Version 1.4 on the way...

[queks]

Jeff, can you pls look into the code for the IM part. Many of my members including myself get to see each other's IM content randomly. Sometime, the IM box shows another person's IM instead of our own IM contend. This problem only occured randomly, i fail to duplicate this problem. I have already post this bug in the bug thread and attach a post from my forum regarding members complaint of able to see other ppls IM content

[xtra]

Neil, we don't touch register globals.  It's about 5 lines of code added which take care of everything.

I'm curious... what did you use to avoid globals? I tried to change that behaviour with ini_alter('register_globals', '0'); but that didn't work. Globals are created anyway.

[Jedi~]

I thought it was ini_set..?

[Jeff Lewis]

register globals does just that.  So by calling a page like the address above... action=post, with register globals you could just access $action in your code with it on.  With it off, you have to use $_GET[action] or $_POST[action] from a form or you can use a catch all.

For 1.4 we have added a small loop to turn all into regular globals.  We haven't used ini set at all...

[xtra]

For 1.4 we have added a small loop to turn all into regular globals.  We haven't used ini set at all...

I assume that you you extract all $_GET and $_POST vars, right? But that will create the same kind of security problems that existed before version 4.2.0, when global were ON by default.
You just extract vars from those arrays, but I guess you don't check if they exist. It means that you can get a parameter passed by an URL, when you expect a post.

I only use the new associative arrays from 4.1.2+
The code is much cleaner and I know what kind of info i'm using. Sessions are also much easier to use, because you only deal with the $_SESSION array, nothing else. No session_register/unregister, etc, ...

[Jeff Lewis]

Yes we extract them but 1.4 is only being made to WORK with 4.2.

SE 2 will make use of the new variables. Everyone lived with PHP in the old way for years, it won't kill anyone until SE 2 comes out...

[Jeff Lewis]

By the way, changes so far:

-fixed attachment error arrayname
-fixed IM error name_name
-fixed globals off error
-fixed missing link to profile in email registration
-fixed infamous Post.php 744 error
-fixed Inactive Members - Aaron O'neil
-fixed report to moderator text - Compuart
-fixed empty settings causing crashes
-fixed bug in Reminder.php
-fixed polls in announcement boards
-fixed user appearing online after changing password and being logged out
-fixed email notify, send to last page
-fixed poll title bar missing class information
-fixed a small quote bug - Dave Smulders
-fixed inline links in create poll screen
-fixed some hardcoded language (yse237-240)
-fixed message icon on message preview
-fixed empty delimiter on profile change (supressed rather than fixed)
-fixed small bug with logging in during maint mode - Pablo
-fixed use of Alt0160 on subject line
-fixed ~ breaking URLs
-fixed some nasty table behaviour
-fixed class information missing from various spots - Chris Cromer
-fixed link to support forums
-fixed QueryString problem - Compuart
-fixed empty delimiter on register
-fixed URL getting changed in code block - Compuart
-fixed large text area, added style to style sheet - macterra
-fixed problem with viewing topics when sticky topics disabled
-fixed problem with websiteURL saving incorrectly


-added previous and next to bottom of screen as well
-added go button back to jumpto box
-added calendar (add images and SQL changes) - Aaron O'Neil
-added ability to NOT leave remnant - Joseph Fung

[Mach8]

Another change - the Move thread screen has been tidied up a lot, thanks for that

It also gives you the option now of making a thread to say the old one had been moved.

[Jeff Lewis]

-added ability to NOT leave remnant - Joseph Fung

Yep, that is what the above is

[Mach8]

Sorry

[Chris Cromer]

I found something, in the instant message center in my inbox, it says the message came from their real name instead of the display name... or maybe yall jest decided to make it like that?

[mats]

I should find i change of assinging members to the kategories very useful
I would like to be able to assing members by their usernames instead or let me choose if i want to assing by membergroup or by name.
Example

if you have three users lets call them 1,2,3 and you want to give them access to different boards but they all should have access to one board that others dont have access to you get a problem.

assingning them to the same membergroup gives them access to the board they shouldnt see.The only way i can fix this is to let them have differant logins and that isnt i nice way of solving this.
If i have missed something and you can do this already i will be happy to know how  

[Hypocrite]

I found something, in the instant message center in my inbox, it says the message came from their real name instead of the display name... or maybe yall jest decided to make it like that?

I think that should be changed because my users are unsure where the IM is going when the real name is different from the display name.

[Chris Cromer]

I found another thing, when you change your e-mail address and you have e-mail password set, it e-mails you a random password, but that password is never set in the database. In fact the password never changes at all it stays the same.

[Jeff Lewis]

Chris, that is what you were working on fixing right?