Changelog-v2.txt

Changelog for phpMussel (>= v2.0.0, < v3.0.0), "Changelog-v2.txt".

=== VERSION RELEASE GUIDELINES ===
phpMussel adopts and adheres to SemVer (Semantic Versioning). For more information
about SemVer, please refer to:
- https://semver.org/

Detailed version release guidelines for phpMussel can be found at:
- https://github.com/phpMussel/.github/blob/master/CONTRIBUTING.md

=== Changes made since last versioned release ===

(none)

=== Version/Release 2.4.5 ===
PATCH RELEASE.

- [2023.01.27; Maikuolan]: Display proper status message when updating
  configuration fails.

- [2023.01.28; Bug-fix; Maikuolan]: Cache handler potentially generating
  unexpected exceptions in some situations; Fixed.

- [2023.02.13; Maikuolan]: Slightly improved performance for when using PDO.

Caleb M (Maikuolan),
February 24, 2023.

=== Version/Release 2.4.4 ===
PATCH RELEASE.

- [2022.09.27; Maikuolan]: Added warnings to the edit file feature of the file
  manager regarding editing PHP files directly via browsers and regarding
  editing files which belong to components.

- [2022.10.25; Maikuolan]: Hardened some configuration constraints.

- [2022.10.28; Maikuolan]: Reworked how the configuration page deals with
  volume-based configuration.

- [2022.11.20; Maikuolan]: Avoid packaging unnecessary files into dist.

- [2022.11.30; Maikuolan]: Adjusted minimum value for some port directives
  from 1 to 0.

- [2022.12.10; Bug-fix; Maikuolan]: The reset button at the front-end
  configuration page wasn't resetting the hidden "other" field; Fixed.

- [2022.12.15; Bug-fix; Maikuolan]: Redis shouldn't set EXPIRE for TTLs less
  than 1; Fixed.

- [2022.12.26; Bug-fix; Maikuolan]: PDF files were sometimes being flagged as
  images; Fixed.

- [2023.01.12; Bug-fix; Maikuolan]: Decimals in the names, choice keys, and
  labels keys of configuration directives were being coerced by PHP to
  underscores; Fixed.

- [2023.01.22; Maikuolan]: Synced common classes package.

Caleb M (Maikuolan),
January 23, 2023.

=== Version/Release 2.4.3 ===
PATCH RELEASE.

- [2022.04.26; Maikuolan]: Added a JavaScript warning to the front-end login.

- [2022.05.02; Maikuolan]: Front-end warnings have been hidden from non-logged
  in users.

- [2022.05.08; Maikuolan]: Made the warnings/notices at the front-end accounts
  page slightly smaller.

- [2022.05.26; Bug-fix; Maikuolan]: Instead of "GMT", the "Last modified"
  header given for front-end assets specified "+0000", which some browsers
  don't understand properly; Fixed.

- [2022.06.09; Maikuolan]: Following symlinks for RecursiveDirectoryIterator
  instances enabled.

- [2022.06.17; Maikuolan]: Slightly improved RTL support.

- [2022.07.13; Maikuolan]: Synced common classes package.

- [2022.07.21; Maikuolan]: Coloured the "delete" option available at various
  dropdown menus red, to make it stand out a little from the other options.

- [2022.07.23; Maikuolan]: Added the ability to reset specific parts of the
  configuration back to their defaults.

Caleb M (Maikuolan),
July 24, 2022.

=== Version/Release 2.4.2 ===
PATCH RELEASE.

- [2022.02.21; Maikuolan]: Improved IP address resolution strategy.

- [2022.02.21; Bug-fix; Maikuolan]: File manager component files categorisation
  didn't account for multi-domain installation configuration files; Fixed.

- [2022.03.11; Bug-fix; Maikuolan]: Shorthand data was quoted, but needed to be
  defined as literals in order to avoid being unentitised prior to being parsed
  as regular expression partials, in order to avoid breaking those expressions
  and potentially triggering fatal errors; Fixed.

- [2022.03.24; Bug-fix; Maikuolan]: Fixed a bottleneck in the scan process
  caused by the ReadFile closure (#231).

Caleb M (Maikuolan),
March 25, 2022.

=== Version/Release 2.4.1 ===
PATCH RELEASE.

- [2021.11.27; Maikuolan]: At the front-end configuration page,
  configuration directives relying on specific extensions (specifically, at
  this time, the supplementary cache options) will now include a notice as
  to whether the extensions relied upon are available.

- [2022.01.22; Maikuolan]: Dropped Gitter chat in favour of using GitHub
  Discussions instead.

- [2022.02.01; Bug-fix; Maikuolan]: Failed to correctly determine the client's
  IP address under certain circumstances (e.g., multiple choices available via
  HTTP_X_FORWARDED_FOR); Fixed.

- [2022.02.14; Maikuolan]: Synced common classes package.

Caleb M (Maikuolan),
February 14, 2022.

=== Version/Release 2.4.0 ===
MINOR RELEASE.

- [2021.05.28; Maikuolan]: Performed some minor refactoring.

- [2021.06.06; Maikuolan]: Reworked checkbox support for the front-end
  configuration page.

- [2021.06.07; Maikuolan]: Since v3, the "repository backup locations" are kind
  of useless (not linked up with Composer, and only providing metapackage data,
  rather than all the attached repositories/packages). Removed those links from
  the front-end home page and v3 documentation accordingly.

- [2021.06.08; Maikuolan]: Subtle aesthetic patch.

- [2021.06.10; Maikuolan]: Added a configuration directive for returning a 415
  status code for when an upload is blocked due to its filetype being
  blacklisted. Also did some very minor refactoring.

- [2021.06.29; Bug-fix; Maikuolan]: The front-end file manager's pie chart's
  components accordion was broken; Fixed.

- [2021.07.02; Maikuolan]: Synced common classes package.

- [2021.07.04; Bug-fixes; Maikuolan]: When the metadata for an already
  installed component was missing from the upstream, a wrong parameter type
  error could occur, causing the updates page to not load correctly; Fixed.
  Due to the scope that the executor queue would be iterated from, an infinite
  loop could theoretically occur under certain circumstances when attempting to
  install or update a component via the front-end updates page; Fixed.

- [2021.07.14; Maikuolan]: It's now possible, when updating via Cronable, to
  specify whether to update just the signature files, or to update everything.

- [2021.09.05; Maikuolan]: Precaution against potential future undefined index
  added to fallback closure.

- [2021.09.09; Bug-fix; Maikuolan]: The front-end signature information page
  reported the wrong counts for unidentified or other under the signature
  vendor or source counts; Fixed.

- [2021.10.30; Maikuolan]: Code-style cleanup: Public before private
  properties, magic before public before private methods.

- [2021.10.31; NEW FEATURE; Maikuolan]: Added the ability to segregate cache
  data on the basis of prefixes specified by the instance. This could be useful
  for when different installations are utilising the same caching mechanisms at
  the same server.

Caleb M (Maikuolan),
October 31, 2021.

=== Version/Release 2.3.1 ===
PATCH RELEASE.

- [2021.04.11; Maikuolan]: Updates handler activation closure will now activate
  its own dependencies, too.

- [2021.04.14; Bug-fix; Maikuolan]: Including the configured theme as a default
  dependency would prevent updates occurring for the component in question when
  using custom themes; Removed the dependency to resolve the problem.

- [2021.04.19; Bug-fix; Maikuolan]: BuildPath could potentially trigger
  warnings when open_basedir is defined, causing logging, among various
  other internal file operations, to fail (related to PHP bug 69240); Fixed.

- [2021.04.23; Bug-fix; Maikuolan]: The "one-step solution" options available
  at the front-end updates page were broken; Fixed.

- [2021.04.27; Maikuolan]: Removed the default username/password tip from the
  front-end login page.

- [2021.05.01; Bug-fix; Maikuolan]: Log truncation not being calculated
  properly; Fixed.

- [2021.05.07; Maikuolan]: Very slightly reworked/improved the front-end CSS.
  File manager update: Successfully uploaded files now return a 201 status.

- [2021.05.09; Bug-fix; Maikuolan]: Newly discovered component annotations were
  being immediately dumped instead of being written to the corresponding
  component metadata files; Fixed.

- [2021.05.22; Maikuolan]: Synced common classes package.

Caleb M (Maikuolan),
May 22, 2021.

=== Version/Release 2.3.0 ===
MINOR RELEASE.

- [2020.12.05; Bug-fix; Maikuolan]: Possible compatibility problem with
  Cronable introduced on November 27th; Fixed.

- [2021.01.10; Maikuolan]: Separated the code for performing outbound requests
  through cURL out to its own independent class.

- [2021.02.05; Maikuolan]: The default timeout for external requests is now
  configurable.

- [2021.02.05; Maikuolan]: The preview text next to the input fields on the
  configuration page didn't quite align properly; Fixed.

- [2021.02.07; NEW FEATURE; Maikuolan]: Added the ability to hide the phpMussel
  version used.

- [2021.02.20; Maikuolan]: Synced common classes package.

- [2021.02.22; Bug-fix; Maikuolan]: Reactivate flag within the front-end
  updater's internal procedure for updating and repairing components sometimes
  raised incorrectly; Fixed.

- [2021.03.11; Maikuolan]: Added some missing return type declarations.

- [2021.04.06; Bug-fixes; Maikuolan]: Some interdependent components weren't
  explicitly marked at the front-end updates page; Fixed. Unnecessary count
  check enforced on interdependent replacements; Removed.

- [2021.04.07-09; Maikuolan]: Added proper component dependency support to the
  front-end updates page and revamped related code and update mechanisms.

Caleb M (Maikuolan),
April 10, 2021.

=== Version/Release 2.2.0 ===
MINOR RELEASE.

- [2020.10.05; Maikuolan]: Very minor aesthetic fix.

- [2020.10.08; Maikuolan]: Added some 'copy to clipboard' buttons to the
  homepage and statistics page.

- [2020.10.09; Maikuolan]: Aesthetic patch + added a new theme.

- [2020.10.10; Bug-fix; Maikuolan]: MajorVersionNotice not declared early
  enough in frontend.php, causing an undefined index notice to occur; Fixed.

- [2020.10.18; Bug-fix; Maikuolan]: A small, minor scan optimisation mechanism
  found to be faulty, causing signatures to sometimes be skipped when not
  intended.
  Refer github.com/phpMussel/phpMussel/issues/224

- [2020.10.30; Maikuolan]: Redesigned the login pips and refactored some CSS.

- [2020.11.12; Bug-fix; Maikuolan]: Fixed potential undefined index error
  caused by the front-end updates page repair mechanism.

- [2020.11.20; Maikuolan]: Added partial support for detecting objects and
  files embedded within pdf files (due to the nature of how this has been
  implemented, for the purpose of scanning these embedded objects and files,
  phpMussel will regard pdf as an archive format; this is intentional).

- [2020.11.27; Maikuolan]: Ditched external test frameworks in favour of GitHub
  Actions. Replaced existing tests. (More work needs to eventually be done
  towards tests. This will eventually happen at some point).

- [2020.11.27; Maikuolan]: Some minor code-style cleanup and removed support
  showing test results at the updates page (since we're using different
  mechanisms now anyway).

Caleb M (Maikuolan),
December 4, 2020.

=== Version/Release 2.1.6 ===
PATCH RELEASE.

- [2020.07.06; Maikuolan]: Performed some minor refactoring.

- [2020.07.11; Bug-fix; Maikuolan]: The code for scanning zip files was
  treating directories as files, which wasn't affecting the overall results or
  performance of the scan process, but was adding some small amount of
  pointless and unwanted overhead to it; Fixed.

- [2020.07.12; Maikuolan]: Added a major version checker to the front-end
  updates page.

- [2020.07.13; Bug-fix; Maikuolan]: PHPMailer notifications would encode
  incorrectly when dealing with non-ANSI data (i.e., when using languages
  other than English); Fixed.

- [2020.07.13; Bug-fix; Maikuolan]: Possible problem found with IsActivable
  when updating certain components via the front-end updates page; Fixed.

- [2020.07.16; DEPRECATION/REMOVAL; Maikuolan]: hosts-file.net is dead. All
  related hpHosts content and configuration directives removed accordingly.

- [2020.07.31; Maikuolan]: Improved the way that the (generated by ...) notice,
  displayed at the footer of HTML pages, is rendered.

- [2020.08.04; Maikuolan]: Addressed a potential compatibility problem with
  installations where PHP has its output proxied through to a different host.
  Also slightly improved the aesthetics of the front-end, and changed the
  logout link to a logout button.

- [2020.08.06; Bug-fix; Maikuolan]: Two lines in the updater code were swapped
  the wrong way around, which could cause notices to appear sometimes; Fixed.

- [2020.08.06; Maikuolan]: Addressed a potential problem with calculating the
  number of bytes removed when updating components and slightly refactored the
  front-end functions file.

- [2020.09.30; Maikuolan]: Synced up common classes.

- [2020.10.01; Bug-fix; Maikuolan]: Discovered that the image chameleon attack
  detection could generate false positives against Mac OS X thumbnails; Fixed.
  Refer github.com/phpMussel/phpMussel/issues/223

Caleb M (Maikuolan),
October 1, 2020.

=== Version/Release 2.1.5 ===
PATCH RELEASE.

- [2020.06.20; Bug-fix; Maikuolan]: Logs were being written to the wrong
  directory in some cases due to the way that paths were being
  reconstructed; Fixed. Also improved some updates page guard code.

- [2020.07.03; Maikuolan]: Performed some minor refactoring.

Caleb M (Maikuolan),
July 3, 2020.

=== Version/Release 2.1.4 ===
PATCH RELEASE.

- [2020.06.17; Maikuolan]: Strengthened some guard code (the potential existed
  for some edge-case errors to occasionally slip through the existing code).

- [2020.06.19; Bug-fix; Maikuolan]: Logging broken due to missing parameter in
  the preg_split call in the recently introduced BuildPath closure; Fixed.

Caleb M (Maikuolan),
June 19, 2020.

=== Version/Release 2.1.3 ===
PATCH RELEASE.

- [2020.04.13; Maikuolan]: Performed some minor refactoring.

- [2020.04.14; Bug-fix; Maikuolan]: The phpMussel switch file isn't a signature
  file, but unintentionally matched positive for the phpMussel signature file
  magic number, allowing a very small but real risk that it would be
  interpreted by phpMussel as a signature file, causing PHP errors to be
  generated; Fixed.

- [2020.05.07; Maikuolan]: Some very minor aesthetic improvements.

- [2020.05.16; Maikuolan]: Slightly improved the safety of some included
  hyperlinks by way of including rel tags like noopener, noreferrer, external.
  Added the ability for configuration defaults to define regular expressions
  to be applied to their own values through preg_replace, thus complimenting
  the existing auto-typing functionality (phpMussel won't yet be using this
  functionality for its own configuration defaults, but it is added with the
  intent to provide a mechanism by which plugins may be able to provide
  additional safeguards of their own against bad configuration values).

- [2020.05.28; Bug-fix; Maikuolan]: The front-end accounts page was incorrectly
  reporting argon2id passwords as invalid; Fixed.

- [2020.06.02; Maikuolan]: Worked on some more minor aesthetic improvements.
  Also added some configuration filters (based on the work done last month) to
  some specific potentially error-prone configuration directives to help reduce
  the risk of erroneous values being specified there.

- [2020.06.03; Maikuolan]: Slightly strengthened the sanity checks performed by
  the front-end updates page when it verifies components.

- [2020.06.07; Maikuolan]: Very slightly improved the logic at the front-end
  updates page for determining whether a component is active or inactive. Also
  made the upload handler uninstallable.

- [2020.06.10; Bug-fix; Maikuolan]: Wrong metadata counts sometimes reported by
  the front-end signatures information page; Fixed.

- [2020.06.11; Maikuolan]: Slightly improved some PHPDoc annotations.

- [2020.06.14; Maikuolan]: Adjusted some potentially misleading L10N data.

- [2020.06.15; Maikuolan]: Performed some minor refactoring.

Caleb M (Maikuolan),
June 15, 2020.

=== Version/Release 2.1.2 ===
PATCH RELEASE.

- [2020.01.01; Bug-fix; Maikuolan]: The cache handler's PDO query template for
  deleting expired cache entries was malformed; Fixed.

- [2020.01.12; Bug-fix; Maikuolan]: Found and fixed a small typo in the choice
  filter for the default_algo configuration directive.

- [2020.01.13; Bug-fix; Maikuolan]: Repair was always failing, specifically for
  just the very first component to appear in any particular components metadata
  file; Fixed.

- [2020.01.25; Maikuolan]: Performed some minor refactoring.

- [2020.02.29; Maikuolan]: Added unit test suite (BDD testing and
  unit testing with Codeception and PHPUnit).
  Refer github.com/phpMussel/phpMussel/issues/177

- [2020.03.01; Bug-fix; Maikuolan]: The number of expected arguments in a call
  to sprintf in the functions file could potentially be manipulated in some
  cases depending on the data supplied to it; Fixed.

Caleb M (Maikuolan),
March 1, 2020.

=== Version/Release 2.1.1 ===
PATCH RELEASE.

- [2019.10.23; Maikuolan]: Improved caching mechanism guard code. Deprecated
  and removed the PHP vulnerable version warning formerly displayed at the
  front-end homepage (it risked causing unnecessary alarm for some users,
  especially those unable to update due to hosting restrictions, and posed a
  general annoyance for some other users).

- [2019.11.04; Maikuolan]: Updated the Cache class to use REPLACE INTO instead
  of ON DUPLICATE KEY for SET_QUERY (SQLite and others don't properly support
  the latter). Added the checkTablesPDO method to try to automatically create a
  table for the Cache class instance to use when PDO is enabled.

- [2019.11.04; Maikuolan]: Updated the installed/available extensions list to
  be able to also list which related drivers are installed/available.

- [2019.11.07; Maikuolan]: Performed some aesthetic changes to the front-end
  configuration page, replacing the directive index with a collapsible list,
  added support for category descriptions, and replaced the extensions table
  at the front-end homepage with a collapsible list.

- [2019.12.10; Bug-fix; Maikuolan]: Undefined variable notice when uninstalling
  components via the front-end updates page; Fixed.

- [2019.12.11; Bug-fix; Maikuolan]: Internal duplication of component metadata
  at the downstream could sometimes occur in some specific contexts, thereby
  preventing the front-end updates page offering the option to repair the
  affected components; Fixed.

- [2019.12.12; Maikuolan]: Added a "clear all" button to the cache data page.

- [2019.12.12; Bug-fix; Maikuolan]: The directory traversal detection code was
  unintentionally catching .htaccess files, thereby causing unnecessary forced
  failures on some specific front-end operations; Fixed.

- [2019.12.27; Bug-fix; Maikuolan]: The cache handler's mechanism for creating
  missing tables in PDO used a malformed query and didn't work properly; Fixed.

- [2019.12.31; Bug-fixes; Maikuolan]: Configuring the supplementary cache
  options in a certain way, due to the way that the front-end updates page
  interacted with the cache handler, could potentially cause the updater to
  perform multiple, superfluous outbound requests during normal operation,
  thereby causing it to lag out and generate server error messages; Fixed.
  Since 2019.12.11, the updater would sometimes fail to correctly detect and
  prepare newly found components from the upstream; Fixed. Also added a new
  mechanism to the codebase to aid with diagnosing bugs in the future (disabled
  by default; not configurable).

Caleb M (Maikuolan),
January 1, 2020.

=== Version/Release 2.1.0 ===
MINOR RELEASE.

- [2019.09.04; Maikuolan]: Added *partial* internal language support for
  Latvian, Norwegian, Polish, and Swedish. Will sync it all up with the other
  translations when there's time.

- [2019.09.06; Bug-fix; Maikuolan]: Found a way to trigger an invalid argument
  warning at the front-end updates page in some contexts; Fixed.

- [2019.09.17; Maikuolan]: Added an events orchestrator and refactored.

- [2019.09.18; Maikuolan]: Added an error handler event to be able to catch and
  report errors more effectively.

- [2019.09.24; NEW FEATURE; Maikuolan]: Improved error logging and added a
  default error log handler to take care of error logging in the absence of any
  custom event handlers for error logging. A new configuration directive has
  been added accordingly (error_log). Additionally, all event handlers have
  been moved into their own file, to keep them separated from function/closure
  definitions and to improve maintainability. Some minor refactoring has also
  occurred affecting the aforementioned and calls made to the time formatter.

- [2019.09.26; Bug-fix; Maikuolan]: Some pre-condition checks weren't being
  processed correctly, causing OLE objects to not be recognised correctly in
  some cases (thanks to Costegillio for bringing this to my attention); Fixed.
  Refer github.com/phpMussel/phpMussel/issues/209

- [2019.09.26; Bug-fix; Maikuolan]: Some of the missing directory guards were
  faulty (thanks to Costegillio for bringing this to my attention); Fixed.
  Refer github.com/phpMussel/phpMussel/issues/210

- [2019.09.29; NEW FEATURE; Maikuolan]: Added the ability to automatically
  repair some components via the front-end updates page.

- [2019.10.02; Maikuolan]: Added a new vendor shorthand entry (abuse.ch).

Caleb M (Maikuolan),
October 2, 2019.

=== Version/Release 2.0.0 ===
MAJOR RELEASE (BACKWARDS INCOMPATIBLE).

- [2019.05.31; NEW FEATURE; Maikuolan]: Added the ability to automatically
  switch between different channels when requesting a remote resource (e.g.,
  when the front-end updates page attempts to update something, or attempts to
  retrieve the latest available component metadata), for whenever such a
  request fails (e.g., due to server errors, the requested resource no longer
  existing at a particular location, etc), and added a new configuration
  directive, "disabled_channels", to optionally prevent phpMussel from ever
  requesting resources from particular, specific channels.

- [2019.06.17; Maikuolan]: Added the ability to optionally update only all
  signature files to the front-end updates page (as opposed to updating
  everything at once).

- [2019.06.27; Maikuolan]: Shifted responsibility for number formatting out
  from the front-end functions file, into its own, distinct class.

- [2019.07.10; Maikuolan]: The front-end updates page now sets "verify" as the
  default option for components, to help reduce the risk that users select
  "uninstall" or "deactivate" by accident.

- [2019.07.10; Maikuolan]: Slightly improved front-end pie chart colouring.

- [2019.07.26; Maikuolan]: Added condition to ensure that "delete" should never
  be the default option selected for files shown at the front-end file manager.

- [2019.08.05-06; MAJOR CODE CHANGE; Maikuolan]: Removed PHP 5.4 polyfills,
  thereby immediately upping the minimum PHP version requirement for the
  upcoming release. Updated the loader, upping the hardcoded minimum PHP
  version requirement to PHP 7.2, and removed some no longer needed code.
  Removed some extraneous .htaccess files (only really need our main .htaccess
  file in the base of the vault nowadays; the extra .htaccess files in some of
  the vault's subdirectories aren't necessary). Renamed a number of
  configuration directives in order to better comply with the phpMussel code
  style guidelines regarding the use of snake_case for configuration
  directives. Shifted the class autoloader out from the functions file, into
  the main loader. Added PHP7-style type hinting and return type declarations
  wherever applicable. Updated all common classes package classes to the latest
  compatible versions. Added some missing PHPDoc comments.

- [2019.08.17; Maikuolan]: Reinstated the "lang_override" directive.

- [2019.08.23; Maikuolan]: Slightly refactored the front-end updates page,
  related closures and other related functionality, and added the ability to
  install/activate or to deactivate/uninstall with a single action (previously,
  these actions had to be done separately, as two actions). Added some new
  switches/filters.

- [2019.08.24; Maikuolan]: Added last modified date/time to the file listings
  at the front-end file manager and fixed a possible issue with correct icon
  display for some not yet used file formats.

- [2019.08.31; Maikuolan]: Removed some unnecessary code from the loader, left
  over from some old features already removed a long time ago.

Caleb M (Maikuolan),
August 31, 2019.

======

"Changelog-v2.txt" contains changelog notes for versions => 2.0.0 < 3.0.0.

Note: v2 branches from v1 at 1.10.0 onward.

Changelog notes for versions => 1.0.0 < 2.0.0 can be found in the
"Changelog-v1.txt" file included with any relevant, corresponding releases.

Changelog notes for versions < 1.0.0 can be found in the "Changelog-v0.txt"
file or in the "_docs/change_log.txt" file included with any relevant,
corresponding releases.