Thu 05 Nov 2009 |
Few important changes in 1.5.15 release
Written by Klas Berlič
To accompany the official release announcement, I would like to point out few of the most important changes in this release:
.htaccess change that prevents looking at your extensions XML files - while this was not a security hole by itself, it kept open doors for hackers to see what version of particular extension you are running. To put this fix into effect you have to uncomment (remove #) from corresponding section (lines 35-39) in htaccess.txt and rename htaccess.txt to .htaccess (or copy/paste that part into your existing .htaccess, must be inserted at the same place).
TEST before you put this on live site - if your site is serving publicly accessible XML than this is not directly usable for you - you would need to make exceptions for those files or use regex based rules for blocking. Also not usable for those without apache/mod_rewrite.
PHP 5.3.x compatibility - Joomla runs fine on PHP 5.3.x now (except of OpenID library)
Core components caching - com_weblinks and com_contact are using cache for the first time. Also com_content view cache comes with more refined caching logic, so that caching is disabled only where it needs to be (e.g. for users using filters). This should result in speed increases on high-traffic sites.
Other notable bugfixes:
- TinyMCE is now working properly - all remaining bugs created by the recent TinyMCE upgrade should be gone now
- Mootols were upgraded to 1.1.2 to ensure future compatibility with Firefox 3.6
Note:
For all that would like to enable access to XML inside their extensions, one way would be to create .htaccess in each directory that contains .xml files and put reverse rule in it (or in a directory above those directories that need exceptions - it applies to current directory and all directories bellow):
<Files ~ "\.xml$">
Allow from all
Satisfy all
</Files>
or even more explicit rule, limited only to myfile.xml:
<Files myfile.xml>
Allow from all
Satisfy all
</Files>
2009-11-05 14:57:00
should read Mootools and FF 3.6
2009-11-05 15:14:08
2009-11-05 15:53:49
Can you maybe provide an example or link for people who are using XML files for other things and need to create exceptions in the new htaccess file?
2009-11-05 16:15:54
Provide an example for people who are using XML files 'd be really glad
2009-11-05 16:23:05
I need to create exceptions in the new htaccess file rules, can you help me?
My Ozio Gallery2 extension works with xml files and with this new rules doesn't work correctly
2009-11-05 17:38:50
thank you
thay is good new
2009-11-05 17:40:21
http://forum.joomla.org/viewtopic.php?f=432&p=1916553
2009-11-05 18:09:10
For those interested in .htaccess - one can use another set of tighter rules (see informationleak2-peter.patch here http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_id=32&tracker_item_id=18353).
For extension developers that would like to enable access to XML inside their extensions, one way would be to create .htaccess in each directory that contains .xml files and put reverse rule in it (or in a directory above those directories that need exceptions - it applies to current directory and all directories bellow):
Allow from all
Satisfy all
or even more explicit rule, limited only to myfile.xml:
Allow from all
Satisfy all
2009-11-05 18:10:37
2009-11-05 18:15:31
2009-11-05 19:39:00
2009-11-06 03:26:36
Joomla security is just too important and should not be for the domain of only a users - especially now that the standard Joomla htaccess file has been updated.
2009-11-06 10:22:41
"Mootools were upgraded to 1.1.2" imo, not to 1.12!
See: http://mootools.net/blog/2009/11/02/upgrade-mootools/
Thanks, klas!
2009-11-08 23:55:21
2009-11-20 17:35:56
Article Manager > Article > TinyMCE 2.0 does not appear to be functioning. The HTML editor is now gone. HTML code is now visibly inserted into my article text. Please advise.
2009-11-20 17:54:02
@Silver: for flash movie create exception like one mentioned above in the article. If you use multiple movies, store them in the same directory and create an exception for that directory.
2009-11-25 06:51:10
Also, the interface says TinyMCE Editor 2.0, but I believe the actual version is 3.2.6.
2010-02-02 06:50:17
I am building a new site, fresh joomla installation, and the built in