><br>
1231 (pointed out by Joat Dede).</li>
1234 <p>This update also includes fixes for the notorious "permission denied"
1235 error messages that some users would get in the Admin area (e.g. when trying
1236 to save a story and being "only" a user with Story Admin permissions).</p>
1238 <p>The full 1.3.7sr2 tarball also includes various new and updated language
1239 files (see the Changelog for details).</p>
1242 <h2><a name="changes137sr1">Geeklog 1.3.7sr1</a></h2>
1244 <h3>Security issues</h3>
1246 <p>The main purpose of this release is to fix the following security issues.
1247 All users are strongly recommended to upgrade to this version.</p>
1249 <li>Javascript code could be injected in the homepage field of a user's profile (reported by Jin Yean Tan).</li>
1250 <li>Javascript code could be injected in certain URLs to be used in a cross-site scripting attack (reported by Jin Yean Tan).</li>
1251 <li>Comments could be deleted by anybody if they knew the comment id (which is not normally visible).</li>
1252 <li>A StoryAdmin could manipulate stories even if s/he did not have access to them (e.g. when s/he was not a member of a certain group). The same applied to Admins for events, links, polls, topics, and blocks (reported by Kobaz).</li>
1255 <h3>Other Bugfixes</h3>
1258 <li>Fixed possible causes for endless loops with the redirect in index.php: No redirect will be done if $HTTP_SERVER_VARS['HTTP_HOST'] is not set. Also, the comparison of the configured and actual server name is not case-sensitive any more.</li>
1259 <li>Fixed image resizing when using ImageMagick.</li>
1260 <li>The new user notification email (introduced in Geeklog 1.3.7) was always
1261 sent out, even if 'user' was not listed in $_CONF['notification'].
1262 <li>The Admin menu will now be displayed for users who have Admin access to plugins only, but not to one of the core Admin features.</li>
1263 <li>The default for the daily digest is now back to "off", i.e. new users will not receive it automatically. To enable the daily digest for new users again, set $_CONF['emailstoriesperdefault'] = 1 in config.php.</li>
1266 <p>Documentation and hard-coded links (version check, link to Geeklog in a site's footer) have been updated to point to <a href="http://www.geeklog.net/">www.geeklog.net</a>.</p>
1269 <h2><a name="changes137">Geeklog 1.3.7</a></h2>
1271 <h3>New Features</h3>
1274 <li>A notification email can now be sent when a new story, link, or event
1275 has been submitted or a new user has registered with the site (see the
1276 <a href="config.html#submission">submission settings</a> for details).<br>
1277 Please note that this feature doesn't tie in with Geeklog's security
1278 features - it's really more of a hack, since many people asked for this
1280 <li>Following the "X stories in last 24 hours" link in the What's New block
1281 will now display just those new stories.</li>
1282 <li>User photos are now resized, just like images in stories (if the use
1283 of an image library is configured). The max. dimensions for user photos
1284 can be set with a separate set of config variables in
1285 <tt>config.php</tt>.</li>
1286 <li>The plugin menu now lists all plugins which exist in the file system
1287 but haven't been installed yet. It also provides a link to the install
1288 script of those plugins for easy installation.</li>
1289 <li>Several new config variables have been added to config.php (notification,
1290 showfirstasfeatured, dateonly, timeonly, skip_preview, upcomingeventsrange,
1291 emailstoryloginrequired, hideemailicon, hideprintericon, hidenewstories,
1292 hidenewcomments, hidenewlinks, max_photo_width, max_photo_height,
1293 max_photo_size). Please see the <a
1294 href="config.html">config documentation</a> for details.</li>
1295 <li>Theme changes: Please consult the <a href="theme.html#changes137">themes
1296 documentation</a> for a list of changes.</li>
1303 <li>Added sanity checks in the Admin story editor to prevent the loss of all
1304 stories when using an incomplete language file (or when manipulating the
1306 <li>Fixed a nasty bug in lib-security.php that let any user with UserAdmin
1307 permissions change the Root user's password, thus effectively becoming
1309 <li>Fixed problems with blocks disappearing when they were set to
1311 <li>Fixed problems with multiple [code] ... [/code] sections in stories
1313 <li>Fixed double line spacing in [code] sections and HTML-formatted comments
1314 on PHP 4.2.0 and up.</li>
1315 <li>Fixed problems with slashes and HTML entities in emails sent by
1317 <li>Fixes and improvements to the plugin API.</li>
1320 <p><strong>Contributors:</strong> Blaine Lang, Vincent Furia, and Kenn Osborne
1321 have contributed to this release. Thank you!</p>
1323 <h3><a name="addindex">Speeding up Geeklog (a bit)</a></h3>
1325 <p>If you're upgrading from 1.3.6 or older versions, you may want to run the
1326 script called <tt>addindex.php</tt> that you will find in the <tt>install</tt>
1327 directory. This script adds index fields to some of Geeklog's database tables
1328 which should improve overall access times a bit.</p>
1330 <p>This has been implemented as a separate script (and not as part of the
1331 upgrade process of the install script) since it may take some time to run,
1332 depending on how many users / stories / etc. you have in your database. Some
1333 people may even run into timeouts, e.g. when their hosting service limits the
1334 execution time of PHP scripts. If that happens to you - <strong>Don't
1335 Panic</strong>. Simply run the script again (and again and ...) until it
1336 reports that it didn't add any fields to any tables.</p>
1338 <p>Please note that you do <em>not</em> need to run this script if you're doing
1339 a fresh install of Geeklog 1.3.7. A database created during a fresh install
1340 already has the new index fields.</p>
1343 <h2><a name="changes136">Geeklog 1.3.6</a></h2>
1345 <h3>New Features</h3>
1348 <li>Images in articles can now be resized automatically during upload
1349 (provided you have either ImageMagick or netpbm installed). See the
1350 <a href="config.html#image">configuration description</a> for details.</li>
1351 <li>The contents of a static page entitled "Frontpage" will be displayed
1352 before the first story on the front page of a Geeklog site. If the static
1353 page additionally carries the label "nonews", then it will completely
1354 replace the news on the front page.</li>
1355 <li>User submission queue: When activated (in <tt><a
1356 href="config.html#submission">config.php</a></tt>), new users will need to
1357 be approved by an admin before they receive their password.</li>
1358 <li>The submission queues can be switched off separately, either completely
1359 (in <tt><a href="config.html#submission">config.php</a></tt>) or only for
1360 certain groups of users (by using the new features story.submit,
1361 links.submit, and event.submit).</li>
1362 <li>When posting source code (e.g. PHP, HTML, ...), you can now use the
1363 [code] ... [/code] pseudo tags to enclose those portions of your posting
1364 that should be reproduced verbatim.</li>
1365 <li>The links section now uses a categorized and paged display (can be
1366 <a href="config.html#links">switched off</a> separately and even back to the
1367 pre-1.3.6 style listing).</li>
1368 <li>Anonymous users can now be <a href="config.html#login">blocked</a> from
1369 almost every part of the site (e.g. links section, site stats, ...), if
1371 <li>A Geeklog site can now be disabled easily (e.g. for maintenance) by
1372 setting a flag in <tt><a href="config.html#site">config.php</a></tt>.</li>
1373 <li>Theme changes: Please consult the <a href="theme.html#changes136">themes
1374 documentation</a> for a list of changes.</li>
1380 <li>Several fixes have been made to ensure that permissions are taken into
1381 account properly (e.g. not revealing titles of stories that the user has no
1383 <li>Several fixes have been made to make sure that Geeklog can now be
1384 properly localized (provided you have a language file that is up to date
1385 and have chosen the proper <a href="config.html#languages_locale">locale
1386 settings</a> for your country and language).</li>
1387 <li>The variable $_CONF['site_admin_url'] is now used properly so that you
1388 can rename Geeklog's <tt>admin</tt> directory if needed.</li>
1389 <li>New RDF parser will now import most (if not all) RDF news feeds
1396 <li>Since there are a lot of new variables in <tt>config.php</tt>, it is
1397 recommended you start with a fresh copy of that file instead of copying
1398 over your old <tt>config.php</tt> from your previous installation.</li>
1399 <li>Please note that currently only the English, German, Italian, Polish,
1400 and Japanese language files are up to date. Using one of the other
1401 language files may result in your Geeklog site not working properly.</li>
1404 <p><strong>Contributors:</strong> Gene Wood, Blaine Lang, Tom Willet, and
1405 Roger Webster have contributed to this release. Thank you!</p>
1407 <div class="footer">
1408 <a href="http://wiki.geeklog.net">The Geeklog Documentation Project</a><br>
1409 All trademarks and copyrights on this page are owned by their respective owners. Geeklog is copyleft.