Installer dev, everything is working now, so far as I can tell

Add transparent support for PDO into installer; further integration of PDO

Removed unused/seldom-used DBAL functions that weren't entirely supported in PDO

Merged

Add PDO support for MySQL

Fixed undefined $errors in mass e-mail function

Merged

Fix double negative in avatar language string ("Don't block animated images" -> "Allow animated images")

Add Output class for Comet (HTTP incremental streams) -- experimental and not working with every browser/apache configuration.

Make redirects send 302 Found instead of 307 to suppress "confirm POST resend" dialog in firefox

DBAL: Persistent connections; also explicitly commit and unlock tables when shutting down

Plugins: support closures

Fixed a few bugs/display issues in search

Fixed minor display issue in login.js

Cacher: Add XCache support (partial)

Merged

Added template context API and render_getpage_norender hook. This allows variable sets to be pushed and popped from $template, so that variables in a template inclusion can be accessed and pre-processed by plugins.

firebugx was breaking things

Small change to generation time formatting to make all pages the same time. Makes apachebench not screw up.

Image scaling: Fixed a bug where (height > width) images would be scaled to the wrong dimensions (GD). Added PNG/GIF transparency support to GD image resizer. Added a cache bypass option to SpecialUpDownload.

Disable output gzipping during file download... it negates the memory usage controls

Typo

Fixed PHP-based JSON decode to output arrays, not objects

AjaxUpload: fixed handling of upload completion

Conditionally declare hex2bin() due to a function of the same name being introduced in PHP 5.4

Improvements and updates to tutorial

Improved vimperator compatibility in jBox

SECURITY: Various security enhancements to password resets. They are now rate-limited by username and IP, and it is possible to disable username autofill for guests.

Fixed CLI installer failing to set the DB version

Release: 1.1.8pl1

Release prep 1.1.8pl1

SECURITY: CSRF protection in Private Messaging, which is a really broken feature and should get the TinyMCE treatment. *sigh* Reported by Secunia.

SECURITY: Fixed XSS in post-login page redirection. Reported by Secunia.

Fixed installer (DB revision was wrong); make editor load jQuery, as the editor requires it now

Removed TinyMCE from licenses page

Removed TinyMCE.

Removed explicit TinyMCE support, replaced with support for arbitrary page_formats. The TinyMCE files will be removed in an upcoming commit.

Added database transaction API. (Untested with Postgres)

Fixed a typo in which()

ajax get_styles is now case insensitive with the theme_id

functions: HTML compressor: fixed handling of <script> blocks which consist only of whitespace

More comments in enanium header

Fixed some variable issues in emailer

ACL permissions viewer has better formatting now

Corrected a link

Added another AJAX editor hook after init is pretty much done

Added set_post() in Request_HTTP

Added some more hooks to the page editing pipeline. It should now be possible to add controls to the page editor, send the data from them out to the server, and process them on the server side.

Fixed a postgresql bug in the File namespace (reported by phirox - thanks)

AES: Fixed wrongfully hardcoded $return_format/$input_format (non-security)

Added conflict resolution for wikitext heading names

Some enhancements to the error handler. It replaces out ENANO_ROOT for security, and if the warning is from dbal.php and ENANO_DEBUG is set, prints out a much more verbose message.

Changed var_export() calls to use "true" as second parameter. Not sure which PHP version it was added in, but I could have sworn it wasn't there last time I checked.

Fixed syntax error in plugins/admin/PageManager.php

Fixed some rather severe issues when changing the urlname of uploaded files

Added FLAC to list of file types. (In other news: I'm an audiophile)

Updated tags

Fixed title[]= too.

Tagged 1.1.8 as current-unstable

Tagged release: 1.1.8

Added a notice to re-import language on 1.1.8 upgrade

Tagged release: 1.1.7pl2

SECURITY: Fix SQL injection in banlist check (1.1.7 branch)

editor: removed extraneous debug info; changed around the order by which the textarea is created and appended to the DOM

Fixed bad language installation docs in common

SECURITY: Fix SQL injection in banlist check

SECURITY: Fix path disclosure in Special:Captcha

common: log Enano upgrades

Added a new "hide-with-mce" CSS class in Dynano; all elements which have it will be hidden when TinyMCE is activated, and re-shown when it is destroyed.

ImageMagick check now notes that only directories in the PATH are checked.

Fixed a table_prefix omission in File namespace code.

Parser updates. Added the "styled" keyword to wikitables to allow them to be styled using the current theme's standard table skinning, and changes to how the image tag parser decides how to display an image (framed, inline or raw).

Added an editor hook that allows plugins to insert their own content right before the editor box.

Fixed a rather major bug with the external link parser: two links in one line now handled gracefully.

Fixed check for iPhone OS 3 - it now returns true on 3.0 or any later version including 4.x

Merged

Fixed password field in HTML login not being focused during >USER_LEVEL_MEMBER auth

Hide the "Create an account" button if registration is disabled (Enanium only, but there is a template boolean called "registration_disabled" so other themes can use it too)

Merged (again)

Converted inlinerename.js in enanium to tabs

So, grinding_halt() now finally uses the new default theme in template_nodb.

Fixed display of username in comments (ranks enabled)

Fixed typo in string acl_inherit_pg_everyone. Fixes issue 22.

Merged from accidental split

Added an API for AJAX file uploads and the monitoring thereof. This is to be used in Snapr and soon core (Special:UploadFile).

Fixed broken handling of password reset response in AJAX login

Fixed some bugs with the change password form when pw_strength_enable is 0.

Fixed some ACL scope warnings

Visual refresh on the textarea in the enanium page editor. Also fixed missing image on the Save Draft button.

Javascript maintenance. Upgraded jQuery; fixed some gzip bugs; added JavascriptCompressor usage to licenses/.

Fixed PHP warning with empty search results

Fixed no plugins showing up in sidebar create block page

Enanium: Link blocks now render properly on the right sidebar, and textual blocks now look good on the left.

Got live reauth working again in the admin cp

Added an icon for Edit Sidebar admin page.

Plugin manager: fixed duplicate removal of whiteout

Experimentally changing how content-length works.

Fixed theme not being loaded in Admin:EditSidebar

Disabled Javascript debugging. That thing has a nasty habit of getting enabled when it shouldn't.

Improved display of comments from foes, and fixed some general issues with the friend and foe lists

Enabled content-length in Special:DownloadFile even when gzip is on. Should probably check the http spec to see if Content-Length should match the decoded or encoded length

Fixed redlinks to special pages + parameters

Files now list what pages use them

ajax.php getpage now cals $template->set_page() so that templates that depend on PAGE_URLNAME etc. will not show errors

Lockouts were displaying separately when they should have been displayed together (incorrect grouping). Possibly breaks Postgres - needs re-test in that environment

Moved sidebar editor into the admin CP. Icon still needs to be added, no Internet right now to go find one. Also fixed a few template related things.

Updated README and KNOWN_BUGS for 1.1.8

jBox now works when horizontally scrolled; fixed case matching inconsistency in autofill

Pending group memberships no longer alter result in rank alterations

Some fixes to autofill with Unicode usernames; fixed a few end user experience pieces of the group CP. Users are now allowed to freely leave GROUP_OPEN and GROUP_REQUEST groups, and must be removed by a group mod for GROUP_CLOSED and GROUP_HIDDEN.

Added template hooks in the JS template compiler. Attach to thook_<template hook name>. Use Echo() to echo HTML; access compiler instance with Template.tpl_{strings,bool}, etc.

Database revision is now shown in ACP home

Added ability for plugins to hook into admin user manager

Improved captcha word generation; fixed duplicate auth parameter in Special:Login privileged login; improved search indexer performance on websites with lots of words

Fixed direction related regression in drop down code

Made login window focus the controls earlier if animations are disabled.

Clean up that GLOBALS silliness.

Default theme can no longer be changed in demo mode

DiffieHellman: gracefully handle platforms that fail the sha256 self test, currently only known to be PowerPC. Added support for PHP's built-in hash functions (they were added in 5.1.2) and use them in lieu of the built-in sha256 implementation when available.

Fixed the (rather expected) 1.0.x migration issues db revision system