History: ReleaseProcess1910

Tiki 1.9.10 (and quickfix 1.9.10.1) was released by Marc Laporte and Louis-Philippe Huberdeau.

Compared to 1.9.9, this release contains 77 commits by from 2007-12-22 to 2008-02-22 by franck, lphuberdeau, luciash, marclaporte, mose, nkoth, sylvieg

Thank you to Fortify software for reporting a cross-site scripting (XSS) vulnerability in tiki-edit_article.php. Until you upgrade, workaround is to not permit non-trusted users or deactivate the articles feature altogether.

Security

• Improving input sanitizer (pre 1.9.10)
• New pre-emptive securitycheck.php script
• Adding feature and permission checks to all files to comply with the securitycheck.php script.
• Developer script have extra protection to make sure they can't be run from the web (on a badly configured server)
• Lots of useless files were deleted.

• Fix a bug to "Real name" in tiki-adminusers.php which was introduced in 1.9.9 This caused issues with registration as well. Users were not able to login.
• Image gallery: fixed the next-prev glitch
• Various fixes to Live Support.
• Various fixes to InterTiki
• Forums: prevent forum pruning from removing comments as well, or from other forums.
• Fixes to "thumbnail" plugin
• Better handling of usernames with special characters

• tiki-contact.php has anti-bot protection
• and some administrative fixes and enhancements to the release, security and developer scripts.
• New "suprescript" plugin to make easy superscript in wiki page, without using html, like subscript plugin.

  
  

http://tikiwiki.org/changelog