glFusion v1.1.3 is primarily a security and bug fix release, with a few minor feature enhancements thrown in.
This release does make database modifications, so you must run the Installation / Upgrade routine after you have loaded the files to your server.
There are three security updates included with this release to address the following issues:
SQL Injection Issue which could allow an attacker to compromise (gain access) to any user's password hash. This was a very serious vulnerability which could allow your admin user account to become compromised.
User Masquerading which would allow anyone to log in as any user if they knew the password hash of the user. By setting the appropriate cookie on their own browser, you could bypass the user name / password screen and log in directly. Combined with the SQL Injection issue above, this would allow an attacker to easily log in as any user.
Cross Site Scripting (XSS) Issue which could allow an attacker to use a glFusion site in cross site scripting attacks.
All of these issues have been fixed in glFusion v1.1.3 and some additional checks have been included to help prevent future issues like these.
Caching of the template files generally provides a significant performance boost, but we have found in some environments it can actually have a negative impact on performance. Specifically, on sites where the disk access is slower, caching of the templates will slow down the site and add to the server load. A good is example is Windows based servers that use network shares to store the web directories.
You now have the ability to control whether or not the templates are cached. In the Online Configuration system, under Themes, is the new option Enable Template Caching. We recommend you do your own tests, disable caching and see how it affects the performance of your site.
glFusion uses several small template files to assemble each web page. It can be difficult to understand which template to modify to affect a change to the look and feel of your site. While not a new feature, glFusion has always supported having comments in the template files that are stripped before sending to the browser. These comments are surrounded by {# …comment here #}. The new feature in v1.1.3 is the ability to convert these internal template comments into HTML comments. This means any {# #} will be translated into <!– –> so you can see them when viewing the source of your rendered web page.
We have also added a special template variable called templatelocation which is replaced the physical location and name of the current template file. We have added the following comment to every .thtml template (in private/plugins as well as public_html/):
{# begin {templatelocation} #}
{# end {templatelocation} #}
If you enable Template Comments, when you view the source of your page, you'll see something like this for each template used to build the page:
<!-- begin /usr/home/www/private/plugins/polls/templates/pollanswer.thtml --> <li><input type="radio" name="aid[0]" value="6" /> Other</li> <!-- end /usr/home/www/private/plugins/polls/templates/pollanswer.thtml -->
You can now easily see what template is being used, the content it produces, and where it ends.
glFusion has always had the ability to show or hide most of the Story Information information like author, views, mail story, etc. The ability to hide or show the story date / time was never included. We've solved this oversight by adding the option to show or hide the story date / time.
glFusion v1.1.1 added a new feature to consolidate all CSS and JavaScript output into a single reference point for the browser. This significantly improved the page load times. Now that this feature has been well exercised, we've also discovered it can add some extra CPU load to the server. We've redesigned how the CSS and JavaScript is spooled so we now have the best of both worlds, improved page load times and no additional server load.
We moved the Current Password field to the top of the entry form. Since a user must enter their current password to change their existing password, it makes sense to have it listed before the new password fields.
We've also added a Password Strength meter to give feedback to the user on how secure their password really is.
Calendar Plugin
CAPTCHA Plugin
FileMgmt Plugin
Forum Plugin
Media Gallery Plugin
Polls Plugin
Site Tailor