Releases for Drupal core

Release notes

The twelfth maintenance and security release of the Drupal 6 series. Only fixes for security vulnerabilities and other bugs have been committed. New features are only being added to the forthcoming Drupal 7.0 release.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:

• SA-CORE-2009-006 - Drupal core - Cross site scripting

In addition to this security vulnerability, the following bugs have been fixed since the 6.11 release:

• #353328 by catch, BrianV: When a new commment is added, the redirection path should point to page, where the new comment is.
• #239945 by Xano, JeremyFrench, Damien Tournoud, andypost: Should not iterate over the children in taxonomy_get_tree() anymore if we reached max_depth.
• #292565 by grendzy, John Morahan, Jody Linn: remove path munging on 403/404 pages, which caused problems for login redirects
• #448268 by dww: Make sure that submitting the themes admin form clears out the update status cache, just like the modules admin form does.

Release notes

The eleventh maintenance and security release of the Drupal 6 series. Only fixes for security vulnerabilities and other bugs have been committed. New features are only being added to the forthcoming Drupal 7.0 release.

This release fixes a security vulnerability. Sites are urged to upgrade immediately after reading the security announcement:

• SA-CORE-2009-005 - Drupal core - Cross site scripting

In addition to this security vulnerability, the following bugs have been fixed since the 6.10 release:

• #376408 follow up by pwolanin: search_nodeapi() lacked break in switch; resulted in issue in logic not code flow
• #197864 by vito_swat, alpritt, Murz, catch: Use hook_term_path() in forum module instead of hook_link_alter(); simplfies code, improves performance and compatibility.
• #314314 by bastos, Dave Reid, mr.baileys, Pasqualle: fix invalid XHTML markup in update.php output
• #372914 by chx, pwolanin, webchick: Menu link title localization was broken when a non-t callback was used
• #395086 by Freso: call trim() before truncate_utf8() in comment module for better quality truncation.

Release notes

The tenth maintenance and security release of the Drupal 6 series. Only fixes for security vulnerabilities and other bugs have been committed. New features are only being added to the forthcoming Drupal 7.0 release.

This release fixes a security vulnerability. Sites are urged to upgrade immediately after reading the security announcement:

• SA-CORE-2009-003 - Local file inclusion on Windows

In addition to this security vulnerability, the following bugs have been fixed since the 6.9 release:

• - Patch #298722 by pwolanin: _menu_translate returns FALSE before to_arg is available. Drupal.org upgrade blocker.
• #310863 by bangpound, dboulet, catch, lee20: Locale variable results in locale module install, so skip adding empty variable when not needed.
• #275796 by Gribnif, Damien Tournoud, Dave Reid, vaish: module_list() should set its static variable to NULL instead of unset()-ing it, so it does not retain its value
• #328110 by marcingy, swentel, Damien Tournoud, pwolanin, David_Rothstein: the link argument is passed by reference to menu_link_save(), so avoid overwriting local variables in menu_enable().

Release notes

The fifteenth maintenance and security release of the Drupal 5 series. Only fixes for security vulnerabilities and other bugs have been committed. New features are only being added to the forthcoming Drupal 7.0 release.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:

• SA-CORE-2009-001 Drupal core - Multiple vulnerabilities

Release notes

The fourteenth maintenance release of the Drupal 5 series. Only fixes for bugs have been committed. New features are only being added to the forthcoming Drupal 7.0 release.

The following bug has been fixed since the 5.13 release:

• Rolling back #280934. PHP 4 incompatibility.

Release notes

The seventh maintenance and security release of the Drupal 6 series. Only fixes for security vulnerabilities and other bugs have been committed. New features are only being added to the forthcoming Drupal 7.0 release.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:

• SA-2008-073 - Drupal core - Multiple vulnerabilities

In addition to this security vulnerability, the following bugs have been fixed since the 6.6 release:

• - Patch #324118 by winterheart: fixed invalid XHTML being generated for forum topic listings.
• - Patch #329019 by dww, sun: fixed PHP warning.
• #315739 by sun: The theme name is in arg(4) on the block admin page, so only redirect to theme specific page if that is set.
• - Patch #329646 by Damien Tournoud: properly reset user_access().
• - Patch #255293 by Gribnif, maartenvg: incorrect regex causes some aggregated CSS to fail.
• #329998 by pwolanin: escape markup looking non-HTML tags in schema descriptions

Release notes

The twelfth maintenance and security release of the Drupal 5 series. Only fixes for security vulnerabilities and other bugs have been committed. New features are only being added to the forthcoming Drupal 7.0 release.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:

• SA-2008-067 - Drupal core - Multiple vulnerabilities

Release notes

The eleventh maintenance and security release of the Drupal 5 series. Only fixes for security vulnerabilities and other bugs have been committed. New features are only being added to the forthcoming Drupal 7.0 release.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:

• SA-2008-060 - Drupal core - Multiple vulnerabilities

In addition to this security vulnerability, the following bugs have been fixed in the 5.11 release:

• - Patch #265899 by mfb: uri_brief mail token did not support https URLs.
• - Patch #170310 by mfb, JohnAlbin: avoid SSL cookie getting over-written by non-SSL cookie.
• #296096 by Damien Tournoud. Fix 5.10 Postgres install & update.
• - Patch #246143 by bjaspan, Damien Tournoud: make sure updates are run in numeric order, not in definition order.
• #181831 by Rob Loach. Backport of #130630 by chx: provide an id on the form item wrapper div.
• #283026 by Damien Tournoud. Make user_authenticate from external source (for existing users) work with no server part.
• #298535 by mkalkbrenner. Correct HTTP status code for failed connection.
• #108717 by add1sun and neclimdul. Code style.
• - Patch #230932 by ryanlath: file_scan_directory() didn't scan the directory called '0'. Backport by cridenour.
• follow up to #280621 by lilou: the object tag was disallowed in a previous version in filter_xss_admin(), so disallow param as well, which is only meaningful inside an object tag
• #208270 reported by Dries, patch by jvandyk: it was not possible to clear the XML-RPC error cache, making it impossible to do multiple queries in one request. Add xmlrpc_clear_error() and slightly modify xmlrpc_error() to fix.
• - Patch #308549 by lyrincz, Dave Reid: fixed broken link in PHPdoc.
• #67895 patch by goba, tested by JirkaRybka and blackdog: move poll votes with poll options, when an option is removed, instead of dropping all old votes, solving an old data loss bug. Backport by dww.
• #312730 by Damien Tournoud. hook_requirements('install') should work for modules that don't reside in the main './modules' folder.

Release notes

The tenth maintenance and security release of the Drupal 5 series. Only fixes for security vulnerabilities and other bugs have been committed. New features are only being added to the forthcoming Drupal 7.0 release.

This release fixes security vulnerabilities. Sites are urged to upgrade immediately after reading the security announcement:

• SA-2008-047 - Drupal core - Multiple vulnerabilities

In addition to this security vulnerability, the following bugs have been fixed in the 5.10 release:

• #117748 by webchick, Pancho, Rob Loach, pwolanin: required field values were not properly trim()ed on validation
• #207991 by Rok Zlender: xmlrpc_date did not parse dates well. Backport by clemens.tolboom.
• Patch #254725 by Steve Dondley and BioALIEN: maxlength field for 'allowed HTML tags' is too short. Backport by scor.
• - Patch #285467 by mustafau: fixed typo a MT blog API function.
• #272636 by evolvingweb, dvessel: add 'js' class to html tag in drupal.js instead of overwriting all its classes with 'js'. Backport by sun.
• #292538 by Damien Tournoud and hanoii. Fix $sidebar_indicator behavior.