glFusion v1.2.0 continues our commitment to providing a secure and robust content management system. This releases contains some significant security updates, several consistency tweaks, and several improvements to the administrative functions. All glFusion users are encouraged to upgrade as soon as possible.
For those who are upgrading, please don't forget to run the Upgrade Wizard after you have loaded the files to your server.
Some of the enhancements below required us to make some changes to the template files. Be sure and check out the Template Changes page and update any of your custom templates.
Defense in Depth Security Enhancements
Improved Password Encryption
With this release we have replaced the password encryption algorithm with a much more security method. Previously, glFusion relied on MD5 encryption, which has started to show its age and has been proven to be breakable. Your current users will continue to use the MD5 method until they change their password. Any new users, and users who change their password, will automatically start using the newer encryption method.
Improved Session Handling
In prior versions of glFusion, the method used to allow users to automatically login for an extended period of time (the Remember Me setting in My Account) would expose the MD5 password hash. The cookie used to allow the auto login contained the MD5 hash of the user's password.
There are a couple of problems with this approach. First, if the cookie were to be stolen or hijacked, it is possible someone could crack the MD5 encrypted password. Second, the length of time the cookie is valid (time to live) was controlled by the client, not the server. Basically, glFusion had no way to enforce how long the cookie was valid.
glFusion has always had extra protections to help mitigate the two items above. glFusion would validate the IP address of the user who set the cookie matched the user who was trying to use it. Still, with the weak encryption that MD5 offers, exposing the encrypted password simply is not a good practice.
With glFusion v1.2.0, the 'Remember Me' automatic login process has been completely re-engineered so the user's encrypted password is no longer used. Instead, session tokens are used and their time to live is now controlled in glFusion. These enhancements combined with the existing IP checking provide for a much more secure environment.
Administrative Features Require Re-authentication
With glFusion v1.2.0, we now require re-authentication before allowing access to the administrative features of the site. This provides another layer of defense for your site. Although we have several significant protections in place to protect the long term cookie (Remember Me), this additional protection is simply one more layer of protection.
General Code Improvements
We continue to perform code reviews and make necessary adjustments to improve the overall security posture of the system. Once specific area where we focused during this release cycle was the use of the PHP function addslashes. This function is used to protect SQL queries from SQL injection attacks. We have replaced the use of addslashes() with the mysql_real_escape_string() function which provides better protection.
Summary
These are all defense in depth enhancements. This means we do not rely on just 1 or 2 protection methods, we have several layers to provide the best protections we can. We honestly don't know what the next vulnerability will be, but our goal is to lessen the effectiveness of any potential breaches. It is one thing to claim to be a secure environment, but without a good defense in depth approach, talk is cheap.
Administrative Enhancements
Look and Feel
Mark Howard has been very busy reworking many of the administrative screens to make them both consistent in look and feel, and to make them much more usable.
User Editor
There is a new user editor in glFusion v1.2.0 that allows the site administrator to edit all attributes about a user, including their preferences for 3rd party plugins.
Global User Preference Editor
The Global User Preference Editor allows the site administrator to change certain user preferences for all users. For example, if you decide that you would prefer the comments show in a nested format, you can change the site default, but that does not override each user's individual preference. You can now reset all users to use the nested format.
Default Groups
You can now assign specific groups to users automatically through the Group Editor user interface. In past versions of glFusion, you had to write a custom PHP function to accomplish this goal. The Private Message plugin uses this feature, where it sets the PM Users group as a default group. This will automatically allow all users to send / receive private messages. As an example, if you had a user who was abusing the privilege (sending too many messages, bothering or harassing other users), you then simply remove them from the PM Users group, and they no longer have access to the PM plugin.
Consistency Improvements
We've reviewed the general functionality of various components of glFusion and tried to bring an improved consistency to how certain tasks are handled.
Login Required
If a function requires the user to login, we now present the login screen with a message stating that access to this area requires you to login, instead of just a message stating login required.
Navigation / Extra Block Display
We have implemented the option for all plugins to determine if the right / left navigation columns should display. In the past, some plugins supported this, others didn't. Now, the majority of the 3rd party plugins support this feature.
Comment Enhancements
Eric and I have reworked the overall style of comments in glFusion v1.2.0. It now defaults to include the comment author's avatar within the comments. Comments made by the article author (the person who wrote the original story) can be styled differently from the others to make them stand out more. We even included a way to specify styling for comments made by certain groups of users (say all Root users, etc.) We have changed the default view mode to nested, which really does a much better job of presenting comments. Finally, we have added a configuration option to allow you to specify which editor (Text, HTML, or WYSIWYG) to use for posting comments.
Improved User Registration
We have added the much requested option to allow users to select their own password at registration time. Now you have the option to allow new users to choose their own password and receive an activation email when they register. With this registration method, once they select the link in the activation email, their account will be activated. We believe this new feature will make for a much better user registration experience. For more details, see the User Registration documentation.
glFusion v1.2.0
Calendar Plugin
CAPTCHA Plugin
FileMgmt Plugin
Forum Plugin
Links Plugin
Media Gallery Plugin
Polls Plugin
Site Tailor Plugin
Staticpages Plugin