Foswiki Release 1.1.9

Foswiki - The Free and Open Source Wiki

Foswiki is an enterprise collaboration and information sharing tool targeted for professional use in many types of organizations: from small businesses to multi-nationals, from one-product open source groups, to worldwide research networks.

Foswiki is a wiki: fundamentally, a website with editable web pages. It looks like a normal web site but it encourages contributions, edits, updates, questions, and answers from its users. It's a powerful way of enabling a community to communicate asynchronously using intranet and public internet websites. Foswiki is simple to learn and use. It aims to provide a transparent way for you to publish and exchange your ideas with others over the web and eliminates the one-webmaster syndrome of outdated intranet content.

Foswiki is a structured wiki with tools that enable users without programming skills to build powerful yet simple applications to process information and support workflows. Developers can extend the functionality of Foswiki with plugins.

Foswiki is the old TWiki project under a new name. Restrictions on the use of the TWiki brand resulted in many of its developers continuing the project under the new Foswiki name. Foswiki is backwards compatible with all content from older TWiki installations. Foswiki 1.1 ships with a TWikiCompatibilityPlugin, thus enabling most extensions made for TWiki to work under Foswiki. Since the start of the Foswiki project there have been several releases of TWiki, However there have been very few functionality changes, and the useful changes have all been tracked in Foswiki, so topics and wiki applications supported by TWiki should also work with Foswiki.

Foswiki is released under the GNU General Public License.

Foswiki Releases

• Foswiki 1.1.0 was built 04 Oct 2010. It is a release with more than 270 bug fixes relative to 1.0.10 and more than 680 bug fixes relative to 1.0.0. And the release adds more than 100 enhancements. Foswiki 1.1.0 introduces jQuery Javascript user interface framework, improved topic history display, new QUERY and FORMAT macros, better userinterfaces for groups, much improved WYSIWYG editor, facelift of the default skin, much improved configure tool, and many more enhancements.
• Foswiki 1.1.1 was built 25 Oct 2010. It is a release that fixes some important bugs that were introduced in 1.1.0. It is highly recommended that all running 1.1.0 upgrade to 1.1.1.
• Foswiki 1.1.2 was built 09 Nov 2010. It is a release that fixes some very important bugs incl. a security related bug. Installations running 1.1.0 and 1.1.1 should be upgraded to 1.1.2
• Foswiki 1.1.3 was built 16 Apr 2011. It is a release that fixes more than 150 bugs. jQuery has been updated to 1.4.3. The default PatternSkin has some usability improvements.
• Foswiki 1.1.4 was built 20 Dec 2011. It is a release that fixes some very important including some security related issues. It contains 143 fixes and 27 enhancements. jQuery has been updated to 1.7.1.
• Foswiki 1.1.5 was built 10 Apr 2012. It is a release that fixes some very important issues including some security related issues. It contains 100 fixes and 20 enhancements.
• Foswiki 1.1.6 was built 02 Dec 2012. It is a release that fixes some important issues including some minor security related issues. It contains 94 fixes and 27 enhancements.
• Foswiki 1.1.7 was built 01 Feb 2013. It is a release that fixes CVE-2012-6329 and CVE-2012-6330. It contains 20 fixes and 4 enhancements.
• Foswiki 1.1.8 was built 28 Feb 2013. It is a release that fixes CVE-2013-1666. It contains 4 fixes.
• Foswiki 1.1.9 was built 18 Nov 2013. It is a release that contains 44 fixes and 4 enhancements..

Pre-installed Extensions

Foswiki 1.1 ships with the following:

• Plugins: AutoViewTemplatePlugin, CommentPlugin, EditTablePlugin, EmptyPlugin, HistoryPlugin, InterwikiPlugin, JQueryPlugin, PreferencesPlugin, RenderListPlugin, SlideShowPlugin, SmiliesPlugin, SpreadSheetPlugin, TablePlugin, TinyMCEPlugin, TwistyPlugin, WysiwygPlugin
• Contribs: CompareRevisionsAddOn, FamFamFamContrib, JSCalendarContrib, MailerContrib, PatchFoswikiContrib, TipsContrib, TopicUserMappingContrib
• Skins: PatternSkin
• Compatibility support - TWikiCompatibilityPlugin

Important changes in Foswiki 1.1.9 (This release)

Release 1.1.9 fixes a number of important bugs. Several are security related and we strongly recommend that sites upgrade to this release.

• The %TOPICLIST% macro now omits topics that cannot be read by the user. Foswiki should not reveal the presence of topics to users who don't have the authority to view the topic.
• Login using url parameters has been restricted. Details below..

Release 1.1.9 addresses several issues that impact sites that have upgraded or will upgrade to newer versions of perl and CPAN modules. We strongly recommend that foswiki be upgraded to 1.1.9 prior to updating to a new release of perl or CPAN modules.

Two serious performance issues have been corrected. The TablePlugin amassed CSS from all visited topics, growing with each view. And an error in SEARCH caused exponential growth of the search expressions which could cause out of memory issues on the server. These could be especially severe for sites using FastCGI or Mod_Perl.

See #Rel01x01x09Details for details.

JQuery upgrade

This release ships with several upgraded versions of JQuery, and changes the default release to version 1.8.3. It also replaces the deprecated JQuery Tooltip plugin with the new UI::Tooltip. Upgraders should visit bin/configure and make the following changes to the Jquery configuration:

• Update {JQueryPlugin}{JQueryVersion} to version 1.8.3
• Disable {JQueryPlugin}{Plugins}{Tooltip}{Enabled} and
• Enable {JQueryPlugin}{Plugins}{'UI::Tooltip'}{Enabled}

Note that although the jquery autocomplete plugin was replaced with ui::autocomplete back in Foswiki release 1.1.4, recent changes to jquery required some additional changes to some UI::Autocomplete examples. See Revision 17042 for details of this change.

Changes to login using URL parameters

All versions of foswiki previously allowed the username and password parameters to be provided on the URL. For ex: bin/view/Myweb/SomeTopic?username=JoeUser;password=SEcrET. Foswiki 1.1.9 has been changed to further restrict login:

• username and password will only be accepted on POST type operations. a simple GET url with username and password will not accept the supplied credentials.
  • The previous behaviour can be restored by enabling $Foswiki::cfg{Session}{AcceptUserPwParamOnGET} in the configuration
• username and password will only be accepted as login credentials on the view, viewauth and login scripts.
  • Other scripts can be authorized by configuring $Foswiki::cfg{Session}{AcceptUserPwParam}

Improved compatibility with Perl 5.18+

Foswiki 1.1.9 has been tested with perl 5.18+. Perl 5.18 has made a very significant change in how hash tables are randomized and stored. See 5.18 perldelta for more information. The change has had some minor impact on Foswiki, most of which were test failures, not core code issues, and were fixed in Item12616. It did however result in discovery of some core bugs that were also fixed.

Sites upgrading to perl 5.18 should carefully test foswiki and review the open tasks at http://foswiki.org/Tasks/PlatformPerl518. Please report any new issues there.

The following differences have been noticed when running under Perl 5.18, and have not been corrected:

• The order of search results order when the requested sort has duplicates is unpredictable. Ex: When sorting by "modified", the order of multiple topics modified at the exact same time will be unpredictable. (Task Item12618)
• The order of groups presented by %USERINFO and %GROUPINFO macros is unpredictable. As a result, the order of groups listed by the WikiGroups topic change on each page view. (Task Item12635)
• The order of data in a perl formatted %QUERY result is unpredictable. (No plan to fix)

Any data internally stored by Foswiki or extensions using a perl hash array will be presented in unpredictable order.

Important changes in Foswiki 1.1.8

Release 1.1.8 fixes a Critical Security Vulnerability. All previous releases of Foswiki are vulnerable to a security issue in Locale::Maketext. It is described further in SecurityAlert-CVE-2013-1666. It is expected that this will be the last release in the Foswiki 1.1 series. The next major release will be a feature release: Foswiki 1.2.0

Release 1.1.8 also includes a configuration checker that will report an error if a vulnerable version of Locale::Maketext is installed.

See #Rel01x01x08Details

Important changes in Foswiki 1.1.7

Release 1.1.7 fixes a Critical Security Vulnerability. All previous releases of Foswiki are vulnerable to a security issue in Locale::Maketext. It is described further in SecurityAlert-CVE-2012-6329. A 2nd vulnerability in the Foswiki %MAKETEXT% macro was also discovered, and is described further in SecurityAlert-CVE-2012-6330 . It is expected that this will be the last release in the Foswiki 1.1 series. The next major release will be a feature release: Foswiki 1.2.0

Release 1.1.7 also includes a security fix for configure that reduces exposure of important passwords in confirmation and log messages.

See #Rel01x01x07Details

Module version strings and new module dependency in 1.1.6 and 1.1.7

The Foswiki and default extension version strings have been changed from a developer oriented string Foswiki-1.1.5, Tue, 10 Apr 2012, build 14595, to a simple perl version string - "v1.1.6". The "RELEASE" string will continue to be more descriptive and can be displayed with a new macro %WIKIRELEASE%.

This adds a new dependency on version 0.77 - the Perl module version class.

• Sites using Perl 5.10.1 or newer have the correct version of version.
• Sites on older versions of perl should install the latest version using CPAN or their system's package manager.

Before upgrading to Foswiki 1.1.6 or 1.1.7, verify that the installed version of CPAN:version is at least version 0.77. If not, upgrade CPAN:version before attempting to upgrade Foswiki! For example:

 perl -Mversion -e 'print "$version::VERSION\n"'
0.9901

Note: Extensions may not have been upgraded to use the new 'dotted-decimal' version string format for dependency checking. If an extension includes a dependency on an SVN-style revision, Foswiki 1.1.6 assumes that the dependency is satisfied by a 'dotted-decimal' version.

Wysiwyg / TinyMCE Editor changes

Release 1.1.6 changed the editor to treat all links as real HTML links in TMCE. This had an annoying side effect: when a user changes the link text displayed in-line, the editor only updated the link text, and the target page was not changed. This even including auto-linked WikiWords. The editor will now save the original WikiWord. During the save, if the new link text is still a WikiWord, and the link target still points to the original WikiWord, it will also be updated to match the new WikiW