project 4.7.x-2.2

This release fixes a security vulnerability, all users of project (4.7.x-2.x) are urged to upgrade. For more details, see DRUPAL-SA-2007-004.

Besides the security fix, the other changes since project-4.7.x-2.1:

New features

• #106246: provide admin setting to change "base URL" for download links

Bug fixes

• #107215 : Published status not respected for release nodes. If you had "access projects" permissions, you could view any unpublished releases.
• #97780: Fixing obscure bug for the "Last updated:" display. It was only displaying if the node had been edited since it was created, since we were still testing against "changed", not "file_date."
• #104837: remove unneeded t() and double check_plain() + check_url()
• Removing cruft that's no longer relevant or desired: we don't want checkboxes to be inline'ed on project node forms.
• #105228: fix CSS to handle new behavior of FAPI #prefix/#suffix (#100787)
• #86806: version filter on project browsing pages no longer resets when you change tabs or use the pager.
• #86806: Version filter resets when you change pages -- fix for anonymous users: disable the selector and add "Login or register to modify the filter" with links (comment 12, patch by dww, backport to DRUPAL-4-7--2).
• use l() to generate links instead of our own custom code
• minor code clean up on recent changes to project taxonomy UI
• #107865: only allow users with 'adminster projects' (not 'administer nodes') permission to delete release nodes.
• #108827: Release form does not display correctly on opera and other browsers that can't handle inline-table (which is CSS3).
• #108678: node_access modules can't provide less restrictive update and delete rights to individual projects due to project_access() bug.
• #78245: homepage property is stored but never displayed on project nodes
• #11879: removing dead hook_content() code
• removing weird stale code that wass initializing things from $_GET in hook_form() which was added in revision 1.15, 2003.
• hook_form() doesn't need $node passed by reference. Removing some stray whitespace and a line of commented-out dead code.

Fixes to the package-release-nodes.php packaging script

• #97583: fixing a minor bug: some watchdog() messages were using the old hard-coded 'release_package' and 'release_error' $type, instead of the global settings.
• #109180: providing links to release nodes in watchdog() [backport]
• #108493: file metadata updates not always saved into the DB:
  • 2 new command-line args for this script: 'check' and 'repair'
  • use clearstatcache() so PHP doesn't return stale stat info.
  • reorganize the code a little so we don't treat failure to rm the tmp directory for a given contrib as a fatal error.
  • only create the task-specific tmp dir if we're creating packages, not checking or repairing metadata.