ocPortal 7.1.6 released

Version 7.1.6 has now been released. This version is a patch release that introduces a number of bug fixes since the last release. Upgrading is strongly advised due to very important security fixes, as well as fixes to comply with changes in dependencies.

To upgrade follow the steps in your website's http://mybaseurl/upgrader.php script. You will need to copy the URL of the attached TAR file (created via the form below) during step 3.

Your upgrade to version 7.1.6

Upgrade file: , or download upgrade directly (4 Mb).

Fixes have been made to the following issues

Fixed major security hole in catalogue system
Fixed XSS security holes in code editor and config editor scripts
Fixed minor security hole (possibly not exploitable) regarding specially crafted redirect URLs
Fixed URL-spoofing security hole
Allowed skipping of pages in the site map block on a per-page basis
Fixed various shopping cart bugs, esp. with PayPal (due to PayPal API changes)
Fixed bugs in merge importer
Fixed bugs in phpNuke importer
Fixed encoding errors in Wordpress import
Fixed default news category permissions
Fixed that add blog links existed even with no personal category permission
Fixed many issues with RSS import, blogger import now works (in theory - code was developed for v8, but back-ported and not re-tested)
Fixed Comcode rendering bugs, in some rare failure cases
Improved HTML to Comcode conversion for blank HTML
Broken links in Comcode no longer automatically show the title of the error screen as the auto-generated link-text
Fixed slow-down generating RSS if very large numbers of pages
Fixed crash if 'forum_posts_per_page' option is set to zero
Fixed bug on some results browsers
Fixed automatic Google site map building
Fixed adding zip downloads on servers that don't have PHP unzipping support
Fixed editing user group error
Fixed member CSV bugs
Guests given better error when adding blogs
Fixed losing required setting on quiz edit
Removed CAPTCHA on join form if enabled but no GD on server
Fixed corruption of member blogs created via use of secondary news categories
Fixed display of non-completed upload/picture CPF fields
Fixed editing of picture/upload CPF fields
Fixed quiz CPF export
Fixed URL moniker bug
Fixed major layout bug with forms on Google Chrome
Fixed display of bottom_news block if news has Comcode/emoticons in titles
Fixed bug creating some kind of thumbnails
Fixed 'use_special_emoticons' permission not being respected
Fixed currency conversion Comcode tag
Allowed search indexing to be disabled
Fixed problems if the gallery add-on is installed after the downloads add-on is actively used
Fixed downloads bug if galleries add-on uninstalled
Fixed problems with downloading from some servers
Fixed missing 'page' Comcode tag button for non-admin staff
Fixed problem with avatars if photos uninstalled
Fixed complex character encoding bug for unicode users doing WYSIWYG/non-WYSIWYG conversions
Fixed display of integer CPFs
Fixed problem with staff menus not degrading fully based on permissions (empty menus)
Passwords no longer word-filtered
Fixed bug if front page assigned HTTPS
Fixed bug if whole site given an HTTPS base URL
Fixed bug reinstalling addons
Fixed problem with browsing through large numbers of entries in the CMS zone
Fixed unintended option to limit CPFs to guests (meaningless)
Fixed erroneous hack-attack messages when doing certain search types
Fixed stats module crashes if very large amount of data held
Fixed problem if unexpected renamed files in CSS/template folders
Can no longer edit Comcode pages if no permission to view (you'd need lots of access before, so not a security issue, but inconsistent)
Fixed missing page name validation when editing Comcode pages
Fixed missing category permissions when importing downloads
Fixed incorrect JAWS advice
PHP 5.4 support

Trackbacks

There have been no trackbacks yet

» Trackback link

Comments

Rishi Saravanan posted 26 March 2012, 11:44 PM

Rating:

Hello,

When I saw this listed fix…

"Fixed major layout bug with forms on Google Chrome"

…I thought it meant we could once again see the names of form fields in screens where you add News, Images, etc. For some reason these names disappeared some time back. However, I'm not seeing this issue fixed even though I made sure the caches were emptied in the site and in my Chrome browser after the upgrade.

Chris Graham posted 27 March 2012, 2:14 AM

(

)

Yes, this is it.

It needs applying to themes manually too. In global.css:

Code



body .accessibility_hidden { /* {$,Contents should be made visible (or interpreted) for accessibly representation but hidden for normal visual display} */
   /* Shift it out of the viewport */
   position: absolute;
   top: -256000px;
   left: 0;
}

becomes:

Code



body .accessibility_hidden { /* {$,Contents should be made visible (or interpreted) for accessibly representation but hidden for normal visual display} */
   /* Shift it out of the viewport */
   position: absolute;
   top: -256000px;
   left: 0;
   display: block; /* stops browser bugs where it interacts with the layout flow incorrectly */
}

i.e. the display:block bit needs adding.

I'm pretty annoyed with Google causing this bug in an automatic update then completely ignoring the test case I reported to them months ago. Generally I really love Google Chrome, but I don't love organisations that ignore bug reports in their key products.

Rishi Saravanan posted 27 March 2012, 2:59 AM

(

)

Okay, thanks Chris for explaining these things so quickly

Brian Hay posted 21 March 2012, 7:50 PM

Rating:

Upgrade went perfectly smooth including running the the theme upgrader.

Thank you!

BobS posted 21 March 2012, 8:03 PM

Rating:

Well, there's a surprise I wan't expecting.

Were their any/many TPL changes, Brian?

Bob

Brian Hay posted 21 March 2012, 8:26 PM

Rating:

I honestly never looked to see, I just hit go lol

But my main theme does have a custom header and global template and it looks to have had no problem with it.

I also upgraded this theme which has no template edits that I can recall but does have extensive css changes and it upgraded with no problems too.

Chris Graham posted 21 March 2012, 8:38 PM

Rating:

No theme changes to deal with.

BobS posted 21 March 2012, 8:47 PM

Rating:

Thanks, Brian and Chris.

Harry-S posted 21 March 2012, 9:34 PM

Rating:

no problems found. smooth upgrading.

Harry

Chris Graham posted 21 March 2012, 9:38 PM

Rating:

Yes, this should be an extremely stable release, as it consists only of bug fixes done in v8 carefully back-ported.

Brian Hay posted 21 March 2012, 9:41 PM

Rating:

I found a problem :( My favorite tool by far, contectual css editor gives an error. I tried it on a few different sites and themes and this is the error I get.

error

PHP NOTICE [8] Undefined offset: 2 in adminzone/pages/modules/admin_themes.php on line 984 (version: 7.1.6, PHP version: 5.3.8, URL: /adminzone/admin_themes/edit_css.htm?theme=Mammoth_Jewelry&file=global.css&keep_wide_high=1&keep_no_xhtml=1)
Here is the stack trace:
Below is a stack trace revealing the state the software was in when the error occurred. If this represents a bug in the unmodified software, you may want to check ocPortal website for a fix, and if there isn't one, report this as a bug. Please note that merely posting a stack trace is not sufficient for us to solve your problem; the stack trace is just an aid that presents us with additional information. We still need to know the error message, what you tried to do, how you tried to do it, version numbers, and any other appropriate information.
We apologise for this problem and if it's a bug we hope you will work with us so that we can fix it for you promptly.

File '/home/mammothj/public_html/sources/failure.php'

Line '674'

Function 'get_html_trace'

Args

File '/home/mammothj/public_html/sources/global2.php'

Line '969'

Function '_fatal_exit'

Args
'PHP NOTICE [8] Undefined offset: 2 in adminzone/pages/modules/admin_themes.php on line 984'

File '/home/mammothj/public_html/sources/failure.php'

Line '214'

Function 'fatal_exit'

Args
'PHP NOTICE [8] Undefined offset: 2 in adminzone/pages/modules/admin_themes.php on line 984'

File '/home/mammothj/public_html/sources/global2.php'

Line '843'

Function '_ocportal_error_handler'

Args
'notice'

8

'Undefined offset: 2'

'adminzone/pages/modules/admin_themes.php'

984

File '/home/mammothj/public_html/adminzone/pages/modules/admin_themes.php'

Line '984'

Function 'ocportal_error_handler'

Args …

File '/home/mammothj/public_html/adminzone/pages/modules/admin_themes.php'

Line '839'

Function 'get_css_revisions'

Class 'Module_admin_themes'

Object Module_admin_themes::__set_state(array( ))

Type '->'

Args
'Mammoth_Jewelry'

'global.css'

File '/home/mammothj/public_html/adminzone/pages/modules/admin_themes.php'

Line '214'

Function 'edit_css'

Class 'Module_admin_themes'

Object Module_admin_themes::__set_state(array( ))

Type '->'

Args

File '/home/mammothj/public_html/sources/zones.php'

Line '386'

Function 'run'

Class 'Module_admin_themes'

Object Module_admin_themes::__set_state(array( ))

Type '->'

Args

File '/home/mammothj/public_html/sources/site.php'

Line '970'

Function 'load_module_page'

Args
'adminzone/pages/modules/admin_themes.php'

'admin_themes'

File '/home/mammothj/public_html/sources/site.php'

Line '753'

Function 'request_page'

Args
'admin_themes'

true

File '/home/mammothj/public_html/adminzone/index.php'

Line '51'

Function 'do_site'

Args

File	'/home/mammothj/public_html/sources/failure.php'
Line	'674'
Function	'get_html_trace'
Args

File	'/home/mammothj/public_html/sources/global2.php'
Line	'969'
Function	'_fatal_exit'
Args	'PHP NOTICE [8] Undefined offset: 2 in adminzone/pages/modules/admin_themes.php on line 984'

File	'/home/mammothj/public_html/sources/failure.php'
Line	'214'
Function	'fatal_exit'
Args	'PHP NOTICE [8] Undefined offset: 2 in adminzone/pages/modules/admin_themes.php on line 984'

File	'/home/mammothj/public_html/sources/global2.php'
Line	'843'
Function	'_ocportal_error_handler'
Args	'notice' 8 'Undefined offset: 2' 'adminzone/pages/modules/admin_themes.php' 984

File	'/home/mammothj/public_html/adminzone/pages/modules/admin_themes.php'
Line	'984'
Function	'ocportal_error_handler'
Args	…

File	'/home/mammothj/public_html/adminzone/pages/modules/admin_themes.php'
Line	'839'
Function	'get_css_revisions'
Class	'Module_admin_themes'
Object	Module_admin_themes::__set_state(array( ))
Type	'->'
Args	'Mammoth_Jewelry' 'global.css'

File	'/home/mammothj/public_html/adminzone/pages/modules/admin_themes.php'
Line	'214'
Function	'edit_css'
Class	'Module_admin_themes'
Object	Module_admin_themes::__set_state(array( ))
Type	'->'
Args

File	'/home/mammothj/public_html/sources/zones.php'
Line	'386'
Function	'run'
Class	'Module_admin_themes'
Object	Module_admin_themes::__set_state(array( ))
Type	'->'
Args

File	'/home/mammothj/public_html/sources/site.php'
Line	'970'
Function	'load_module_page'
Args	'adminzone/pages/modules/admin_themes.php' 'admin_themes'

File	'/home/mammothj/public_html/sources/site.php'
Line	'753'
Function	'request_page'
Args	'admin_themes' true

File	'/home/mammothj/public_html/adminzone/index.php'
Line	'51'
Function	'do_site'
Args

Chris Graham posted 23 March 2012, 11:45 PM

Rating:

Sorry for the new bug, fix is here:

Fix to CSS editor - ocPortal.com

Petrikuhr posted 26 March 2012, 11:47 AM

Rating:

Just saw this, thank you Chris.

Harry-S posted 21 March 2012, 9:47 PM

Rating:

correct, but only to the global.css at my place other css files give no problem

update: found another one news.css

Rishi Saravanan posted 26 March 2012, 5:26 AM

Rating:

I went to copy over the upgrader file with ftp like I usually do, but this time it's telling me it cannot connect to the FTP server. It gives the same message whether I enter the host name as the actual domain name or as IP address. (I was able to connect to our FTP server through Interarchy, so I know I have the correct login info.)

We did upgrade the server for all our websites recently, and it requires SFTP to be used. I wonder if that's an issue here on ocPortal

Chris Graham posted 26 March 2012, 11:50 AM

Rating:

Yes, PHP has no support for SFTP. However, if the server has a good configuration (suExec) it won't need an FTP connection at all to transfer files so you may be able to just leave the FTP stuff blank.

Rishi Saravanan posted 26 March 2012, 6:52 PM

Rating:

Okay, our new server must have good configuration because I left the FTP stuff blank and this time it worked, thanks!

Rishi Saravanan posted 27 March 2012, 12:06 AM

Rating:

Hello,

I'm not sure if it's a bug introduced with this 7.1.6 upgrade, but I just discovered that that system is no longer able to automatically create a thumbnail when I upload a video to the site. However it still automatically generates thumbnails when added youtube videos or uploading images.

Chris Graham posted 27 March 2012, 2:25 AM

Rating:

You'll need FFMPEG on the server, and correctly pointed to by the 'FFMPEG path' option. Also PHP will need to be able to call up system command, and sometimes PHP configurations prevent this.

Rishi Saravanan posted 27 March 2012, 4:21 AM

Rating:

oops, we didn't realize that ffmpeg was not installed on our new server by default

Arbo posted 27 March 2012, 1:58 AM

Rating:

I have a lot of 'custom' code changes. Would upgrading either lose those changes, or potentially not really upgrade the system because a part of code that is upgraded is in a 'custom' file?

Chris Graham posted 27 March 2012, 2:20 AM

Rating:

It's important that you apply the patch we posted in the recent security announcement, otherwise if things are fine I wouldn't worry (apart from the Google Chrome bug Rishi discusses above).

If you've been properly saving customised changes into the proper *_custom dirs they won't be overwritten and it's unlikely there'll be a conflict.

Regardless, the upgrade TAR can be extracted manually (i.e. going through the changes by hand) so long as you know what you're doing.

BobS posted 27 March 2012, 3:08 AM

(

)

Where is that security announce neither searching nor browsing can I find it although I will no doubt stumble across it the minute I dispatch this.

Bob

EDIT: as expected, I just found it: ocPortal security update - ocPortal.com

Make comment

Your name:	Your name (join or login)
Subject:	Subject
Your message: ( posting rules ) [ View all emoticons ]	Your message To reply to an existing post use the reply/quote button under it. Type fresh posts here when not replying to any existing post. Make your post civil and relevant.

Type in the text from the graphic or audio version.