Geeklog 1.4.0sr1 and 1.3.11sr4

James Bercegay of GulfTech Security Research reported several issues with Geeklog's cookie handling that made it vulnerable to SQL injections, arbitrary file access, and even injection and execution of arbitrary code. To fix those issues, we are releasing Geeklog 1.4.0sr1 and 1.3.11sr4 and strongly suggest that you install those updates as soon as possible.

For Geeklog 1.4.0, there's the complete 1.4.0sr1 tarball as well as an upgrade archive containing only the necessary changes over 1.4.0.

To upgrade from Geeklog 1.3.11sr3, use the 1.3.11sr4 upgrade archive. If you're running on an older 1.3.11 release, you will have to install the previous updates first. You can, of course, always choose to update to 1.4.0sr1 directly, following the usual upgrade instructions.

Upgrading to 1.4.0sr1 is also what we suggest to anyone using a Geeklog version older than 1.3.11, as the reported issues also affect all earlier versions.

An advanced editor option is now available as part of the Geeklog 1.4 release. The integration of the FCKeditor which is one of the most popular and well supported OpenSource (LGPL Licensed) HTML editors brings to the web many of the powerful functionalities of desktop editors like MS Word.

A summary of the integration features:

• Advanced Editor is enabled via a setting in the main site config.php
• Enabled for Story Editor, contribute story or comment forms, and Staticpage Editor
• FCKeditor is compatible with most internet browsers which include: IE 5.5+ (Windows), Firefox 1.0+, Mozilla 1.3+ and Netscape 7+.
• Editor Toolbars can be customized and for starters, a more basic toolbar is used for non-admin's for the contribute story form.
• Extensive Editor features like text formatting, tables, link creation and font styles.
• Integrated Image Browser allows images to easily be uploaded and image library maintained.
• Support for uploading assorted file types like zip,doc,xls,pdf,avi,mpg,mpeg,swf,fla

v1.2.1 contains many new features, bug fixes and overall improvements, making it a full featured multi-media gallery solution for Geeklog. This release fully supports Geeklog 1.4 and register_globals turned off.

You can get more information and download Media Gallery through the Media Gallery Support site.

READ THE DOCUMENTATION BEFORE UPGRADING, THERE ARE VERY IMPORTANT INSTRUCTIONS YOU MUST FOLLOW!

Geeklog 1.4.0 is one of the biggest updates in Geeklog's history and introduces the following new features and changes:

• Geeklog now officially works with register_globals = off.
• Ships with FCKeditor (WYSIWYG editor).
• Supports Trackback, Pingback, and pinging weblog directories.
• Remote authentication lets registered users of remote services such as Blogger.com and LiveJournal log into your Geeklog site without having to register.
• New syndication framework that can both read and write feeds in RSS (0.9x and 2.0), RDF, and Atom (0.3 and 1.0) formats.
• The links and polls sections are now plugins and can be disabled, removed, or replaced easily when you don't need them.
• Revamped Admin sections to provide a consistent look and sortable lists.
• New search only returns a specified amount of results per page, thus avoiding the embarrassing timeouts on large databases.
• ... and more.

You may get more information or dowload it through my geeklog software page.

v1.6.0 [29 Jan 2006]

• [fix] save on an SQL query if there is no referrer
• [fix] eliminate some warnings and a few minor buglets
• [new] now installs and works with register_globals off
• [new] changed the browser stats to make them more useful by breaking it down by browser and then version
• [new] optionally show bots by name [Google, Yahoo!, Ask Jeeves, Inktomi, and MSN Bot] in the Who's Online block instead of showing them as Guests [based on code by ByteEnabled]
  • controlled by the new $_GUS_CONF['wo_show_bots'] option in config.php