glFusion v1.1.4 is primarily a security and bug fix release, with a few minor feature enhancements thrown in.
This release does make configuration modifications, so you must run the Installation / Upgrade routine after you have loaded the files to your server.
We have audited the glFusion code base and identified a few areas where coding best practices were not always followed. As a result, we have improved the data checks and validations on many SQL calls.
We’ve also consolidated some of the writable directories so we can reduce the overall number of directories that glFusion needs to have write permissions. Specifically, we have eliminated the Media Gallery rss/ directory and moved the Media Gallery RSS files to the glFusion backend/ directory. We’ve also moved the cached style.css and javascript.js files from the public_html/ directory into the layout_cache/ directory, so there is no requirement for glFusion to write to the public_html/ directory.
In glFusion v1.1.3 we implemented a new security feature that checks to ensure the IP address used to set the long term cookie is the same as the user who is trying to auto login with the long term cookie. This fix removes the ability for someone to steal a users password hash and login (masquerade) as that user. We found this ‘fix’ can cause issues to users who are behind multiple proxy servers where the IP address can change very often. In glFusion v1.1.4 we’ve added the ability to disable this security check.
We added some additional protections to Media Gallery so users cannot upload malicious files if the album is configured to allow any file type.
You now have the ability to override any of the language file texts with your own custom language file. Custom language files would go in the private/language/custom/ directory. The files should only contain the actual language text you want to override, not the entire language file. For example, if I want to override the text:
"This email was sent to you by %s at %s because they thought you might be interested in this article from {$_CONF['site_url']}. This is not SPAM and the email addresses involved in this transaction were not saved to a list or stored for later use."
It is located in the language file stored in the $LANG08[23] variable, so my override file would be:
custom/english.php $LANG08[23]='This is my override text';
During the next upgrade you won't have to worry about your customizations being overwritten!
We've added a new PHP block, phpblock_lastlogin() which will display that last 5 users to log into the site.
We've also added a list of the last 10 users logged in to the stats page.
At one time, glFusion used css.php and js.php PHP scripts to send the stylesheet and javascript to the browser. This was great for performance in sending the data to the browser, but it added a lot of load to the web server. In the previous release of glFusion, we moved to using a cache file, this provided the benefit of the speed to the browser with lower load on the server. While this worked well, it did require that the public_html/ directory had to be writable, which we believe is not the best security practice.
In glFusion v1.1.4, we've found a good compromise on speed, load, and security. We've implemented an improved css.php and js.php that does not place any additional load on the server, maintains the speed of sending the data to the browser in a single HTTP call and does not require the public_html/ be writable.
You will need to update your htmlheader.thtml file if you have a custom version on your site!
When you log into a glFusion site, a long term cookie is set in the browser that contains an encrypted version of your password. This allows you to automatically login to the site hours later. In v1.1.3 we added a security control to validate the IP address of the user to the IP address that originally created the long term cookie. This works great in most cases and removes the ability to someone to masquerade as another user. Unfortunately, if you have users who surf the web while behind a set of proxy servers, their IP address may change with each page load. We’ve now included the ability to turn off this check if it is causing problems for your users.
To turn off the IP check, edit your siteconfig.php file and add (or modify if there already) the following line:
$_SYSTEM['skip_ip_check'] = 1; // 0 = Check IP 1 = Do not check IP
We've added the ability to change the owner on static pages and files in the FileMgmt plugin.
FileMgmt Plugin
Forum Plugin
Media Gallery Plugin
Site Tailor Plugin
StaticPages Plugin