markzz/aurweb.git, branch v1.9.1

Release 1.9.1

2012-03-09T08:24:52Z

Signed-off-by: Lukas Fleischer

UPGRADING: Add release notes for 1.9.1

2012-03-09T07:28:48Z

Signed-off-by: Lukas Fleischer

Replace "nb_NO" translation by "nb"

2012-03-09T07:21:38Z

This one is not a specific dialect, so "nb" (Norwegian Bokmål) is the better name to use here. Thanks-to: Alexander Rødseth Signed-off-by: Lukas Fleischer

Replace "pt" translation by "pt_PT"

2012-03-09T07:15:10Z

This makes the difference between Portuguese (Brazil) and Portuguese (Portugal) a bit clearer. Also, "pt_PT" is way more up to date than "pt". Signed-off-by: Lukas Fleischer

Translation updates from Transifex

2012-03-09T07:11:52Z

Signed-off-by: Lukas Fleischer

Escape all output strings in the header and footer

2012-02-19T04:21:48Z

Escape each output string using htmlspecialchars(). These aren't exploitable; it's still better to escape them properly. Signed-off-by: Lukas Fleischer

Fix some more XSS vulnerabilities

2012-02-19T03:48:31Z

Escape strings properly using htmlspecialchars(). Seems like we missed these in former cleanups. Fixes FS#28515. Signed-off-by: Lukas Fleischer

Escape wildcards in "LIKE" patterns

2011-10-25T07:25:43Z

Percent signs ("%") and underscores ("_") are not escaped by mysql_real_escape_string() and are interpreted as wildcards if combined with "LIKE". Write a wrapper function db_escape_like() and use it where appropriate. Note that we already fixed this for the RPC interface in commit da2ebb667b7a332ddd8d905bf9b9a8694765fed6 but missed the other places. This patch should fix all remaining flaws reported in FS#26527. Signed-off-by: Lukas Fleischer Signed-off-by: Dan McGee

Wrap mysql_real_escape_string() in a function

2011-10-25T07:25:30Z

Wrap mysql_real_escape_string() in a wrapper function db_escape_string() to ease porting to other databases, and as another step to pulling more of the database code into a central location. This is a rebased version of a patch by elij submitted about half a year ago. Thanks-to: elij Signed-off-by: Lukas Fleischer Conflicts: web/lib/aur.inc.php

Update message catalog

2011-09-05T15:02:38Z

Signed-off-by: Lukas Fleischer