diff --git a/.htaccess b/.htaccess new file mode 100644 index 00000000..9494b53b --- /dev/null +++ b/.htaccess @@ -0,0 +1,137 @@ +# +# Apache/PHP/Drupal settings: +# + +# Protect files and directories from prying eyes. + + Order allow,deny + + +# Don't show directory listings for URLs which map to a directory. +Options -Indexes + +# Follow symbolic links in this directory. +Options +FollowSymLinks + +# Make Drupal handle any 404 errors. +ErrorDocument 404 /index.php + +# Force simple error message for requests for non-existent favicon.ico. + + # There is no end quote below, for compatibility with Apache 1.3. + ErrorDocument 404 "The requested file favicon.ico was not found. + + +# Set the default handler. +DirectoryIndex index.php index.html index.htm + +# Override PHP settings that cannot be changed at runtime. See +# sites/default/default.settings.php and drupal_initialize_variables() in +# includes/bootstrap.inc for settings that can be changed at runtime. + +# PHP 5, Apache 1 and 2. + + php_flag magic_quotes_gpc off + php_flag magic_quotes_sybase off + php_flag register_globals off + php_flag session.auto_start off + php_value mbstring.http_input pass + php_value mbstring.http_output pass + php_flag mbstring.encoding_translation off + + +# Requires mod_expires to be enabled. + + # Enable expirations. + ExpiresActive On + + # Cache all files for 2 weeks after access (A). + ExpiresDefault A1209600 + + + # Do not allow PHP scripts to be cached unless they explicitly send cache + # headers themselves. Otherwise all scripts would have to overwrite the + # headers set by mod_expires if they want another caching behavior. This may + # fail if an error occurs early in the bootstrap process, and it may cause + # problems if a non-Drupal PHP file is installed in a subdirectory. + ExpiresActive Off + + + +# Various rewrite rules. + + RewriteEngine on + + # Block access to "hidden" directories whose names begin with a period. This + # includes directories used by version control systems such as Subversion or + # Git to store control files. Files whose names begin with a period, as well + # as the control files used by CVS, are protected by the FilesMatch directive + # above. + # + # NOTE: This only works when mod_rewrite is loaded. Without mod_rewrite, it is + # not possible to block access to entire directories from .htaccess, because + # is not allowed here. + # + # If you do not have mod_rewrite installed, you should remove these + # directories from your webroot or otherwise protect them from being + # downloaded. + RewriteRule "(^|/)\." - [F] + + # If your site can be accessed both with and without the 'www.' prefix, you + # can use one of the following settings to redirect users to your preferred + # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option: + # + # To redirect all users to access the site WITH the 'www.' prefix, + # (http://example.com/... will be redirected to http://www.example.com/...) + # uncomment the following: + # RewriteCond %{HTTP_HOST} !^www\. [NC] + # RewriteRule ^ http://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301] + # + # To redirect all users to access the site WITHOUT the 'www.' prefix, + # (http://www.example.com/... will be redirected to http://example.com/...) + # uncomment the following: + # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC] + # RewriteRule ^ http://%1%{REQUEST_URI} [L,R=301] + + # Modify the RewriteBase if you are using Drupal in a subdirectory or in a + # VirtualDocumentRoot and the rewrite rules are not working properly. + # For example if your site is at http://example.com/drupal uncomment and + # modify the following line: + # RewriteBase /drupal + # + # If your site is running in a VirtualDocumentRoot at http://example.com/, + # uncomment the following line: + # RewriteBase / + + # Pass all requests not referring directly to files in the filesystem to + # index.php. Clean URLs are handled in drupal_environment_initialize(). + RewriteCond %{REQUEST_FILENAME} !-f + RewriteCond %{REQUEST_FILENAME} !-d + RewriteCond %{REQUEST_URI} !=/favicon.ico + RewriteRule ^ index.php [L] + + # Rules to correctly serve gzip compressed CSS and JS files. + # Requires both mod_rewrite and mod_headers to be enabled. + + # Serve gzip compressed CSS files if they exist and the client accepts gzip. + RewriteCond %{HTTP:Accept-encoding} gzip + RewriteCond %{REQUEST_FILENAME}\.gz -s + RewriteRule ^(.*)\.css $1\.css\.gz [QSA] + + # Serve gzip compressed JS files if they exist and the client accepts gzip. + RewriteCond %{HTTP:Accept-encoding} gzip + RewriteCond %{REQUEST_FILENAME}\.gz -s + RewriteRule ^(.*)\.js $1\.js\.gz [QSA] + + # Serve correct content types, and prevent mod_deflate double gzip. + RewriteRule \.css\.gz$ - [T=text/css,E=no-gzip:1] + RewriteRule \.js\.gz$ - [T=text/javascript,E=no-gzip:1] + + + # Serve correct encoding type. + Header append Content-Encoding gzip + # Force proxies to cache gzipped & non-gzipped css/js files separately. + Header append Vary Accept-Encoding + + + diff --git a/CHANGELOG.txt b/CHANGELOG.txt new file mode 100644 index 00000000..131e1724 --- /dev/null +++ b/CHANGELOG.txt @@ -0,0 +1,1302 @@ + +Drupal 7.2, 2011-05-25 +---------------------- +- Added a default .gitignore file. +- Improved PostgreSQL and SQLite support. +- Numerous critical performance improvements. +- Numerous critical fixes to the upgrade path. +- Numerous fixes to language and translation systems. +- Numerous fixes to AJAX and #states systems. +- Improvements to the locking system. +- Numerous documentation fixes. +- Numerous styling and theme system fixes. +- Numerous fixes for schema mis-matches between Drupal 6 and 7. +- Minor internal API clean-ups. + +Drupal 7.1, 2011-05-25 +---------------------- +- Fixed security issues (Cross site scripting, File access bypass), see SA-CORE-2011-001. + +Drupal 7.0, 2011-01-05 +---------------------- +- Database: + * Fully rewritten database layer utilizing PHP 5's PDO abstraction layer. + * Drupal now requires MySQL >= 5.0.15 or PostgreSQL >= 8.3. + * Added query builders for INSERT, UPDATE, DELETE, MERGE, and SELECT queries. + * Support for master/slave replication, transactions, multi-insert queries, + and other features. + * Added support for the SQLite database engine. + * Default to InnoDB engine, rather than MyISAM, on MySQL when available. + This offers increased scalability and data integrity. +- Security: + * Protected cron.php -- cron will only run if the proper key is provided. + * Implemented a pluggable password system and much stronger password hashes + that are compatible with the Portable PHP password hashing framework. + * Rate limited login attempts to prevent brute-force password guessing, and + improved the flood control API to allow variable time windows and + identifiers for limiting user access to resources. + * Transformed the "Update status" module into the "Update manager" which + can securely install or update modules and themes via a web interface. +- Usability: + * Added contextual links (a.k.a. local tasks) to page elements, such as + blocks, nodes, or comments, which allows to perform the most common tasks + with a single click only. + * Improved installer requirements check. + * Improved support for integration of WYSIWYG editors. + * Implemented drag-and-drop positioning for input format listings. + * Implemented drag-and-drop positioning for language listing. + * Implemented drag-and-drop positioning for poll options. + * Provided descriptions and human-readable names for user permissions. + * Removed comment controls for users. + * Removed display order settings for comment module. Comment display + order can now be customized using the Views module. + * Removed the 'related terms' feature from taxonomy module since this can + now be achieved with Field API. + * Added additional features to the default install profile, and implemented + a "slimmed down" install profile designed for developers. + * Added a built-in, automated cron run feature, which is triggered by site + visitors. + * Added an administrator role which is assigned all permissions for + installed modules automatically. + * Image toolkits are now provided by modules (rather than requiring a + manual file copy to the includes directory). + * Added an edit tab to taxonomy term pages. + * Redesigned password strength validator. + * Redesigned the add content type screen. + * Highlight duplicate URL aliases. + * Renamed "input formats" to "text formats". + * Moved text format permissions to the main permissions page. + * Added configurable ability for users to cancel their own accounts. + * Added "vertical tabs", a reusable interface component that features + automatic summaries and increases usability. + * Replaced fieldsets on node edit and add pages with vertical tabs. +- Performance: + * Improved performance on uncached page views by loading multiple core + objects in a single database query. + * Improved performance for logged-in users by reducing queries for path + alias lookups. + * Improved support for HTTP proxies (including reverse proxies), allowing + anonymous page views to be served entirely from the proxy. +- Documentation: + * Hook API documentation now included in Drupal core. +- News aggregator: + * Added OPML import functionality for RSS feeds. + * Optionally, RSS feeds may be configured to not automatically generate feed blocks. +- Search: + * Added support for language-aware searches. +- Aggregator: + * Introduced architecture that allows pluggable parsers and processors for + syndicating RSS and Atom feeds. + * Added options to suspend updating specific feeds and never discard feeds + items. +- Testing: + * Added test framework and tests. +- Improved time zone support: + * Drupal now uses PHP's time zone database when rendering dates in local + time. Site-wide and user-configured time zone offsets have been converted + to time zone names, e.g. Africa/Abidjan. + * In some cases the upgrade and install scripts do not choose the preferred + site default time zone. The automatically-selected time zone can be + corrected at admin/config/regional/settings. + * If your site is being upgraded from Drupal 6 and you do not have the + contributed date or event modules installed, user time zone settings will + fallback to the system time zone and will have to be reconfigured by each user. + * User-configured time zones now serve as the default time zone for PHP + date/time functions. +- Filter system: + * Revamped the filter API and text format storage. + * Added support for default text formats to be assigned on a per-role basis. + * Refactored the HTML corrector to take advantage of PHP 5 features. +- User system: + * Added clean API functions for creating, loading, updating, and deleting + user roles and permissions. + * Refactored the "access rules" component of user module: The user module + now provides a simple interface for blocking single IP addresses. The + previous functionality in the user module for restricting certain e-mail + addresses and usernames is now available as a contributed module. Further, + IP address range blocking is no longer supported and should be implemented + at the operating system level. + * Removed per-user themes: Contributed modules with similar functionality + are available. +- OpenID: + * Added support for Gmail and Google Apps for Domain identifiers. Users can + now login with their user@example.com identifier when example.com is powered + by Google. + * Made the OpenID module more pluggable. +- Added code registry: + * Using the registry, modules declare their includable files via their .info file, + allowing Drupal to lazy-load classes and interfaces as needed. +- Theme system: + * Removed the Bluemarine, Chameleon and Pushbutton themes. These themes live + on as contributed themes (http://drupal.org/project/bluemarine, + http://drupal.org/project/chameleon and http://drupal.org/project/pushbutton). + * Added Stark theme to make analyzing Drupal's default HTML and CSS easier. + * Added Seven as the default administration theme. + * Variable preprocessing of theme hooks prior to template rendering now goes + through two phases: a 'preprocess' phase and a new 'process' phase. See + http://api.drupal.org/api/function/theme/7 for details. + * Theme hooks implemented as functions (rather than as templates) can now + also have preprocess (and process) functions. See + http://api.drupal.org/api/function/theme/7 for details. + * Added Bartik as the default theme. +- File handling: + * Files are now first class Drupal objects with file_load(), file_save(), + and file_validate() functions and corresponding hooks. + * The file_move(), file_copy() and file_delete() functions now operate on + file objects and invoke file hooks so that modules are notified and can + respond to changes. + * For the occasions when only basic file manipulation are needed--such as + uploading a site logo--that don't require the overhead of databases and + hooks, the current unmanaged copy, move and delete operations have been + preserved but renamed to file_unmanaged_*(). + * Rewrote file handling to use PHP stream wrappers to enable support for + both public and private files and to support pluggable storage mechanisms + and access to remote resources (e.g. S3 storage or Flickr photos). + * The mime_extension_mapping variable has been removed. Modules that need to + alter the default MIME type extension mappings should implement + hook_file_mimetype_mapping_alter(). + * Added the hook_file_url_alter() hook, which makes it possible to serve + files from a CDN. + * Added a field specifically for uploading files, previously provided by + the contributed module FileField. +- Image handling: + * Improved image handling, including better support for add-on image + libraries. + * Added API and interface for creating advanced image thumbnails. + * Inclusion of additional effects such as rotate and desaturate. + * Added a field specifically for uploading images, previously provided by + the contributed module ImageField. +- Added aliased multi-site support: + * Added support for mapping domain names to sites directories. +- Added RDF support: + * Modules can declare RDF namespaces which are serialized in the tag + for RDFa support. + * Modules can specify how their data structure maps to RDF. + * Added support for RDFa export of nodes, comments, terms, users, etc. and + their fields. +- Search engine optimization and web linking: + * Added a rel="canonical" link on node and comment pages to prevent + duplicate content indexing by search engines. + * Added a default rel="shortlink" link on node and comment pages that + advertises a short link as an alternative URL to third-party services. + * Meta information is now alterable by all modules before rendering. +- Field API: + * Custom data fields may be attached to nodes, users, comments and taxonomy + terms. + * Node bodies and teasers are now Field API fields instead of + being a hard-coded property of node objects. + * In addition, any other object type may register with Field API + and allow custom data fields to be attached to itself. + * Provides most of the features of the former Content Construction + Kit (CCK) module. + * Taxonomy terms are now Field API fields that can be added to any fieldable + object. +- Installer: + * Refactored the installer into an API that allows Drupal to be installed + via a command line script. +- Page organization + * Made the help text area a full featured region with blocks. + * Site mission is replaced with the highlighted content block region and + separate RSS feed description settings. + * The footer message setting was removed in favor of custom blocks. + * Made the main page content a block which can be moved and ordered + with other blocks in the same region. + * Blocks can now return structured arrays for later rendering just + like page callbacks. +- Translation system + * The translation system now supports message context (msgctxt). + * Added support for translatable fields to Field API. +- JavaScript changes + * Upgraded the core JavaScript library to jQuery version 1.4.4. + * Upgraded the jQuery Forms library to 2.52. + * Added jQuery UI 1.8.7, which allows improvements to Drupal's user + experience. +- Better module version support + * Modules now can specify which version of another module they depend on. +- Removed modules from core + * The following modules have been removed from core, because contributed + modules with similar functionality are available: + * Blog API module + * Ping module + * Throttle module +- Improved node access control system. + * All modules may now influence the access to a node at runtime, not just + the module that defined a node. + * Users may now be allowed to bypass node access restrictions without giving + them complete access to the site. + * Access control affects both published and unpublished nodes. + * Numerous other improvements to the node access system. +- Actions system + * Simplified definitions of actions and triggers. + * Removed dependency on the combination of hooks and operations. Triggers + now directly map to module hooks. +- Task handling + * Added a queue API to process many or long-running tasks. + * Added queue API support to cron API. + * Added a locking framework to coordinate long-running operations across + requests. + +Drupal 6.22, 2011-05-25 +----------------------- +- Made Drupal 6 work better with IIS and Internet Explorer. +- Fixed .po file imports to work better with custom textgroups. +- Improved code documentation at various places. +- Fixed a variety of other bugs. + +Drupal 6.21, 2011-05-25 +---------------------- +- Fixed security issues (Cross site scripting), see SA-CORE-2011-001. + +Drupal 6.20, 2010-12-15 +---------------------- +- Fixed a variety of small bugs, improved code documentation. + +Drupal 6.19, 2010-08-11 +---------------------- +- Fixed a variety of small bugs, improved code documentation. + +Drupal 6.18, 2010-08-11 +---------------------- +- Fixed security issues (OpenID authentication bypass, File download access + bypass, Comment unpublishing bypass, Actions cross site scripting), + see SA-CORE-2010-002. + +Drupal 6.17, 2010-06-02 +---------------------- +- Improved PostgreSQL compatibility +- Better PHP 5.3 and PHP 4 compatibility +- Better browser compatibility of CSS and JS aggregation +- Improved logging for login failures +- Fixed an incompatibility with some contributed modules and the locking system +- Fixed a variety of other bugs. + +Drupal 6.16, 2010-03-03 +---------------------- +- Fixed security issues (Installation cross site scripting, Open redirection, + Locale module cross site scripting, Blocked user session regeneration), + see SA-CORE-2010-001. +- Better support for updated jQuery versions. +- Reduced resource usage of update.module. +- Fixed several issues relating to support of install profiles and + distributions. +- Added a locking framework to avoid data corruption on long operations. +- Fixed a variety of other bugs. + +Drupal 6.15, 2009-12-16 +---------------------- +- Fixed security issues (Cross site scripting), see SA-CORE-2009-009. +- Fixed a variety of other bugs. + +Drupal 6.14, 2009-09-16 +---------------------- +- Fixed security issues (OpenID association cross site request forgeries, + OpenID impersonation and File upload), see SA-CORE-2009-008. +- Changed the system modules page to not run all cache rebuilds; use the + button on the performance settings page to achieve the same effect. +- Added support for PHP 5.3.0 out of the box. +- Fixed a variety of small bugs. + +Drupal 6.13, 2009-07-01 +---------------------- +- Fixed security issues (Cross site scripting, Input format access bypass and + Password leakage in URL), see SA-CORE-2009-007. +- Fixed a variety of small bugs. + +Drupal 6.12, 2009-05-13 +---------------------- +- Fixed security issues (Cross site scripting), see SA-CORE-2009-006. +- Fixed a variety of small bugs. + +Drupal 6.11, 2009-04-29 +---------------------- +- Fixed security issues (Cross site scripting and limited information + disclosure), see SA-CORE-2009-005 +- Fixed performance issues with the menu router cache, the update + status cache and improved cache invalidation +- Fixed a variety of small bugs. + +Drupal 6.10, 2009-02-25 +---------------------- +- Fixed a security issue, (Local file inclusion on Windows), + see SA-CORE-2009-003 +- Fixed node_feed() so custom fields can show up in RSS feeds. +- Improved PostgreSQL compatibility. +- Fixed a variety of small bugs. + +Drupal 6.9, 2009-01-14 +---------------------- +- Fixed security issues, (Access Bypass, Validation Bypass and Hardening + against SQL injection), see SA-CORE-2009-001 +- Made HTTP request checking more robust and informative. +- Fixed HTTP_HOST checking to work again with HTTP 1.0 clients and + basic shell scripts. +- Removed t() calls from all schema documentation. Suggested best practice + changed for contributed modules, see http://drupal.org/node/322731. +- Fixed a variety of small bugs. + +Drupal 6.8, 2008-12-11 +---------------------- +- Removed a previous change incompatible with PHP 5.1.x and lower. + +Drupal 6.7, 2008-12-10 +---------------------- +- Fixed security issues, (Cross site request forgery and Cross site scripting), see SA-2008-073 +- Updated robots.txt and .htaccess to match current file use. +- Fixed a variety of small bugs. + +Drupal 6.6, 2008-10-22 +---------------------- +- Fixed security issues, (File inclusion, Cross site scripting), see SA-2008-067 +- Fixed a variety of small bugs. + +Drupal 6.5, 2008-10-08 +---------------------- +- Fixed security issues, (File upload access bypass, Access rules bypass, + BlogAPI access bypass), see SA-2008-060. +- Fixed a variety of small bugs. + +Drupal 6.4, 2008-08-13 +---------------------- +- Fixed a security issue (Cross site scripting, Arbitrary file uploads via + BlogAPI, Cross site request forgeries and Various Upload module + vulnerabilities), see SA-2008-047. +- Improved error messages during installation. +- Fixed a bug that prevented AHAH handlers to be attached to radios widgets. +- Fixed a variety of small bugs. + +Drupal 6.3, 2008-07-09 +---------------------- +- Fixed security issues, (Cross site scripting, cross site request forgery, + session fixation and SQL injection), see SA-2008-044. +- Slightly modified installation process to prevent file ownership issues on + shared hosts. +- Improved PostgreSQL compatibility (rewritten queries; custom blocks). +- Upgraded to jQuery 1.2.6. +- Performance improvements to search, menu handling and form API caches. +- Fixed Views compatibility issues (Views for Drupal 6 requires Drupal 6.3+). +- Fixed a variety of small bugs. + +Drupal 6.2, 2008-04-09 +---------------------- +- Fixed a variety of small bugs. +- Fixed a security issue (Access bypasses), see SA-2008-026. + +Drupal 6.1, 2008-02-27 +---------------------- +- Fixed a variety of small bugs. +- Fixed a security issue (Cross site scripting), see SA-2008-018. + +Drupal 6.0, 2008-02-13 +---------------------- +- New, faster and better menu system. +- New watchdog as a hook functionality. + * New hook_watchdog that can be implemented by any module to route log + messages to various destinations. + * Expands the severity levels from 3 (Error, Warning, Notice) to the 8 + levels defined in RFC 3164. + * The watchdog module is now called dblog, and is optional, but enabled by + default in the default install profile. + * Extended the database log module so log messages can be filtered. + * Added syslog module: useful for monitoring large Drupal installations. +- Added optional e-mail notifications when users are approved, blocked, or + deleted. +- Drupal works with error reporting set to E_ALL. +- Added scripts/drupal.sh to execute Drupal code from the command line. Useful + to use Drupal as a framework to build command-line tools. +- Made signature support optional and made it possible to theme signatures. +- Made it possible to filter the URL aliases on the URL alias administration + screen. +- Language system improvements: + * Support for right to left languages. + * Language detection based on parts of the URL. + * Browser based language detection. + * Made it possible to specify a node's language. + * Support for translating posts on the site to different languages. + * Language dependent path aliases. + * Automatically import translations when adding a new language. + * JavaScript interface translation. + * Automatically import a module's translation upon enabling that module. +- Moved "PHP input filter" to a standalone module so it can be deleted for + security reasons. +- Usability: + * Improved handling of teasers in posts. + * Added sticky table headers. + * Check for clean URL support automatically with JavaScript. + * Removed default/settings.php. Instead the installer will create it from + default.settings.php. + * Made it possible to configure your own date formats. + * Remember anonymous comment posters. + * Only allow modules and themes to be enabled that have explicitly been + ported to the correct core API version. + * Can now specify the minimum PHP version required for a module within the + .info file. + * Drupal core no longer requires CREATE TEMPORARY TABLES or LOCK TABLES + database rights. + * Dynamically check password strength and confirmation. + * Refactored poll administration. + * Implemented drag-and-drop positioning for blocks, menu items, taxonomy + vocabularies and terms, forums, profile fields, and input format filters. +- Theme system: + * Added .info files to themes and made it easier to specify regions and + features. + * Added theme registry: modules can directly provide .tpl.php files for + their themes without having to create theme_ functions. + * Used the Garland theme for the installation and maintenance pages. + * Added theme preprocess functions for themes that are templates. + * Added support for themeable functions in JavaScript. +- Refactored update.php to a generic batch API to be able to run time-consuming + operations in multiple subsequent HTTP requests. +- Installer: + * Themed the installer with the Garland theme. + * Added form to provide initial site information during installation. + * Added ability to provide extra installation steps programmatically. + * Made it possible to import interface translations at install time. +- Added the HTML corrector filter: + * Fixes faulty and chopped off HTML in postings. + * Tags are now automatically closed at the end of the teaser. +- Performance: + * Made it easier to conditionally load .include files and split up many core + modules. + * Added a JavaScript aggregator. + * Added block-level caching, improving performance for both authenticated + and anonymous users. + * Made Drupal work correctly when running behind a reverse proxy like + Squid or Pound. +- File handling improvements: + * Entries in the files table are now keyed to a user instead of a node. + * Added reusable validation functions to check for uploaded file sizes, + extensions, and image resolution. + * Added ability to create and remove temporary files during a cron job. +- Forum improvements: + * Any node type may now be posted in a forum. +- Taxonomy improvements: + * Descriptions for terms are now shown on taxonomy/term pages as well + as RSS feeds. + * Added versioning support to categories by associating them with node + revisions. +- Added support for OpenID. +- Added support for triggering configurable actions. +- Added the Update status module to automatically check for available updates + and warn sites if they are missing security updates or newer versions. + Sites deploying from CVS should use http://drupal.org/project/cvs_deploy. + Advanced settings provided by http://drupal.org/project/update_advanced. +- Upgraded the core JavaScript library to jQuery version 1.2.3. +- Added a new Schema API, which provides built-in support for core and + contributed modules to work with databases other than MySQL. +- Removed drupal.module. The functionality lives on as the Site network + contributed module (http://drupal.org/project/site_network). +- Removed old system updates. Updates from Drupal versions prior to 5.x will + require upgrading to 5.x before upgrading to 6.x. + +Drupal 5.23, 2010-08-11 +----------------------- +- Fixed security issues (File download access bypass, Comment unpublishing + bypass), see SA-CORE-2010-002. + +Drupal 5.22, 2010-03-03 +----------------------- +- Fixed security issues (Open redirection, Locale module cross site scripting, + Blocked user session regeneration), see SA-CORE-2010-001. + +Drupal 5.21, 2009-12-16 +----------------------- +- Fixed a security issue (Cross site scripting), see SA-CORE-2009-009. +- Fixed a variety of small bugs. + +Drupal 5.20, 2009-09-16 +----------------------- +- Avoid security problems resulting from writing Drupal 6-style menu + declarations. +- Fixed security issues (session fixation), see SA-CORE-2009-008. +- Fixed a variety of small bugs. + +Drupal 5.19, 2009-07-01 +----------------------- +- Fixed security issues (Cross site scripting and Password leakage in URL), see + SA-CORE-2009-007. +- Fixed a variety of small bugs. + +Drupal 5.18, 2009-05-13 +----------------------- +- Fixed security issues (Cross site scripting), see SA-CORE-2009-006. +- Fixed a variety of small bugs. + +Drupal 5.17, 2009-04-29 +----------------------- +- Fixed security issues (Cross site scripting and limited information + disclosure) see SA-CORE-2009-005. +- Fixed a variety of small bugs. + +Drupal 5.16, 2009-02-25 +----------------------- +- Fixed a security issue, (Local file inclusion on Windows), see SA-CORE-2009-004. +- Fixed a variety of small bugs. + +Drupal 5.15, 2009-01-14 +----------------------- +- Fixed security issues, (Hardening against SQL injection), see + SA-CORE-2009-001 +- Fixed HTTP_HOST checking to work again with HTTP 1.0 clients and basic shell + scripts. +- Fixed a variety of small bugs. + +Drupal 5.14, 2008-12-11 +----------------------- +- removed a previous change incompatible with PHP 5.1.x and lower. + +Drupal 5.13, 2008-12-10 +----------------------- +- fixed a variety of small bugs. +- fixed security issues, (Cross site request forgery and Cross site scripting), see SA-2008-073 +- updated robots.txt and .htaccess to match current file use. + +Drupal 5.12, 2008-10-22 +----------------------- +- fixed security issues, (File inclusion), see SA-2008-067 + +Drupal 5.11, 2008-10-08 +----------------------- +- fixed a variety of small bugs. +- fixed security issues, (File upload access bypass, Access rules bypass, + BlogAPI access bypass, Node validation bypass), see SA-2008-060 + +Drupal 5.10, 2008-08-13 +----------------------- +- fixed a variety of small bugs. +- fixed security issues, (Cross site scripting, Arbitrary file uploads via + BlogAPI and Cross site request forgery), see SA-2008-047 + +Drupal 5.9, 2008-07-23 +---------------------- +- fixed a variety of small bugs. +- fixed security issues, (Session fixation), see SA-2008-046 + +Drupal 5.8, 2008-07-09 +---------------------- +- fixed a variety of small bugs. +- fixed security issues, (Cross site scripting, cross site request forgery, and + session fixation), see SA-2008-044 + +Drupal 5.7, 2008-01-28 +---------------------- +- fixed the input format configuration page. +- fixed a variety of small bugs. + +Drupal 5.6, 2008-01-10 +---------------------- +- fixed a variety of small bugs. +- fixed a security issue (Cross site request forgery), see SA-2008-005 +- fixed a security issue (Cross site scripting, UTF8), see SA-2008-006 +- fixed a security issue (Cross site scripting, register_globals), see SA-2008-007 + +Drupal 5.5, 2007-12-06 +---------------------- +- fixed missing missing brackets in a query in the user module. +- fixed taxonomy feed bug introduced by SA-2007-031 + +Drupal 5.4, 2007-12-05 +---------------------- +- fixed a variety of small bugs. +- fixed a security issue (SQL injection), see SA-2007-031 + +Drupal 5.3, 2007-10-17 +---------------------- +- fixed a variety of small bugs. +- fixed a security issue (HTTP response splitting), see SA-2007-024 +- fixed a security issue (Arbitrary code execution via installer), see SA-2007-025 +- fixed a security issue (Cross site scripting via uploads), see SA-2007-026 +- fixed a security issue (User deletion cross site request forgery), see SA-2007-029 +- fixed a security issue (API handling of unpublished comment), see SA-2007-030 + +Drupal 5.2, 2007-07-26 +---------------------- +- changed hook_link() $teaser argument to match documentation. +- fixed a variety of small bugs. +- fixed a security issue (cross-site request forgery), see SA-2007-017 +- fixed a security issue (cross-site scripting), see SA-2007-018 + +Drupal 5.1, 2007-01-29 +---------------------- +- fixed security issue (code execution), see SA-2007-005 +- fixed a variety of small bugs. + +Drupal 5.0, 2007-01-15 +---------------------- +- Completely retooled the administration page + * /Admin now contains an administration page which may be themed + * Reorganised administration menu items by task and by module + * Added a status report page with detailed PHP/MySQL/Drupal information +- Added web-based installer which can: + * Check installation and run-time requirements + * Automatically generate the database configuration file + * Install pre-made 'install profiles' or distributions + * Import the database structure with automatic table prefixing + * Be localized +- Added new default Garland theme +- Added color module to change some themes' color schemes +- Included the jQuery JavaScript library 1.0.4 and converted all core JavaScript to use it +- Introduced the ability to alter mail sent from system +- Module system: + * Added .info files for module meta-data + * Added support for module dependencies + * Improved module installation screen + * Moved core modules to their own directories + * Added support for module uninstalling +- Added support for different cache backends +- Added support for a generic "sites/all" directory. +- Usability: + * Added support for auto-complete forms (AJAX) to user profiles. + * Made it possible to instantly assign roles to newly created user accounts. + * Improved configurability of the contact forms. + * Reorganized the settings pages. + * Made it easy to investigate popular search terms. + * Added a 'select all' checkbox and a range select feature to administration tables. + * Simplified the 'break' tag to split teasers from body. + * Use proper capitalization for titles, menu items and operations. +- Integrated urlfilter.module into filter.module +- Block system: + * Extended the block visibility settings with a role specific setting. + * Made it possible to customize all block titles. +- Poll module: + * Optionally allow people to inspect all votes. + * Optionally allow people to cancel their vote. +- Distributed authentication: + * Added default server option. +- Added default robots.txt to control crawlers. +- Database API: + * Added db_table_exists(). +- Blogapi module: + * 'Blogapi new' and 'blogapi edit' nodeapi operations. +- User module: + * Added hook_profile_alter(). + * E-mail verification is made optional. + * Added mass editing and filtering on admin/user/user. +- PHP Template engine: + * Add the ability to look for a series of suggested templates. + * Look for page templates based upon the path. + * Look for block templates based upon the region, module, and delta. +- Content system: + * Made it easier for node access modules to work well with each other. + * Added configurable content types. + * Changed node rendering to work with structured arrays. +- Performance: + * Improved session handling: reduces database overhead. + * Improved access checking: reduces database overhead. + * Made it possible to do memcached based session management. + * Omit sidebars when serving a '404 - Page not found': saves CPU cycles and bandwidth. + * Added an 'aggressive' caching policy. + * Added a CSS aggregator and compressor (up to 40% faster page loads). +- Removed the archive module. +- Upgrade system: + * Created space for update branches. +- Forms API: + * Made it possible to programmatically submit forms. + * Improved api for multistep forms. +- Theme system: + * Split up and removed drupal.css. + * Added nested lists generation. + * Added a self-clearing block class. + +Drupal 4.7.11, 2008-01-10 +------------------------- +- fixed a security issue (Cross site request forgery), see SA-2008-005 +- fixed a security issue (Cross site scripting, UTF8), see SA-2008-006 +- fixed a security issue (Cross site scripting, register_globals), see SA-2008-007 + +Drupal 4.7.10, 2007-12-06 +------------------------- +- fixed taxonomy feed bug introduced by SA-2007-031 + +Drupal 4.7.9, 2007-12-05 +------------------------ +- fixed a security issue (SQL injection), see SA-2007-031 + +Drupal 4.7.8, 2007-10-17 +---------------------- +- fixed a security issue (HTTP response splitting), see SA-2007-024 +- fixed a security issue (Cross site scripting via uploads), see SA-2007-026 +- fixed a security issue (API handling of unpublished comment), see SA-2007-030 + +Drupal 4.7.7, 2007-07-26 +------------------------ +- fixed security issue (XSS), see SA-2007-018 + +Drupal 4.7.6, 2007-01-29 +------------------------ +- fixed security issue (code execution), see SA-2007-005 + +Drupal 4.7.5, 2007-01-05 +------------------------ +- Fixed security issue (XSS), see SA-2007-001 +- Fixed security issue (DoS), see SA-2007-002 + +Drupal 4.7.4, 2006-10-18 +------------------------ +- Fixed security issue (XSS), see SA-2006-024 +- Fixed security issue (CSRF), see SA-2006-025 +- Fixed security issue (Form action attribute injection), see SA-2006-026 + +Drupal 4.7.3, 2006-08-02 +------------------------ +- Fixed security issue (XSS), see SA-2006-011 + +Drupal 4.7.2, 2006-06-01 +------------------------ +- Fixed critical upload issue, see SA-2006-007 +- Fixed taxonomy XSS issue, see SA-2006-008 +- Fixed a variety of small bugs. + +Drupal 4.7.1, 2006-05-24 +------------------------ +- Fixed critical SQL issue, see SA-2006-005 +- Fixed a serious upgrade related bug. +- Fixed a variety of small bugs. + +Drupal 4.7.0, 2006-05-01 +------------------------ +- Added free tagging support. +- Added a site-wide contact form. +- Theme system: + * Added the PHPTemplate theme engine and removed the Xtemplate engine. + * Converted the bluemarine theme from XTemplate to PHPTemplate. + * Converted the pushbutton theme from XTemplate to PHPTemplate. +- Usability: + * Reworked the 'request new password' functionality. + * Reworked the node and comment edit forms. + * Made it easy to add nodes to the navigation menu. + * Added site 'offline for maintenance' feature. + * Added support for auto-complete forms (AJAX). + * Added support for collapsible page sections (JS). + * Added support for resizable text fields (JS). + * Improved file upload functionality (AJAX). + * Reorganized some settings pages. + * Added friendly database error screens. + * Improved styling of update.php. +- Refactored the forms API. + * Made it possible to alter, extend or theme forms. +- Comment system: + * Added support for "mass comment operations" to ease repetitive tasks. + * Comment moderation has been removed. +- Node system: + * Reworked the revision functionality. + * Removed the bookmarklet code. Third-party modules can now handle + This. +- Upgrade system: + * Allows contributed modules to plug into the upgrade system. +- Profiles: + * Added a block to display author information along with posts. + * Added support for private profile fields. +- Statistics module: + * Added the ability to track page generation times. + * Made it possible to block certain IPs/hostnames. +- Block system: + * Added support for theme-specific block regions. +- Syndication: + * Made the aggregator module parse Atom feeds. + * Made the aggregator generate RSS feeds. + * Added RSS feed settings. +- XML-RPC: + * Replaced the XML-RPC library by a better one. +- Performance: + * Added 'loose caching' option for high-traffic sites. + * Improved performance of path aliasing. + * Added the ability to track page generation times. +- Internationalization: + * Improved Unicode string handling API. + * Added support for PHP's multibyte string module. +- Added support for PHP5's 'mysqli' extension. +- Search module: + * Made indexer smarter and more robust. + * Added advanced search operators (e.g. phrase, node type, ...). + * Added customizable result ranking. +- PostgreSQL support: + * Removed dependency on PL/pgSQL procedural language. +- Menu system: + * Added support for external URLs. +- Queue module: + * Removed from core. +- HTTP handling: + * Added support for a tolerant Base URL. + * Output URIs relative to the root, without a base tag. + +Drupal 4.6.11, 2007-01-05 +------------------------- +- Fixed security issue (XSS), see SA-2007-001 +- Fixed security issue (DoS), see SA-2007-002 + +Drupal 4.6.10, 2006-10-18 +------------------------ +- Fixed security issue (XSS), see SA-2006-024 +- Fixed security issue (CSRF), see SA-2006-025 +- Fixed security issue (Form action attribute injection), see SA-2006-026 + +Drupal 4.6.9, 2006-08-02 +------------------------ +- Fixed security issue (XSS), see SA-2006-011 + +Drupal 4.6.8, 2006-06-01 +------------------------ +- Fixed critical upload issue, see SA-2006-007 +- Fixed taxonomy XSS issue, see SA-2006-008 + +Drupal 4.6.7, 2006-05-24 +------------------------ +- Fixed critical SQL issue, see SA-2006-005 + +Drupal 4.6.6, 2006-03-13 +------------------------ +- Fixed bugs, including 4 security vulnerabilities. + +Drupal 4.6.5, 2005-12-12 +------------------------ +- Fixed bugs: no critical bugs were identified. + +Drupal 4.6.4, 2005-11-30 +------------------------ +- Fixed bugs, including 3 security vulnerabilities. + +Drupal 4.6.3, 2005-08-15 +------------------------ +- Fixed bugs, including a critical "arbitrary PHP code execution" bug. + +Drupal 4.6.2, 2005-06-29 +------------------------ +- Fixed bugs, including two critical "arbitrary PHP code execution" bugs. + +Drupal 4.6.1, 2005-06-01 +------------------------ +- Fixed bugs, including a critical input validation bug. + +Drupal 4.6.0, 2005-04-15 +------------------------ +- PHP5 compliance +- Search: + * Added UTF-8 support to make it work with all languages. + * Improved search indexing algorithm. + * Improved search output. + * Impose a throttle on indexing of large sites. + * Added search block. +- Syndication: + * Made the ping module ping pingomatic.com which, in turn, will ping all the major ping services. + * Made Drupal generate RSS 2.0 feeds. + * Made RSS feeds extensible. + * Added categories to RSS feeds. + * Added enclosures to RSS feeds. +- Flood control mechanism: + * Added a mechanism to throttle certain operations. +- Usability: + * Refactored the block configuration pages. + * Refactored the statistics pages. + * Refactored the watchdog pages. + * Refactored the throttle module configuration. + * Refactored the access rules page. + * Refactored the content administration page. + * Introduced forum configuration pages. + * Added a 'add child page' link to book pages. +- Contact module: + * Added a simple contact module that allows users to contact each other using e-mail. +- Multi-site configuration: + * Made it possible to run multiple sites from a single code base. +- Added an image API: enables better image handling. +- Block system: + * Extended the block visibility settings. +- Theme system: + * Added new theme functions. +- Database backend: + * The PEAR database backend is no longer supported. +- Performance: + * Improved performance of the forum topics block. + * Improved performance of the tracker module. + * Improved performance of the node pages. +- Documentation: + * Improved and extended PHPDoc/Doxygen comments. + +Drupal 4.5.8, 2006-03-13 +------------------------ +- Fixed bugs, including 3 security vulnerabilities. + +Drupal 4.5.7, 2005-12-12 +------------------------ +- Fixed bugs: no critical bugs were identified. + +Drupal 4.5.6, 2005-11-30 +------------------------ +- Fixed bugs, including 3 security vulnerabilities. + +Drupal 4.5.5, 2005-08-15 +------------------------ +- Fixed bugs, including a critical "arbitrary PHP code execution" bug. + +Drupal 4.5.4, 2005-06-29 +------------------------ +- Fixed bugs, including two critical "arbitrary PHP code execution" bugs. + +Drupal 4.5.3, 2005-06-01 +------------------------ +- Fixed bugs, including a critical input validation bug. + +Drupal 4.5.2, 2005-01-15 +------------------------ +- Fixed bugs: a cross-site scripting (XSS) vulnerability has been fixed. + +Drupal 4.5.1, 2004-12-01 +------------------------ +- Fixed bugs: no critical bugs were identified. + +Drupal 4.5.0, 2004-10-18 +------------------------ +- Navigation: + * Made it possible to add, delete, rename and move menu items. + * Introduced tabs and subtabs for local tasks. + * Reorganized the navigation menus. +- User management: + * Added support for multiple roles per user. + * Made it possible to add custom profile fields. + * Made it possible to browse user profiles by field. +- Node system: + * Added support for node-level permissions. +- Comment module: + * Made it possible to leave contact information without having to register. +- Upload module: + * Added support for uploading documents (includes images). +- Forum module: + * Added support for sticky forum topics. + * Made it possible to track forum topics. +- Syndication: + * Added support for RSS ping-notifications of http://technorati.com/. + * Refactored the categorization of syndicated news items. + * Added an URL alias for 'rss.xml'. + * Improved date parsing. +- Database backend: + * Added support for multiple database connections. + * The PostgreSQL backend does no longer require PEAR. +- Theme system: + * Changed all GIFs to PNGs. + * Reorganised the handling of themes, template engines, templates and styles. + * Unified and extended the available theme settings. + * Added theme screenshots. +- Blocks: + * Added 'recent comments' block. + * Added 'categories' block. +- Blogger API: + * Added support for auto-discovery of blogger API via RSD. +- Performance: + * Added support for sending gzip compressed pages. + * Improved performance of the forum module. +- Accessibility: + * Improved the accessibility of the archive module's calendar. + * Improved form handling and error reporting. + * Added HTTP redirects to prevent submitting twice when refreshing right after a form submission. +- Refactored 403 (forbidden) handling and added support for custom 403 pages. +- Documentation: + * Added PHPDoc/Doxygen comments. +- Filter system: + * Added support for using multiple input formats on the site + * Expanded the embedded PHP-code feature so it can be used everywhere + * Added support for role-dependant filtering, through input formats +- UI translation: + * Managing translations is now completely done through the administration interface + * Added support for importing/exporting gettext .po files + +Drupal 4.4.3, 2005-06-01 +------------------------ +- Fixed bugs, including a critical input validation bug. + +Drupal 4.4.2, 2004-07-04 +------------------------ +- Fixed bugs: no critical bugs were identified. + +Drupal 4.4.1, 2004-05-01 +------------------------ +- Fixed bugs: no critical bugs were identified. + +Drupal 4.4.0, 2004-04-01 +------------------------ +- Added support for the MetaWeblog API and MovableType extensions. +- Added a file API: enables better document management. +- Improved the watchdog and search module to log search keys. +- News aggregator: + * Added support for conditional GET. + * Added OPML feed subscription list. + * Added support for , , , , and . +- Comment module: + * Made it possible to disable the "comment viewing controls". +- Performance: + * Improved module loading when serving cached pages. + * Made it possible to automatically disable modules when under heavy load. + * Made it possible to automatically disable blocks when under heavy load. + * Improved performance and memory footprint of the locale module. +- Theme system: + * Made all theme functions start with 'theme_'. + * Made all theme functions return their output. + * Migrated away from using the BaseTheme class. + * Added many new theme functions and refactored existing theme functions. + * Added avatar support to 'Xtemplate'. + * Replaced theme 'UnConeD' by 'Chameleon'. + * Replaced theme 'Marvin' by 'Pushbutton'. +- Usability: + * Added breadcrumb navigation to all pages. + * Made it possible to add context-sensitive help to all pages. + * Replaced drop-down menus by radio buttons where appropriate. + * Removed the 'magic_quotes_gpc = 0' requirement. + * Added a 'book navigation' block. +- Accessibility: + * Made themes degrade gracefully in absence of CSS. + * Grouped form elements using '
' and '' tags. + * Added '