Tag: Bugfixes

NOW AVAILABLE

RT @kobyoz: New session for #magentodp2010 - How to create a #magento connect extension/best practices! #magento #developer #php http:// ...

6 maart, 2010

Hi everyone,

We are sorry to announce the immediate release of phpBB 3.0.7-PL1 to address a security issue which was introduced in 3.0.7, unfortunately the issue wasn't noticed during testing and has only surfaced a week after the release of 3.0.7.

We promised working feeds for phpBB 3.0.7. Sadly, we were not able to deliver on that promise - a critical bug in the permission handling for feeds slipped past. To all people who already have updated to 3.0.7, it is of critical importance to update to 3.0.7-PL1. Otherwise, it is possible for users to bypass permission settings under the following circumstances:

Feeds are enabled
Any of the posts or topics feeds are enabled
The unauthorised user - or one of the groups they are a member of - have forum permissions set on a private forum
If you have excluded a forum from the list of forums that provide feeds, it is unaffected

Note: We recommend the use of a regular update routine over manually editing your files. If you manually edit your files your board will not recognise the update.
The fix for the issue is a single line change inside of feed.php, line 525 has changed from:

Code: Select all: $forum_ids = array_keys($auth->acl_getf('f_read'));

to:

Code: Select all: $forum_ids = array_keys($auth->acl_getf('f_read', true));

There were no other changes, in particular neither style nor language changes.

Installation instructions

A short explanation of how to do a conversion, installation or update is included within the provided INSTALL.html file, please be sure to read it. You can find a list of requirements on our Downloads page.

Security

If you find any security issues please report them to our security tracker.

Available packages

If you experience problems with the automatic update (white screens, timeouts, etc.) we recommend using the "changed files only" or "patch" method for updating.

Full Package:
Full phpBB 3 source code and english language files.
Automatic Update Package:
Update package for the automatic updater, contains changes from previous release to this release.
Changed Files Only:
Complete files, but only those that were changed since previous releases of phpBB 3. This archive contains changed files for every previous release.
Patch Files:
This file contains diffs against the previous phpBB 3 release, which can be applied with the patch utility.

Select the package most suitable for you. We recommend the following methods depending on your situation:

For new installations you should use the Full Package
For updates of boards without modifications you can use the Automatic Update Package (guided update) or the Changed Files Only package (manual update).
For updates of boards with modifications you should use the Automatic Update Package. If you are confident with patch files and patching you can use the Patch Files Package.
International Support Teams may use the Patch Package in conjunction with the Code Changes to better support users with problematic conflicts during their update process or to help them update code sections.
If you are a hoster/provider, you may want to use the Patch Files Package to update all of your client installations.

Please ensure you read the INSTALL and README documents in docs/ before proceeding with installation, updates or conversions!

Download Locations

The download is of course available on our downloads page.
Our release archive provides all packages we build. If you do not find your desired package you can probably find it in the release archive.

These are the files with their md5 sums:

phpBB-3.0.7-PL1.zip (Full Package)
md5sum: 1125b615e13a5bb8787afab58a27c627
phpBB-3.0.7-PL1.tar.bz2 (Full Package)
md5sum: 67570654462c442c29080007c0af1e1b
phpBB-3.0.7-PL1-patch.zip (Patch Files)
md5sum: 44d163c6f945207f666b4b8ecbf179b8
phpBB-3.0.7-PL1-patch.tar.bz2 (Patch Files)
md5sum: 4d611e1160599835ff48fc6454bf85e0
phpBB-3.0.7-PL1-files.zip (Changed Files)
md5sum: 579f5685cc37c69dd6ce023b46ce2593
phpBB-3.0.7-PL1-files.tar.bz2 (Changed Files)
md5sum: 2779984411598d919a6a1e6adc35894d
phpBB-3.0.7_to_3.0.7-PL1.zip (Automatic Update Package from 3.0.7)
md5sum: e135fd3b43c17c0bdc69f3fc246e6524
phpBB-3.0.7_to_3.0.7-PL1.tar.bz2 (Automatic Update Package from 3.0.7)
md5sum: 589d21934c14a6517583316659f0225f
phpBB-3.0.6_to_3.0.7-PL1.zip (Automatic Update Package from 3.0.6)
md5sum: b93e31c7930ace5af89d9804b55d8c66
phpBB-3.0.6_to_3.0.7-PL1.tar.bz2 (Automatic Update Package from 3.0.6)
md5sum: cf9b3a42872be8afcddb42648a390861

Download & Documentation

4 maart, 2010

The PHP development team is proud to announce the immediate release of PHP 5.3.2. This is a maintenance release in the 5.3 series, which includes a large number of bug fixes.

Security Enhancements and Fixes in PHP 5.3.2:

Improved LCG entropy. (Rasmus, Samy Kamkar)
Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen)
Fixed a possible open_basedir/safe_mode bypass in the session extension identified by Grzegorz Stachowiak. (Ilia)

Key Bug Fixes in PHP 5.3.2 include:

Added support for SHA-256 and SHA-512 to php's crypt.
Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check.
Fixed bug #51059 (crypt crashes when invalid salt are given).
Fixed bug #50940 Custom content-length set incorrectly in Apache sapis.
Fixed bug #50847 (strip_tags() removes all tags greater then 1023 bytes long).
Fixed bug #50723 (Bug in garbage collector causes crash).
Fixed bug #50661 (DOMDocument::loadXML does not allow UTF-16).
Fixed bug #50632 (filter_input() does not return default value if the variable does not exist).
Fixed bug #50540 (Crash while running ldap_next_reference test cases).
Fixed bug #49851 (http wrapper breaks on 1024 char long headers).
Over 60 other bug fixes.

For users upgrading from PHP 5.2 there is a migration guide available here, detailing the changes between those releases and PHP 5.3.

Further information and downloads:

For a full list of changes in PHP 5.3.2, see the ChangeLog. For source downloads please visit our downloads page, Windows binaries can be found on windows.php.net/download/.

28 februari, 2010

Hello everyone,

We are pleased to announce the release of phpBB "Run bugs, run! Bertie is coming!" 3.0.7. This new version is a maintenance release fixing a number of a bugs as well as improving on usability and performance. We have entirely overhauled the Feed feature, fixing a lot of bugs and odd behaviours. Some problems with the automated updater have been solved, so if you are still on 3.0.5 this update should work a lot better for you.

We urge you to update your installation as soon as possible. The bugs fixed in phpBB 3.0.7 ensure the smooth operation of your board. Our support team will only support phpBB 3.0.7, updates to phpBB 3.0.7 and conversions to phpBB 3.0.7. Submissions to our trackers for older versions will not be accepted, please make sure you update before you submit a bug report.

If you use a language pack other than the default "English [GB]", you should check our downloads section, an update may already be available.

For a complete list of changes with attributed ticket numbers, please consult our comprehensive changelog. Below I have extracted the most important changes in phpBB 3.0.7.

Minor feature additions to phpBB 3.0.7

You can now see private forums in your ATOM feeds using HTTP authentication by passing the GET parameter "auth=http".
The INTTEXT token was added to custom BBCodes to allow for non-ASCII letters in html attributes.
You can now enable quick reply in all forums with a single click.

Small functionality changes in phpBB 3.0.7

Warn users about potentially dangerous BBcodes.
Forum feed no longer includes posts of subforums.
Speed up topic move operation by adding an index for topic_id on the topics track table. (Bug #56545)
Move redirect into a hidden field to avoid issues with mod_security. (Bug #54145)
Log user activations through inactive users ACP. (Bug #30145)
Alter ACP user quick tools interface to reduce confusion with the delete operation.
Show a proper preview for the Q&A CAPTCHA. (Bug #56365)
Send time of last item instead of current time in ATOM Feeds. (Bug #53305)
Split "All topics" feed into "New Topics" and "Active Topics" feeds.
It is no longer possible to persist a solution for the login CAPTCHA.
Friends and foes will not show up as private message rule options if their respective UCP modules are disabled. (Bug #51155)
Offer for guests to log in for egosearch and unreadposts search before the search permissions check. (Bug #51585)

A list of important bugfixes since phpBB 3.0.6

Allow ban reason and length to be selected and copied in ACP and subsilver2 MCP. (Bug #51095)
Correctly set last modified headers. (Bug #54245, thanks Paul.J.Murphy)
Make word censoring case insensitive. (Bug #54265)
Fulltext-MySQL search for keywords and username at the same time. (Bug #54325)
Various XHTML and CSS mistakes in prosilver and subsilver2. (Bugs #54705, #55895, #57505, #57875 - Patch by HardStyle)
Cleanly handle forum/topic not found in ATOM Feeds. (Bug #54295)
PHP 5.3 compatibility: Check if function dl() exists before calling it. (Bug #54665)
PHP 5.3 compatibility: Disable E_DEPRECATED on startup to keep set_magic_quotes_runtime(0) quiet. (Bug #54495)
Correctly replace table prefix before inserting schema data into the database. (Bug #54815)
Use memcache::replace() instead of memcache::set() for existing keys to prevent problems.
Check for required functions in eAccelerator. (Bug #54465)
Use correct RFC 3339 date format in ATOM feed. (Bug #55005)
Do not deliver topics from unreadable or passworded forums in the news feed. (Bug #54345)
Restore user language choice to compiled stylesheets. (Bug #54035)
Do not permit unauthorised users to delete private messages from folder listing. (Bug #54355)
Handle export of private messages where all recipients were deleted. (Bug #50985)
Add ability to disable overall (aka board-wide) feed.
Do not pass new_link parameter when creating a persistent connection with mysql. (Bug #55785)
Improved search query performance through sorting words by their occurance. (Bug #21555)
Strictly check whether a moderator can post in the destination forum when moving topic. (Bug #56255)
Do not unsubscribe users from topics replying with quickreply. (Bug #56235)
Don't submit when pressing enter on preview button. (Bug #54395)
Load reCAPTCHA over https when using a secure connection to the board. (Bug #55755)
Don't send activation email when user tries to change email without permission. (Bug #56335 - Fix by nrohler)
Correctly orientate quoted text image on RTL languages. (Bug #33745)
Fall back to default language email template if specified file does not exist. (Bug #35595)
Database updater now separates ADD COLUMN from SET NOT NULL and SET DEFAULT, when using PostgreSQL <= 7.4 (Bug #54435)
Styles adjustment to correctly display an order of rtl/ltr mixed content. (Bugs #55485, #55545)
Do not store email templates in database. (Bug #54505)
Fix problems with firebird by no longer using 'count' as a column alias. (Bug #57455)
Make user_email_hash() function independent from system's architecture. (Bug #57755)
Global announcements could not be accessed on a board using Firebird as the database server. (Bug #57525)
Do not delete unrelated attachments when deleting empty forums. (Bug #57375)
Update process: Store expected resulting file contents in cache and do not suggest further merges if the contents match, also fixes infinite merge loop (Bug #54075)

Installation instructions

A short explanation of how to do a conversion, installation or update is included within the provided INSTALL.html file, please be sure to read it. You can find a list of requirements on our Downloads page.

Security

If you find any security issues please report them to our security tracker.

Available packages

If you experience problems with the automatic update (white screens, timeouts, etc.) we recommend using the "changed files only" or "patch" method for updating.

Full Package:
Full phpBB 3 source code and english language files.
Automatic Update Package:
Update package for the automatic updater, contains changes from previous release to this release.
Changed Files Only:
Complete files, but only those that were changed since previous releases of phpBB 3. This archive contains changed files for every previous release.
Patch Files:
This file contains diffs against the previous phpBB 3 release, which can be applied with the patch utility.
Code Changes Package:
This package contains MOD instructions for changes to the following sections: Language changes, prosilver style changes and subsilver2 style changes.

Select the package most suitable for you. We recommend the following methods depending on your situation:

For new installations you should use the Full Package
For updates of boards without modifications you can use the Automatic Update Package (guided update) or the Changed Files Only package (manual update).
For updates of boards with modifications you should use the Automatic Update Package. If you are confident with patch files and patching you can use the Patch Files Package.
Style Authors and Translators may use the Code Changes Package to update their styles or language packs.
International Support Teams may use the Patch Package in conjunction with the Code Changes to better support users with problematic conflicts during their update process or to help them update code sections.
If you are a hoster/provider, you may want to use the Patch Files Package to update all of your client installations.

Please ensure you read the INSTALL and README documents in docs/ before proceeding with installation, updates or conversions!

Download Locations

The download is of course available on our downloads page.
Our release archive provides all packages we build. If you do not find your desired package you can probably find it in the release archive.

These are the files with their md5 sums:

phpBB-3.0.7.zip
md5sum: 034c556a436a1f7a3905c1dcd1271564
phpBB-3.0.7.tar.bz2
md5sum: a0a9b0eb3fd00267fea71b9938f9f989
phpBB-3.0.7-patch.zip
md5sum: 7d0bd2ac68f5da7c082f8f39bf10fced
phpBB-3.0.7-patch.tar.bz2
md5sum: 4ef0b9c58d022755d1e5c9b08f1ba593
phpBB-3.0.7-files.zip
md5sum: 43b0291fc649c62c8aa4c963355d414b
phpBB-3.0.7-files.tar.bz2
md5sum: 327e017dee7678e0bc1033a4f99d2e21
phpBB-3.0.6_to_3.0.7.zip
md5sum: 45bdc622489809f576f094a35ab27e80
phpBB-3.0.6_to_3.0.7.tar.bz2
md5sum: 507ab687f8ff35b68ce42e689337e26a
phpBB-3.0.6_to_3.0.7-codechanges.zip
md5sum: 346e5e098cdf1a8d503917413b8c5cb6
phpBB-3.0.6_to_3.0.7-codechanges.tar.bz2
md5sum: 5be3dd31a6dda10778ba05cda40bd2c2

Download & Documentation

we hope your update or installation is quick and easy,
the phpBB Team

25 februari, 2010

The PHP development team would like to announce the immediate availability of PHP 5.2.13. This release focuses on improving the stability of the PHP 5.2.x branch with over 40 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release.

Security Enhancements and Fixes in PHP 5.2.13:

Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen)
Fixed a possible open_basedir/safe_mode bypass in session extension identified by Grzegorz Stachowiak. (Ilia)
Improved LCG entropy. (Rasmus, Samy Kamkar)

Further details about the PHP 5.2.13 release can be found in the release announcement, and the full list of changes are available in the ChangeLog.

20 februari, 2010

Magento CE version 1.4.0.1 Stable is now available for download and upgrade.

Please Note: We do NOT recommend upgrading a production installation of Magento directly. Please backup database and all files before upgrading. Please make sure to check file permissions before trying to upgrade through your Magento Connect Manager.

This release mainly fixes an upgrade issue that was experienced while upgrading through Magento Connect Manager and a cache issue in specific environments.

We highly recommend disabling Magento cache before upgrading.

To see a full list of features and fixed issues please visit our release notes page. Diff files are available here.

Since version 1.4.0.0 for security reasons the trace in the Magento error report page is disabled by default. The “Error log number” does not give any information about the error. To enable the trace copy the errors/local.xml.sample to errors/local.xml and follow the instructions described in that file.

Please report all issues with this release in the bug tracker.

Important Note 1: If the Magento Compilation Module is enabled it must be disabled before attempting to upgrade. After upgrading is done, click on “Run Compilation Process” to process and enable it again.

Important Note 2: If you are running Magento in a cluster environment and are using a shared cache (e.g. Memcached) you will now need to also make sure to configure Magento to use Database as the “slow” backend cache.

FROM THE MAGENTO TWITTER FEED

NOW AVAILABLE

RT @YoavMagento Magento CE version 1.4.0.1 is now available for download and upgrade http://bit.ly/cpnlYu

13 februari, 2010

We are excited to announce the availability of Magento CE Version 1.4.0.0 Stable for upgrade and download.

This release includes many new features such as Widgets, WYSIWYG editor. support for 3D Secure, and many further improvements from Magento CE 1.3.x.

To see a full list of features and fixed issues please visit our release notes page. Diff files are available here.

Please report all issues with this release in the bug tracker.

Important Note 1: If the Magento Compilation Module is enabled it must be disabled before attempting to upgrade. After upgrading is done, click on “Run Compilation Process” to process and enable it again.

Important Note 2: If you are running Magento in a cluster environment and are using a shared cache (e.g. Memcached) you will need to make sure to configure Magento to use Database as the “slow” backend cache. More info will follow in our Knowledgebase and updated White-paper next week.

Please Note: We do NOT recommend upgrading a production installation of Magento directly. Please backup database and all files before upgrading. Please make sure to check file permissions before trying to upgrade through your Magento Connect Manager.

Update: Issue with upgrading through Magento Connect Manager is resolved.

FROM THE MAGENTO TWITTER FEED

NOW AVAILABLE

RT @YoavMagento Magento CE version 1.4.0.1 is now available for download and upgrade http://bit.ly/cpnlYu

30 januari, 2010

This post is part of a weekly series by the Magento Enterprise Edition subscription support team covering tips, tricks and hints to some of the most common, and uncommon, issues as submitted by support customers.

+++++++

One of Magento’s most superior strengths are its capabilities for scaling to support multi-store and multi-language retailing all from the same backend. In this tutorial, we will be showing you how to take advantage of Magento’s scalability by creating multiple websites with unique domain names sharing the same product catalog. (***NOTE: Each store can also be configured to offer a unique product catalog as well.)

For this example, we’ll be attempting to set up domain1.com, domain2.com and domain3.com.

Generally, Magento is installed into the folder /var/www/http, as per the Magento Installation Guide, and you can find more information related to the initial setup and configuration of any Magento installation there. We aren’t going to through an full blown installation right now though, and for our purposes, we are going to presume that the Magento instance has already been installed in the server.

We’ll be dividing the process into steps based on the areas of configuration we will need to deal with–namely, Categories, Store Configuration in Magento Admin, Store Configuration in the Server.

1: Categories

First, will need to create our Categories. Since all three websites will be sharing the same catalog, we will be using the default root Category in Catalog -> Categories -> Manage Categories and will be creating our categories under that root category (i.e. Clothing, Electronics, etc.).

These categories (Clothing, Electronics) should be set as both “Is Active” from the General Information tab and “Is Anchor” from the Display Settings tab for them to appear on the frontend of your Magento shop. (***NOTE: If the websites will not be sharing the same catalog, a Root Category must be created for each website. Thus, if there are 3 websites, there will be 3 Root Categories with subcategories under them.)

2: Store Configuration in the Magento Admin

1. Now that we have created our Categories, it’s time to create our websites by going to System -> Manage Stores and clicking the “Create Website” button.

Name – domain name of our new website
Code – a parameter that will be used in configuring the Apache web server to point to that particular domain name

2. Once the website has been created, we’ll create the store corresponding to this website by clicking on the “Create Store” button in System -> Manage Stores.

Website – website to which this store will be associated
Name – the same as the website name
Root Category – the root category that will be used for this store. (Refer to Step 1 for Details)

3. Then, we create the store view which is the interface that the customer will be able to access on the frontend. Click the “Create Store View” button in System -> Manage Stores.

Store – store to which this view will be associated
Name – name of this store view (i.e. English Version, German Version, etc.)
Code – code for this store view
Status – if enabled, this store view will be accessible from our frontend, otherwise, it will not be accessible

4. After the Store has been created, we need to configure the Unsecure Base URL and Secure Base URL under System -> Configuration -> General -> Web. Before we set their respective base URLs, we first need to ensure that the configuration scope is set to the domain1.com website to define which site we are working on.

Then, we modify the base URLs for both Unsecure:

and Secure:

with the corresponding domain name by unchecking the ”Use default [STORE VIEW]” checkbox and then save the configuration.

5. Now we just repeat Steps 2-4 for the other two websites, domain2.com and domain3.com by replacing the fields with their respective information.

3: Store Configuration in the Server

1. Now we re-configure the Apache configuration file, httpd.conf, for all domains to set the DocumentRoot to our Magento directory. In this case, the directory is /var/www/http:

<VirtualHost *:80>
    ServerAdmin webmaster@domain1.com
    DocumentRoot  /var/www/http
    ServerName domain0.com
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin webmaster@domain2.com
    DocumentRoot  /var/www/http
    ServerName domain1.com
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin webmaster@domain3.com
    DocumentRoot  /var/www/http
    ServerName domain2.com
</VirtualHost>

2. Edit the .htaccess file at /var/www/http/.htaccess and add the following lines below:

SetEnvIf Host www\.domain1\.com MAGE_RUN_CODE=domain1_com
SetEnvIf Host www\.domain1\.com MAGE_RUN_TYPE=website
SetEnvIf Host ^domain1\.com MAGE_RUN_CODE=domain1_com
SetEnvIf Host ^domain1\.com MAGE_RUN_TYPE=website

SetEnvIf Host www\.domain2\.com MAGE_RUN_CODE=domain2_com
SetEnvIf Host www\.domain2\.com MAGE_RUN_TYPE=website
SetEnvIf Host ^domain2\.com MAGE_RUN_CODE=domain2_com
SetEnvIf Host ^domain2\.com MAGE_RUN_TYPE=website

SetEnvIf Host www\.domain3\.com MAGE_RUN_CODE=domain3_com
SetEnvIf Host www\.domain3\.com MAGE_RUN_TYPE=website
SetEnvIf Host ^domain3\.com MAGE_RUN_CODE=domain3_com
SetEnvIf Host ^domain3\.com MAGE_RUN_TYPE=website

3. Restart Apache Server

If you are on a Red Hat based distribution, you’ll be able to type service apache restart. For other distributions, you’ll want to type apachectl restart. (***NOTE: The second option here is different than “apachectl graceful” which will run a graceful restart and reload configuration files, without terminating current connections. We don’t have any visitors to our site yet, so it’s okay to do a “apachectl restart”.)

4: We’re Ready to Go!

After we’ve complete all of these steps we should now see all 3 domains in our backend:

All that’s left now is to add products to the catalog and give each site a custom theme if we wish to do so. Many people are taking advantage of Magento’s powerful multi-store functionality, whether it’s to set up stores with multiple languages, different catalogs and even the same catalogs (as in our example) with different front ends as a marketing vehicle. No matter which you decide to use Magento’s powerful features for, we hope this post will provide a good starting point to help you get there!

FROM THE MAGENTO TWITTER FEED

NOW AVAILABLE