Version 3.2.7 (2014-02-13)
--------------------------
### Fixed
Fix another weakness in the `Input` class and further harden the `deserialize()`
function. Thanks to Martin Auswöger for his input.
Version 2.11.16 (2014-02-13)
----------------------------
### Fixed
Fix another weakness in the `Input` class and further harden the `deserialize()`
function. Thanks to Martin Auswöger for his input.
* pkgsrc change: remove obsolete lines for contao31.
Version 3.2.5 (2014-02-03)
--------------------------
### Fixed
Correctly load the parent pages in the navigation modules (see #6696).
### Fixed
Correctly encode URLs with GET parameters in the syndication links (see #6683).
### Fixed
Do not pass POST data to the `deserialize()` function, so it is not vulnerable
to PHP object injection. Thanks to Pedro Ribeiro for his input (see #6695).
### Fixed
Allow any character in passwords, especially the less-than symbol (see #6447).
### Fixed
Purge the image cache if a file is being renamed (see #6641).
### Fixed
Preserve tags in custom CSS definitions (see #6667).
### Fixed
Make the swipe CSS selectors more specific (see #6666).
### Fixed
Correctly optimize floating-point numbers in style sheets (see #6674).
Version 2.11.14 (2014-02-03)
----------------------------
### Fixed
Do not pass POST data to the `deserialize()` function, so it is not vulnerable
to PHP object injection. Thanks to Pedro Ribeiro for his input (see #6695).
Version 3.2.4 (2014-01-20)
--------------------------
### Fixed
Updated the Russian translation of the TinyMCE "typolinks" plugins (see #6224).
### Fixed
Do not create multiple stylect layers upon Ajax changes.
### Fixed
Some DCAs were missing the "rem" unit (see #6634).
### Fixed
Correctly trim the SQL statements in the `Database` class (see #6623).
### Fixed
Fix some broken back end icons (see #6214).
### Fixed
Show a hint in the news archive menu if there are no items (see #5888).
### Fixed
Prevent the back end tool tips from exceeding the screen width (see #6639).
### Fixed
Support the Google+ vanity name in addition to the numeric ID (see #6454).
### Fixed
Correctly detect Android tablets in the `Environment` class (see #5869).
### Fixed
Correctly resolve the module dependencies (see #6606).
### Fixed
Correctly unset the PHP session cookie depending on its parameters.
### Fixed
Fixed the XHTML variant of the comments form (see #5675).
### Fixed
Correctly assign articles to columns (see #6595).
### Fixed
Correctly merge the CSS classes in the `Hybrid` class (see #6601).
fix a few trivial (but nasty) problems of this almost leaf package:
approved by gdt@.
Version 3.2.3 (2013-12-20)
--------------------------
### Fixed
Correctly resize the mediaboxAdvanced in IE11 (see #6504).
### Fixed
Set the correct status header for cached files (see #6585).
### Fixed
Correctly set the empty value depending on the DB field (fixes#6550, #6544).
### Fixed
Prevent saving of detached models (see #6506).
### Fixed
Correctly determine the ACE editor's height (see #6578).
### Fixed
Always fall back to English if a language does not exist (see #6581).
### Fixed
Correctly display repeated events in the event list (see #6555).
### Fixed
Correctly show the available layout columns in the article module (see #6548).
### Fixed
Correctly show the "read more" link in the news list modules (see #6439).
### Updated
Updated html5shiv to version 3.7.0 (see #6543).
### Fixed
Support browsers with both mouse and touch support in the back end (see #6520).
### Fixed
Correctly handle multiple `RadioTable` widgets on the same page (see #6389).
### Fixed
Fixed two issues with the SQL cache (see #6507).
### Fixed
Do not require a redirect page for newsletter channels (see #6521).
### Fixed
Use the related field instead of `id` in the model query builder (see #6540).
Version 3.2.2 (2013-12-09)
--------------------------
### Fixed
Correctly support insert tags nested in shortened "iflng" tags (see #6509).
### Fixed
Do not require a foreign key to define a relation in the DCA (see #6524).
### Fixed
Use UUIDs as parent IDs in `Dbafs::addResource()` (see #6532).
### Fixed
Correctly set the default language (see #6533).
### Fixed
Correctly update the order fields in the database updater (see #6534).
### Fixed
Do not override the "href" property in `addImageToTemplate()` (see #6468).
### Fixed
Correctly handle URLs if page aliases are disabled (see #6502).
### Fixed
Handle UUIDs in `Model::getRelated()` (see #6525).
### Fixed
Hide records with only one version from the "changed elements" overview.
### Fixed
Use an auto-resizing textarea to store CSS selectors.
### Updated
Updated the ACE editor to version 1.1.2.
### Fixed
Prevent the ACE editor from overlapping the modal window (see #6497).
### Fixed
Use the default back end theme when running in safe mode (see #6505).
* pkgsrc change: drop optional php-tidy package requirement from MESSAGE.
Version 3.2.1 (2013-11-29)
--------------------------
### Updated
Updated TinyMCE to version 3.5.10 to fix the IE11 issues (see #6479).
### Fixed
Optionally override the repository tables when importing a template (see #6470).
### Fixed
Only do the UUID conversion once even if the `Database\Updater` helper methods
are called multiple times (see #6481).
### Fixed
Correctly toggle the mobile/desktop view (see #6227).
### Fixed
Correctly detect UUIDs in the "file" insert tag (see #6472).
### Fixed
Correctly assign images to FAQs (see #6465).
### Fixed
Improved the speed and memory footprint of the news archive menu (see #6463).
### Fixed
Removed `CalendarEventsModel::findBoundaries()` (see #6467).
Version 2.11.13 (2013-11-19)
----------------------------
### Fixed
Sort the list of available modules (see #6391).
### Fixed
Decode entities in passwords (see #6252).
### Fixed
Replace insert tags in the details view of the listing module (see #6120).
Version 3.1.4 (2013-10-14)
--------------------------
### Fixed
Do not show the debug bar in the modal dialog (see #6302).
### Fixed
Ignore the "maxlength" setting in certain form fields (see #6283).
### Fixed
Correctly show the "toggle page status" icon (see #6282).
### Removed
Removed the TinyMCE spell checker (see #6247).
### Updated
Updated TCPDF to version 3.0.38 (see #6268).
### Fixed
Correctly render the pages breadcrumb menu for non-admin users (see #6067).
### Fixed
Correctly handle the accordion fields during the version 3.1 update (see #6229).
### Fixed
Correctly handle special characters in page aliases (see #6232).
Version 3.1.3 (2013-09-24)
--------------------------
### Fixed
Do not redirect to protected pages after logout (see #6210).
### Fixed
Consider the additional arguments in `Frontend::jumpToOrReload()` (see #5734).
### Fixed
Prevent article aliases from using reserved names (see #6066).
### Fixed
Correctly update the RSS feeds if a news item or event changes (see #6102).
### Fixed
Correctly link to news and calendar feeds via insert tag (see #6164).
### Fixed
Make the CSS ID available in the custom navigation module (see #6129).
### Fixed
Do not cache the "toggle_view" insert tag (see #6172).
### Fixed
Unset the primary key if a model is deleted (see #6162).
### Fixed
Support `tel:` and `sms:` upon IDNA conversion (see #6148).
### Fixed
Apply the width and height to the audio player as well (see #6114).
### Fixed
Do not exit after a template has been output (see #5570).
### Changed
Drop the database query cache (see #6070). This renders `executeUncached()` and
`executeCached()` deprecated. Use `execute()` instead.
### Fixed
Handle all possible errors when uploading files (see #5934).
Version 3.1.2 (2013-08-27)
--------------------------
### Fixed
Add the global date format in `PageModel::loadDetails()` (see #6104).
### Fixed
Do not override the referer upon Ajax requests (see #5956).
### Fixed
Fixed the content slider in IE < 9 (see #5878).
### Fixed
Do not set a database driver by default (see #6088).
### Fixed
Decode punycode domains in the listing module (see #5946).
### Fixed
Show all themes a template is defined in (see #6071).
### Fixed
Do not add the domain name twice in `redirectToFrontendPage()` (see #6076).
### Fixed
Use the `currentLogin` field to sort users by their last login (see #5949).
### Fixed
Fix the offset handling in the CSS grid (see #5943).
### Fixed
Do not use the `date`, `time` and `datetime` input types (see #5918).
### Fixed
Show tooltips for selected single images in the file picker (see #6031).
### Fixed
Correctly synchronize if a sub folder is selected (see #5979).
### Fixed
Correctly handle password which are longer than 64 characters (see #6015).
### Fixed
Added missing Vietnamese characters to the UFT8 mapper (see #6010).
### Fixed
Decode entities in the page and file pickers (see #5989).
### Fixed
Ensure that the default user and group are integer values (see #6017).
### New
Added the Czech typolinks translations (thanks to ShiraNai7) (see #6051).
### Fixed
Added an option to purge the search cache (see #6041).
### Fixed
Preserve the repository tables when importing a theme (see #6037).
### Fixed
Pass the module to `getAttributesFromDca()` in the registration and personal
data module classes (see #6002).
### Fixed
Validate the e-mail address when creating an admin user (see #6003).
### Fixed
Fix the newslist pagination count (see #5997).
### Fixed
Make the GD image max width and height parameters mandatory (see #5940).
### Fixed
Replace all insert tags when exporting a page as PDF (see #5990).
### Fixed
Correctly validate the options in `Widget::isValidOption()` (see #5951).
### Fixed
Decode IDNA domains in any system mail (see #5932).
### Fixed
Store integers bigger than `PHP_INT_MAX` as string (see #5939).
### Fixed
Fix the alignment of the versions menu in IE (see #5962).
### Fixed
Do not cache the result of `Model::count*()` (see #5973).
### Fixed
Added some missing office file extensions to the configuration (see #6021).
### Fixed
Fixed the "indexPage" hook (see #5967).
### Fixed
Do not copy the autologin hash when duplicating members (see #5945).
### Fixed
Added .svgz support to the default `.htaccess` file (see #5938).
Version 2.11.12 (2013-08-22)
----------------------------
### Fixed
Allow to paste into the root page in "edit multiple" mode (see #5620).
### Updated
Updated TCPDF to version 6.0.010 (see #5676).
### Fixed
Backported the changes from e44864d2 (see #5683).
### Fixed
Handle all possible errors when uploading files (see #5934).
### Improved
Improved the memory footprint of the search index rebuild (see #5681).
### Fixed
Do not trigger the "setNewPassword" hook twice (see #5247).
### Updated
Updated SimplePie to version 1.3.1 (see #5604).
### Fixed
Delete the `pathconfig.php` file in the install tool (see #5536).
Albanian language files are added and Spanish language files are re-added.
Version 3.1.1 (2013-06-25)
--------------------------
### Fixed
Append the query string when forwarding (see #5867).
### Fixed
Decouple the file/page picker breadcrumb from the file/page manager (see #5899).
### Fixed
Also show the mandatory star in password confirmation fields (see #5926).
### Fixed
Only return one IP address in `Environment::get('ip')` (see #5830).
### Fixed
Explicitly check for `.php` files when scanning DCA files (see #5898).
### Fixed
Replaced all dummy `.htaccess` files with `.gitignore` files.
### Fixed
Quote wildcard characters in MySQL `LIKE` queries (see #5896).
### Fixed
Correctly align the version drop-down menu in Safari (see #5854).
### Fixed
Make sure `window.$` is mapped to MooTools (see #5892).
### Fixed
Do not add sort buttons to table row headers (see #5845).
### Fixed
Show the newsletter channels upon registration (see #5874).
### Updated
Updated ACE to version 1.1.01 (fixes#5852).
### Fixed
Correctly handle hidden pages in the custom navigation module (see #5832).
### Fixed
Support FAQs with images on the FAQ page (see #5810).
### Fixed
Support using commas in folder names in the file selector (see #5823).
### Fixed
Ignore the `auto_item` parameter when forwarding internally (see #5886).
### Fixed
Added support for old IE versions to swipe.js (see #5862).
### Fixed
Correctly bypass the cache if `bypassCache` is set (see #5872).
### Fixed
Preserve the CSS3PIE behavior file path when combining style sheets (see #5848).
### Fixed
Support all known template types in the autoload creator (see #5857).
### Fixed
Correctly adjust the accordion elements to the new DB structure (see #5820).
### Fixed
Added `E_USER_DEPRECATED` to the list of error constants (see #5839).
Version 2.11.11 (2013-04-03)
----------------------------
### Fixed
Pass the style attribute to empty image gallery table cells (see #5485).
### Fixed
Do not override the website path in the default config file (see #5339).
pkgsrc change: stop using DIST_SUBDIR.
Version 3.0.6 (2013-03-21)
--------------------------
### Fixed
Do not add links to news, events, FAQs or newsletters to the sitemap if the
target page has not been published (see #5520).
### Fixed
Include the local configuration file twice, once before and once after the
module configuration files are parsed (see #5490). This will make settings like
the debug or safe mode work properly.
### Fixed
Correctly set the RSS feed self-reference (see #5478).
### Fixed
Remove `­` and ` ` from RSS and Atom feeds (see #5473).
### Fixed
Do not remove the grid column margin on mobile devices (see #5475).
### Fixed
Store the relative path to the installation in the `pathconfig.php` (see #5339).
### Fixed
Correctly send the comment moderation mails (see #5443).
### Fixed
Correctly create the user home directory upon registration (see #5437).
### Improved
Made the `.htaccess` files Apache 2.4 ready (see #5032).
### Fixed
Also truncate opened files in `File::truncate()` (see #5459).
### Fixed
Added the "allowTransparency" attribute to the mediabox script (see #5077).
### Fixed
The submit button label was not shown in the `FormSubmit` widget (see #5434).
### Fixed
Show invisible elements in the back end preview (see #5449).
### Fixed
Allow to create forward pages without a specific target (see #5453).
### Fixed
Updated the TinyMCE typolinks plugin (see #5329).
### Fixed
Correctly initialize the user's pagemounts (see #5454).
### Fixed
Support loading static JavaScripts in the `config.php` files (see #4890).
### Fixed
Show all articles if the article list module is in the same column (see #5373).
### Fixed
Do not show `mail_` templates from theme folders (see #5379).
### Fixed
Consider only published events when finding the calendar boundaries and only
render the previous and next links if there are events (see #5426).
### Fixed
Do not override the header and footer height in the layout builder (see #5368).
### Fixed
Correctly reset fallback, default and "do not copy" fields (see #5252).
Version 2.11.10 (2013-03-21)
----------------------------
### Fixed
Cast varchar date fields to int when selecting from the database (see #5503).
### Fixed
Only unset POST variables if `Widget::submitInput()` returns `true` (see #5474).
### Fixed
Strictly compare values when determining whether to save or not (see #5471).
### Updated
Updated TinyMCE to version 3.5.8 (see #5329).
### Fixed
Correctly show the "invalid date and time" error message (see #5480).
### Fixed
Correctly split the words when adding to the search index (see #5363).
### Fixed
Correctly load TinyMCE in IE7 and IE8 (see #5346).
### Fixed
Send the correct cache headers in "client cache only" mode (see #5358).
### Fixed
Remove the session of deleted or disabled users (see #5353).
### Fixed
Correctly set the cookie paths (see #5339).
Version 3.0.5 (2013-02-19)
--------------------------
### Fixed
Removed the pixel unit from the video width and height attributes (see #5383).
### Fixed
Correctly load the language files (see #5384).
This relase contains fix for CVE-2012-6112(TinyMCE), too.
Version 3.0.4 (2013-02-14)
--------------------------
### Fixed
Correctly split the words when adding to the search index (see #5363).
### Fixed
If an eagerly loaded relation does not exist, return `null` instead of an empty
model in `Model::getRelated()` (see #5356).
### Fixed
Throw an exception if the file system and the database are out of sync and
show a meaningful error message (see #5101).
### Fixed
Return an associative array in `Model_Collection::fetchEach()` if the requested
field is **not** `id` (see #5134).
### Fixed
Make eagerly loaded "pageTree" fields mandatory again (see #4866).
### Fixed
Do not use forward pages as upper page in the book navigation (see #5074).
### Fixed
Correctly show the "empty news list" note (see #5304).
### Fixed
Correctly sort values by an external order field (see #5322).
### Fixed
Define the login status constants in the back end (see #4099, #5279).
### Fixed
Make sure the drag'n'drop hints do not overlay the field labels (see #5338).
### Fixed
Apply the color picker to single fields as well (see #5240).
### Fixed
Correctly close the SimpleModal overlay with the escape key (see #5297).
### Updated
Update TinyMCE to version 3.5.8 (see #5273).
### Fixed
Correctly check for nested arrays in `Widget::isValidOption()` (see #5328).
### Fixed
Preserve the order of multi source fields when exporting a theme (see #5237).
### Fixed
Also check whether the target exists when creating new folders (see #5260).
### Fixed
Load the core `autoload.php` files first (see #5261).
### Fixed
Support `null` as column default value in the DCA (see #5252).
### New
Added the `$blnDoNotCreate` option to the `Files` class, which makes the class
write to a temporary file first and then move it to its destination in one
atomic operation. This fixes some cache issues (see #5307).
### Fixed
Handle `@` blocks when importing style sheets (see #5250).
### Fixed
Show the newsletter list even if there is no jumpTo page configured in the
channel and show the enclosures in the newsletter reader (see #5233).
### Fixed
Added an option to load model relations uncached (see #5248, #5102). Also fixed
the `array_merge()` order so the default options can be overriden.
### Updated
Updated SimplePie to version 1.3.1 (see #5207).
### Updated
Updated SwiftMailer to version 4.3.0 (see #5263).
### Fixed
The jQuery accordion script did not work with minified markup (see #5245).
### Fixed
Removed the "spaceToUnderscore" option from all alias fields (see #5266).
### Fixed
The media content element now supports .ogg files (see #5282).
### Fixed
Do not rewrite requests for .mp3, .mp4, .webm or .ogv files (see #5258, #5284).
### Fixed
Correctly determin the last run of the command scheduler (see #5278).
### Fixed
Make the jQuery accordion behave like the MooTools version (see #5251).
### Fixed
Added support for more advanced media queries (see #5236).
### Fixed
Added the missing `UserGroupModel` class (see #5218).
### Fixed
Handle the case that `glob()` returns `false` (see #5226).
### Fixed
The table sorter did not work if jQuery and MooTools were active (see #5228).
### Fixed
Copy all content elements if pages are duplicated with childs (see #5241).
### Fixed
Added lazy template loading for newsletter mail templates.
Version 3.0.3 (2013-01-08)
--------------------------
### Fixed
Do not separate a style sheet with a font-face selector if the definition is
invisible or the media type of the style sheet is "all" (see #5216).
### Fixed
Looking for theme templates broke the install routine (see #5210).
### Fixed
Correctly handle empty newsletter channel selections.
* Hungarian and Slovenian language files are added, too.
Version 3.0.2 (2013-01-07)
--------------------------
### Fixed
Throw an error if FileTree or PageTree widgets are left blank although they are
marked as mandatory in the DCA (see #5131).
### Fixed
Modules and Hybrids included via content element were shown even if the content
element was invisible or not published (see #5203).
### Fixed
Do not try to limit the template selection to a particular theme but show all
available themes instead (see #5095).
### Fixed
Correctly build the comments subscription confirmation URL (see #5201).
### Fixed
Update the database if a file is being uploaded in the front end (see #5137).
### Fixed
Do not send a 404 header if an enclosure is requested and cannot be find by a
module; there might be another module which can (see #5178).
### Fixed
Consider the `save_callback` of the password field in `tl_user` when a back end
user is forced to change his password (see #5138).
### Fixed
Random images now open in the lightbox if configured (see #5191).
### Fixed
Find e-mail addresse like `a@b.com` in `String::encodeEmail()` (see #5175).
### Fixed
Make sure there is a minimal MooTools core version for the command scheduler
(see #5195).
### Fixed
Made `Model::getPk()` and `Model::getTable()` static (see #5128).
### Fixed
Do not move resources in the file manager if the targets exist. Otherwise the
database might get out of sync with the file system (see #5145).
### Fixed
Convert automatically generated article alias names if the page uses folder URL
style alias names (see #5168).
### Fixed
The newsletter system did not yet handle file ID attachments (see #5118).
### Fixed
The gallery and downloads element now support using the user's home directory
again (see #5113).
### Fixed
Added an option to load models uncached (see #5102).
### Fixed
Added support for `CURRENT_DATE`, `CURRENT_TIME` and `CURRENT_TIMESTAMP` to the
database installer (see #5089).
### Fixed
Store the whole database row in `Calendar::addEvent()` so e.g. RSS feeds with
the event text instead of just the teaser are being rendered (see #5085).
### Fixed
Purge the internal cache after a module has been (de)activated (see #5016).
### Fixed
Do not cache the `system/cron/cron.txt` file (see #5105).
### Fixed
Do not create content elements for news and events which redirect to articles,
pages or external URLs during the version 3 update (see #5117).
### Fixed
Handle incorrectly closed indexer comments (see #5119).
### Fixed
The table content element did not assign the correct CSS class names when there
was only one row and one column (see #5140).
### Fixed
Consider the dynamic ptable when copying/deleting content elements (see #5041).
### Fixed
Scan templates in the autoload creator even if there are no classes (see #5158).
### Fixed
Corrected the main column margin when using the layout builder in combination
with the responsive grid (see #5170).
### Fixed
Consider the sorting order of external style sheets (see #5038).
### Fixed
The numeric file mounts of a user were overridden by the real paths (see #5083).
Version 2.11.8 (2013-01-07)
---------------------------
### Fixed
Make sure entered dates map to an existing date (see #5086).
### Fixed
Fixed the MySQLi field count (see #5182).
### Fixed
The Date class should return `00:00` for `Date(0)->time` (see #4249).
### Reverted
Handle dependencies when updating extensions (see #3804).
### Fixed
Fixed the unprefixed CSS gradient output (see #4569).
### Fixed
Fixed a small formatting issue in the Music Academy theme (see #5160).
### Fixed
Show all extensions in the log when updating multiple at once (see #5144).
### Fixed
Standardize RSS feed aliases (see #5096).
### Fixed
Make the `FileUpload` constructor public (see #5054).
### Fixed
Use `isset()` in the `Database::fetch*()` methods (see #4990).
### Fixed
Changed the `System::getReadableSize()` algorithm to powers of two (see #4283).
### Fixed
Removed Tahiti and the Netherlands Antilles from the countries list (see #3791).
### Fixed
Also adjust the `be_navigation.html5` template to the new "getUserNavigation"
hook changes (see #3411).
Contao Open Source CMS 3.0.0 is new major release since Contao (as
TYPOlight) was publicly released.
Major changes from 2.11.
* Use PHP namespace and more flexible to extend.
* Improve performance with mapper class loader.
* Better support for mobile devices and responsive design
* Database supported file management and handling of file's meta data.
* jQuery support coexist with MooTools.
* Directories in URL path.
* HTML5 based audio/video player (also YouTube).
* Improve ease to use.
* Display of what has changed.
* Complete fix for CSRF.
Version 2.11.6 (2012-09-26)
---------------------------
### Fixed
Correctly handle root pages in `Controller::getPageDetails()` (see #4610).
### Fixed
Consider the page language when forwarding (see #4841).
### Fixed
URL encode the enclosure URLs in RSS/Atom feeds (see #4839).
### Fixed
Also create empty templates folders if a theme is imported (see #4793).
### Fixed
Decode Punycode domains when used via insert tag (see #4753).
### Fixed
Correctly handle open tags in `String::substrHtml()` (see #4773).
### Fixed
Correctly handle units when importing style sheets (see #4721).
### Fixed
The mediabox plugin did not play Vimeo videos (see #4770).
### Fixed
Correctly align stylect menus in the form generator in the back end (see #4557).
### Fixed
Add a link if a news item or event points to an internal page (see #4671).
### Fixed
Wrap the MooTools fallback into CDATA tags on XHTML pages (see #4680).
### Fixed
Do not add a default value to textareas (see #4722).
### Fixed
Do not override the comments array in case login is required to comment,
otherwise no commets will be shown (see #4064).
* Include contao/Makefile.common from contao/Makefile.example.
* Add code some fragment tward to Contao 3.0 support.
* Add CT_VERBASE to use COMMENT.
* Use CT_FILES to Contao's files directory name.
It also fixes a little security problem of permission check about undo
processing.
Quote from release announce: http://www.contao.org/en/news/contao-2_11_5.html
The bugfix release fixes a couple of issues, including the SOAP
compression problem in PHP 5.4, the IDNA URL converting issue and
the TinyMCE relative URLs problem.
Fixes a critical privilege escalation:
http://www.contao.org/en/news/contao-2_11_4.html
Version 2.11.4 (2012-06-12)
* Fixed
Fixed a critical privilege escalation vulnerability which allowed
regular users to make themselves administrators (see #4427).
* Fixed
Support insert tags as external redirect target (see #4373).
* Updated
Updated the CSS3PIE plugin to version 1.0.0 (see #4378).
* Fixed
Re-applied the "autofocus the first field" patch (see #4297).
* Fixed
The pagination menu fix was missing in the listing, search and RSS reader
modules (see #4292).
* Fixed
Added the "required" attribute to the captcha input field (see #4247).
* Fixed
Correctly tell Google Analytics to anonymize the visitor's IP (see
#4290). Heads up: Adjust your moo_analytics templates accordingly!
* Fixed
Correctly align stylect menus in Safari and Opera (see #4284).
Security release.
Version 2.11.2 (2012-03-14)
---------------------------
### Fixed
Fixed an issue with the CSS3PIE url being incorrectly rewritten (see #4074).
### Fixed
Fixed a security vulnerability in the file manager which allowed back end users
to download files from the `tl_files` directory even if they were not mounted in
their profile (thanks to Marko Cupic).
### Fixed
Fixed a potential XSS vulnerability in the undo module (thanks to Oliver Klee).
The issue is not considered critical, because it requires the script tag to be
in the list of allowed HTML tags, which is not the case by default.
### Fixed
The IDNA convert class did not run under PHP 5.2 (see #4044).
Version 2.10.4 (2011-12-30)
---------------------------
- Fixed: the Environment class did not always return the correct script name
(#3603)
- Fixed: close the connection after sending a file to the browser (#3602)
- Fixed: the new Ajax cron trigger did not work in IE8 due to missing
Date.now() support (#3681)
- Fixed: do not block ressources required by the Google website preview in the
robots.txt file (#3688)
- Fixed: correctly update the cache after a new template has been created
(#3676)
- Fixed: correctly handle HTML comments in inline JavaScripts (#3696)
- Fixed: get the next autoincrement ID when importing a theme so deleted
themes can be restored (#3604)
- Fixed a few minor issues
Version 2.10.3 (2011-11-07)
---------------------------
- Fixed: the postLogin/Logout hooks broke the save() method of the model
(#3545)
- Fixed: the style sheet editor did not handle font-family/size:inherit
correctly (#3531)
- Fixed: MooTools changed the default wMode settings for Swiff (#3540)
- Fixed: the style sheet importer did not handle
border-color:transparent/inherit (#3480)
- Fixed: do not index empty news/event/FAQ/newsletter reader pages (#3511)
- Fixed: group labels were not always loaded correctly (#3591)
- Fixed: added a rename() workaround for Windows to the FileCache class (#3390)
- Fixed: the site structure was not ordered properly for non-admins (#3423)
- Fixed: custom layout sections were not displayed in "override all" mode
(#3460)
- Fixed a few minor issues
It is really fix the XSS problem.
Version 2.10.2 (2011-10-10)
---------------------------
- Updated: updated TinyMCE to version 3.4.6
- Fixed: do not remove slashes just because get_magic_quotes_gpc() exists
- Fixed: CSS units were not always applied when used with global variables
(#3464)
- Fixed: the task deadline field did not show the date picker (#3351)
- Fixed: do not return empty lines in the compileDefinition hook (#3440)
- Fixed: the TinyMCE spellchecker did not work anymore (#3487)
- Fixed: the regexp for validating phone numbers accepted invalid values
(#3493)
- Fixed: added the new HTML5 elements to the valid TinyMCE tags (#3479)
- Fixed: the style sheet generator did not support absolute URLs (#3512)
- Fixed: fixed a potential XSS vulnerability (thanks to sschurtz)
- Fixed a few minor issues
From release announce:
The maintenance release provides stability fixes for the version 2.10
branch and updates TinyMCE to version 3.4.4 (which fixes a few IE9
issues).
pkgsrc change:
Add a note to MESSAGE needs of www/php-tidy package when using minify
the HTML markup function of Contao 2.10.
