Vanilla 1.1.5 will fix some XSS and CSRF vulnerability. You can try it already by installing Vanilla 1.1.5 release candidate 4. For more information about the vulnerabilities, see Vanilla 1.1.5 releases notes (draft).

Upgrading instructions (draft):
http://lussumo.com/upgrade

The official release is planed for 22nd of September. Let us know if find any bugs or need us to add some delegation.

Vanilla 1.1.5-rc4:
http://vanilla-friends.googlecode.com/files/vanilla-1.1.5-rc4.zip

Don't install it on a live forum!!!

The uncompressed css files are in themes/vanilla/styles/default/src.

There is also a src folder in js/

It was decided to show a warning about the blank password--we didn't want the user to be ignorant of the problem and we didn't want to accept blank passwords without batting an eye.

So you see a warning message that you have to read with instructions that you had better follow before being able to proceed.

You're on the right track to be a developer--you basically prove yourself with add-ons and offering help in the community forums.

@micz: I will host a changed-only-files package on Vanilla-friend.

Update: You can now download the changed-only-files package. The upgrade package doesn't have the css and js source files.

I don't wish to be rude, but why had vanilla not had a update in some time. Other forums seem to be adding new features every other day. This is not a hit a vanilla.

@Simonb: We are just fixing bugs. Vanilla is just a basic forum that should allow developers to build a forum that looks like and does exactly what they want. Its a long time I haven't look at other forum but at the time they were very difficult to customize and to strip down.

I wish someone would make a full feature forum based on Vanilla, so that people who like vanilla design but are not developers have a ready to use solution.

From what I read, Vanilla 2 that Mark is working on should give more power to extension developer (in 1.x, some part can't easily be modified because they are loaded before the extensions) with a better api, and will focus on scalability. It will probably have less features; a feature like whispers make caching impossible.

Thanks guys for fixing this issues. I appreciate the fact that you gave due credit also. Good work Vanilla! :)

Vanilla++ :)

Thanks for doing the legwork for the update!

Ditto. I feel a bit guilty that you guys were nice enough to credit me, when all I did was suggest a minor change. :)

a feature like whispers make caching impossible

How so? Just filter the whispers from the cached copy. Even if there's a hundred whispers in the discussion, which I assume is really stretching it, it's no big in terms of memory or CPU cycles.

Question: I noticed some PHPDocumenter work in the feature list...is that the way of the future? While I was working on that bit of API documentation I did for the wiki, I kept thinking, "this is not the proper place for this."

You said the full release was scheduled for the end of the month, how far has the expected release date been pushed back? (if it isn't coming out today)

Lots of files have this:

@version 1.1.4-rc2

when it should be this:

@version 1.1.5-rc2

I just add Vanilla 1.1.5-rc3:
http://vanilla-friends.googlecode.com/files/vanilla-1.1.5-rc3.zip.

Please review it, especially if you can test it with mysql 3.23 or with a custom authenticator.

yep, don't install it on a live forum!!!

Hi, I am a new user in this community. Since last month I have started using Vanilla Forum, and I like it very much. I first used v. 1.1.4, then 1.1.5rc1 and currently I use version 1.1.5 rc2. Today I tried to update manually new files which came with 1.1.5 rc3. I used WinDiff to find out which files were modified and then updated those files on my server. After updating files, I got the following error message when I tried to log in:

------
A fatal, non-recoverable error has occurred
Technical information (for support personel):

Error Message
The "PasswordHash" class referenced by "PasswordHash" does not appear to exist.
Affected Elements
ObjectFactory.NewObject();

For additional support documentation, visit the Lussumo Documentation website at: lussumo.com/docs
------

I decided to go back again to 1.1.5. rcc2 version. As soon as a hash problem is fixed, I can try to make a new test.

@Engin: Can you add before line 35 of library/Framework/Framework.Class.SqlSearch.php $this->UserQuery = strtolower(trim($this->UserQuery));


It should look like that:
function BreakKeywords() {
$this->UserQuery = strtolower(trim($this->UserQuery));
$Keywords = explode(' ', $this->UserQuery);


1.1.5rc3 worked fine for me, I just deleted everything except for the conf and extensions directories and uploaded all the new files.

@Dinoboff: I create a new database with encoding utf8_general_ci. now everything is ok.

How do I go about authenticating my costume, Dinoboff? :D