Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.

Removed all PostgreSQL support from the installer as per http://enanocms.org/News:1200114064; installer support for Postgres is available in the 1.1 branch now

Fixed case-sensitive file extensions

PHP4 fix: sidebar missing in installer UI: problem was wrongly named constructor for templateIndividualSafe

Fix undefined E_STRICT under PHP 4; add PHP 4 deprecation notice in admin panel

Installer works again now (for MySQL only)

Adding a few stray files and removing the no-longer-needed Creative Commons Attribution 2.0 license (no more libraries under that license are included with Enano); adding hooks pageprocess_render_{head,tail} to be run before and after the final page render, respectively.

Integrating patch for PHP 6.0-dev compatibility

Fixed wrong images being used in installer formutils

Fixed broken installer due to bad $plugins object

Enabled strong compression on pwstrength.js as it causes problems otherwise in Opera

Added support for Diffie-Hellman key exchange during login. w00t!

And might as well add theme-manager.js while I'm at it.

Merging a stray change from Nighthawk (probably release tagging)

Can't believe I forgot to add ThemeManager.php.

[retag] Unstable alpha release: 1.1.2 (Caoineag alpha 2)

Detagging last release revision to merge in theme manager from Scribus

Started (but disabled) work on the new theme manager, 1.1.2 is being released with this thing halfway done.

Unstable alpha release: 1.1.2 (Caoineag alpha 2)

Updated readme file for 1.1.2 release

Merging Nighthawk and Scribus branches

Modernized Special:CreatePage.

Fixed typo in ban logic

Some memory usage improvements, I think. PHP is being weird to me.

Merging changes from scribus

Fixed user -> user_id transition for enano_tags table

Optimized JS aggressive-compression list a little more

Re-enabled, debugged, and optimized Javascript compression code

Unsuccessful attempt at fixing "dismiss"/"close manager" buttons in ACL editor; non-breaking change to template API to allow plugins to add "normal" sidebar widgets in addition to the special "raw" block type, specified as the third parameter to $template->sidebar_widget(). Defaults to false, which is old behavior; new behavior (enabled by passing TRUE as the 3rd param) means that the content of the block is primarily block-level links.

Fixed version-set on migration code (see the comments in the source for why) and added post-upgrade hooks.

Edit summary should now be carried over when a draft is restored

[Minor] Fixed obsolete trigger upon attempt at page save after draft autosave

OOPS: forgot to add the "save draft" icon

Added "is_draft != 1" where appropriate in SQL queries to prevent drafts from being treated as real revisions.

Added autosave functionality and resurrected the old toolbar code that was added about a year ago but never uesd.

Tagging latest revision as rebrand

Rebrand as 1.1.2; made upgrade framework functional

Added upgrade schema files for 1.1.1 -> current (1.1.2-dev)

Removed unused schema files

Modified editor and rename functions to go through the API when rolling back. This causes rollbacks to be logged.

Mass-fixed all AJAX functions to also check the HTTP status code before parsing the response

Added some basic timezone support; DST support is still to come.

[minor] re-enabled ENANO_DANGEROUS on install.php (oops!); made textarea in page editor focus automatically

Made the form validation icons (check/X/?) more visually appealing. IE-friendliness is still on the TODO list.

Started on a Special:RecentChanges page, more to come.

Fixed some captcha bugs and made all captcha fields case-insensitive

Implemented a new CAPTCHA API; the frontend ($session->{make,get}_captcha) is API-compatible but the backend (the captcha class) is deprecated.

A few hacks to make the 1.1 demo plugin work

Cosmetic improvements to page editor; added demo mode checks in Admin:LangManager

Fixed some MySQL installation schema bugs, thanks to rainmain on the forums.

Added a heading "editing page" in page editor for visual appeal; removed use of alternate <?= ?> syntax in installer as it was causing problems on Win2k3 + PHP/FastCGI. (Experimentally using TortoiseHG's hgtk to commit)

Fixed some stray undefined-variable problems revealed as a result of testing on Windows Server '03, IIS6, PHP/FastCGI, and PostgreSQL 8.2.5.

Fixed splitting bug (really the same issue from stable) in get_pageid_from_url(); upgraded TinyMCE to version 3.0-stable

Fixed jBox menus failing to appear when window scrolled down

Unstable alpha release (1.1.1)

Updated readme file for 1.1.1

Localization is FINISHED, DAMN IT HELLAH YEAH! OVER WITH! Man, it feels to get that off my chest. Release is in under 48 hours, folks. And we're ready for it.

Fixed JSON parser error in installer (caused by magic_quotes_gpc, wouldn't you know) and re-enabled server-side l10n debugging

Merging Nighthawk and Scribus branches (and Scribus is back, yay!)

Localized stray string "list of registered members" in UCP

Rebranded source code as 1.1.1; added TinyMCE ACL rule as per Vadi's request: http://forum.enanocms.org/viewtopic.php?f=7&t=54

Fixed contentPath getting messed up because I forgot a slash or two in payload

payload.php stg_language_setup() should set default language now

Fixed bad column count in MySQL payload

Fixed SYSMSG tag in templates causing problems; commented out ENANO_DEBUG; fixed bad table prefix in installer payload logic

Profiling enabled for RenderMan's wikiformat routine; [minor] made HTML from profiler more pretty

Fixed case where HTML comments were getting stripped when opening tag not followed by whitespace (<!--foo--> was stripped, <!-- foo --> was not, neither is stripped now)

Updated acledit and comment templates on themes, as they weren't in sync with Oxygen; fixed some undefined index errors in SpecialAdmin and paths

Minor and hopefully non-breaking change to plugin loader to possibly double performance at hook points

Got Enano to load even if there are no plugins; added caching for decrypted session keys to significantly improve performance (in theory at least)

Removed stray debugging info from ACL editor success notification; added ability for guests to set language on URI (?lang=eng); added html_in_pages ACL type and separated from php_in_pages so HTML can be embedded but not PHP; rewote portions of the path manager to better abstract URL input; added Zend Framework into list of BSD-licensed libraries; localized some remaining strings; got the migration script working, but just barely; fixed display bug in Special:Contributions; localized Main Page button in admin panel

Finished (or nearly finished) the admin language CP

[minor] Trying to be a little more careful with values from users_extra in validate_session()

[minor] silenced errors to mysql_free_result() and pg_free_result()

[minor] silenced errors to ob_gzhandler()

A number of scattered changes. Profiler added and only enabled in debug mode (currently on), but awfully useful for fixing performance in the future. Started work on Admin:LangManager

Improved compatibility with PostgreSQL and fixed a number of installer bugs; fixed missing "meta" category declaration in language files

Localized registration errors and activation/COPPA e-mails

Localized the 404 page, w00t.

Finished localizing PageProcessor, we hope

Localized autosuggestion widgets

Localized Special:UploadFile and Special:DownloadFile

Localized Special:EditSidebar

Finished l10n on user CP

Re-merged rev 35ed07abc99e, apparently didn't go through the first time.

Started localization on User CP. Localized pagination, password strength, and various other small widgets. Fixed bug in path manager causing return of fullpage from get_page_id_from_url() even when namespace is Special.

PageUtils::createpage(): $name was being sanitized too strictly

Implemented (well stubbed) IP logging in non-AJAX comment interface

Implemented IP logging for comments and registration

Completed l10n on admin panel. Exception is Admin:ThemeManager, which is pending a rewrite.

Localized Admin:MassEmail

Localized Admin:COPPA

Fixed a coupla minor bugs with the template_nodb class wrongly referencing $lang

A few more installer tweaks / fixes. Initted upgrade script. Added migration schema from 1.0 to 1.1.

Dropping changes from revision 350 (dd7cbc97f681)

Enano's new installable installer, alpha 1. No upgrade and (in some parts) very little localization.

Initlogs stage of installer now working

Oops, search_index table was still registered and language and language_strings weren't

More progress on the installer. At this point it can install and import the language, but does not rename config files. Still much work to be done, most notably localization and creation of MySQL users and databases.

Welcome to the new Enano installer. Much distance still to be covered but the basics are there.

Localized and separated Admin:GroupManager

Oops, forgot to add in the rewritten Admin:PageEditor

WiP commit for admin panel localization. All modules up to Admin:UserManager (working down the list) are localized except Admin:ThemeManager, which is due for a rewrite

Merging in something from Nighthawk, can't seem to figure out what

Localized the first parts of the admin panel. As a consequence, also wrote a brand new Admin:PageManager that doesn't suck like the old one did.

Finished localization of SpecialUserFuncs

[Minor] fix stupid bad td width in privmsgs compose interface

Merging in the last couple of revisions from stable

Fixed search indexer causing duplicate keys when two "words" of 64+ characters encountered and first 64 characters are the same (thanks Vadi); attempt to fix onunload confirmation during page editing

Corrected licensing issue on YoungPup's DOM-Drag (it is now public domain -> GPLv2+ for Enano); fixed wrongful access denial under specific circumstances (fetch_page_acl() on nonexistent page + wiki mode)

Made CAPTCHA for guests' page editing work with the non-AJAX interface

Added ability to require CAPTCHA for guests when editing pages (AJAX INTERFACE ONLY)