AGAVI CHANGELOG =============== 0.11.9 (December ??, 2009) -------------------------- CHG: Update timezone database to 2009m (#1154) (David) 0.11.8 (July 25, 2009) ---------------------- CHG: Validator shortcut "arraylength" should default to minimum of one element (#1123) (David) CHG: Update timezone database to 2009k (#1121) (David) CHG: Remove unnecessary use of create_function() in AgaviInarrayValidator (#1112) (David) FIX: AgaviArraylengthValidator doesn't work with files (#1122) (David) FIX: Arrays that failed validation are not purged from request data (#1084) (David) FIX: Memory leak in AgaviTranslationManager::getLocaleIdentifier() (#1083) (David) 0.11.7 (March 26, 2009) ----------------------- ADD: Allow setting of session_cache_expire(), session_cache_limiter() and session_module_name() through configuration (#1035) (David) CHG: Allow control over exporting behavior in combination with argument bases (#1074) (Dominik, David) CHG: Update timezone database to 2009d (#1070) (David) CHG: Generated WSDLs should not have namespace attribute on soap:body elements if service is document/literal (#1061) (David) CHG: Regex validator should export the validated data (#1041) (Felix) CHG: Throw exception if Apache's SERVER_SOFTWARE env var contains insufficient version information (#1029) (David) FIX: Exporting parameters from validators with an argument base causes fatal error (#1073) (David, Dominik) FIX: Fatal error in AgaviArrayPathDefinition::setValue() in combination with arrays (#1075) (David) FIX: Race conditions in AgaviConfigCache::writeCacheFile() may produce corrupt files (#1072) (Dominik) FIX: Form Population Filter inserts markup container for validation errors even if there are no messages to insert (#1060) (David) FIX: AgaviTranslationManager::$translators and $supplementalData are not initialized as empty array (#1045) (David) 0.11.6 (February 4, 2009) ------------------------- SEC: CVE-2009-0417: Cross-site scripting vulnerability in handling of incoming URLs (#1019) (David) FIX: Content-Type and Content-Length request headers are treated incorrectly (#1017) (David) FIX: AgaviWebRequest HTTP PUT support ignores Content-Type header (#1014) (David) 0.11.6 RC2 (January 29, 2009) ----------------------------- ADD: AgaviResponse::hasContent() (#1007) (David) ADD: AgaviException::render() should send shell exit code (#990) (David) ADD: Optionally set 'secure' flag on response cookies automatically (#982) (David) ADD: Optionally set 'secure' flag on session cookies automatically (#981) (David) ADD: Add AgaviWebRequest::isHttps() convenience method (#980) (David) ADD: Allow setting of session save path in AgaviSessionStorage (#979) (David) CHG: Update timezone database to 2009a (#1013) (David) CHG: Remove unused property AgaviOperatorValidator::$errors (#987) (David) CHG: Allow arbitrary number of fractional seconds for parsing date formats (#977) (Dominik) FIX: Several date classes are lacking type hints in method signatures (#997) (Dominik) FIX: FPF does not insert error messages or classes for submit buttons (#1011) (David) FIX: Shiny exception template produces invalid XHTML (#1009) (David) FIX: Sample App's and code templates' SecureSuccessView responds with a 401 HTTP status code instead of 403 (#1010) (David) FIX: [EXPLETIVE] Fucking Debian fucking ruined their fucking PHP package once again, and now we need to waste fucking time to fucking fix it (#1008) FIX: AgaviSoapController does not handle some SoapServer/SoapClient options properly (#1006) (David) FIX: AgaviCalendar::setTimeInMillis() doesn't explicitly cast value to float (#996) (David) FIX: AgaviConfigCache::loadConfigHandlers() may trigger "cannot redeclare class" fatal error (#989) (David) FIX: Caching generates invalid group values in some cases (#988) (David) FIX: Validation marks fields that weren't processed due to unsatisfied dependencies as sucessful (#984) (Dominik, David) FIX: Form Population Filter reveals errors from validators with severities "silent" and "info" (#986) (David) FIX: Validators with argument arrays might not perform dependency checks (#985) (David, Dominik) FIX: The Milliseconds 1-99 are missing the leading 0 when a date is formatted (#978) (Dominik) 0.11.6 RC1 (January 10, 2009) ----------------------------- ADD: Add option to control Propel 1.3 instance pooling (#960) (Felix) ADD: AgaviArraylengthValidator (#948) (Dominik) ADD: Optionally allow sending of response content when redirecting in AgaviWebResponse (#916) (David) CHG: Harden path string handling in AgaviArrayPathDefinition (#973) (David, Dominik) CHG: Change magic_quotes_gpc handling to require PHP 5.2.8 and use the fixes introduced there (#953) (David) CHG: Re-throw exception instead of printing stack trace and info in exception templates when display_errors is off (#952) (David) CHG: Add +FollowSymLinks to .htaccess code templates and samples (#893) (David) CHG: Add more best practices to code templates (#910) (David) CHG: Use standard layouts etc for system actions instead of hand-built renderers and layers in code templates (#911) (David) CHG: Always merge slot response metadata even if response content is null (#917) (David) CHG: Update timezone database to 2008i (#912) (David) CHG: Add standard warning about broken libxml versions (#909) (David) FIX: Init queries are not run correctly for Propel 1.3 (#975) (David) FIX: AgaviWebResponse sends Content-Length header with value 0 even if 'send_redirect_content' option is enabled (#972) (David) FIX: Using the timezone option in a locale string passed to _d() can possibly change the timezone of the given calendar object (#962) (Dominik) FIX: AgaviTranslationManager::createCalendar() forgets TZ offset when called with DateTime object (#957) (Dominik) FIX: Missing variable declaration in AgaviGettextTranslator (#968) (Dominik) FIX: AgaviWebRequestDataHolder method implementations are all over the place (#955) (David) FIX: Request data is not cleared if default View is run in absence of suitable Action::execute*() method (#967) (David) FIX: Slot container created inside a forward container retains "is_forward" parameter (#966) (David) FIX: Access to global request data holder is not locked during AgaviAction::getDefaultViewName() (#954) (David) FIX: The class name of AgaviAndoperatorValidator and AgaviNotoperatorValidator don't match the coding guidelines (#951) (David) FIX: Several validators might raise notices or break altogether on incorrect argument types (#946) (Dominik) FIX: AgaviValidator::getKeysInCurrentBase triggers a warning if the current validator base is no array (#947) (Dominik) FIX: FPF error insertion fails if XPath expression yields more than one location in the document (#943) (David) FIX: Possible to run any action by passing module/action parameters to invalid URL (#934) (David) FIX: Pattern delimiter is not passed to several preg_quote calls (#939) (David) FIX: AgaviPropelDatabase::connect() doesn't honor datasource parameter (#937) (David, Sven Kretschmann) FIX: Invalid CSS in project wizard's WelcomeSuccess template (#928) (TANAKA Koichi, David) FIX: Converting an AgaviCalendar with a custom unnamed Timezone an DateTime object fails (#922) (Dominik) FIX: logging.xml and output_types.xml handlers have variable name escaping problems (#921) (David) FIX: Wrong urls when passing host and port to WebRouting::gen() (#902) (Felix) FIX: build.xml is missing reset of code templates dir to default before copying dist.htaccess (#914) (David) FIX: Filename patterns are escaped incorrectly in config_handlers.xml (#913) (Noah) 0.11.5 (October 25, 2008) ------------------------- CHG: Update timezone database to 2008h (#896) (David) FIX: AgaviSoapResponse::searchSoapHeader() compares namespaces incorrectly (#892) (David) 0.11.5 RC1 (October 20, 2008) ----------------------------- FIX: AgaviDatabase::getName() always returns false (#887) (David) FIX: Validation config handler is broken for nested validators (#886) (David) FIX: Build system does not create app/log folder in new projects (#881) (David, Noah) 0.11.4 (October 14, 2008) ------------------------- CHG: Update logging.xml in Sample app and code templates and add "log" dir to Sample app (#879) (David) FIX: Parameters are not merged in config_handlers.xml (#880) (David) 0.11.4 RC1 (October 2, 2008) ---------------------------- ADD: Allow specifying of doctrine template implementations (#864) (David, TANAKA Koichi) FIX: Default autoload.xml is missing AgaviMysqliDatabase entry (#868) (David) FIX: SOAP and XMLRPC test scripts in sample app are broken (#866) (David) FIX: Certain validator names will cause a fatal error (#863) (David) FIX: Sample app SearchEngineSpamAction works with invalid product names (#861) (David) 0.11.3 (September 19, 2008) --------------------------- CHG: Update zoneinfo database to 2008f (#860) (David) CHG: Improve sample app SearchEngineSpamAction to use ID and optionally name (#859) (David) FIX: AgaviXmlrpcepiphpResponse::setHttpStatusCode() is not implemented but gets called in sample app Error404SuccessView (#849) (David) 0.11.3 RC2 (September 9, 2008) ------------------------------ ADD: Allow runtime configuration of Smarty via parameters in AgaviSmartyRenderer (#846) (David, TANAKA Koichi) ADD: Caching group element with array value support (#809) (David) ADD: Allow convenience array index access in AgaviAttributeHolder (#843) (David) CHG: AgaviSmartyRenderer should not set a Smarty plugins dir (#848) (David) FIX: Empty redirect in response may cause uninitialized string offset notice (#847) (David) FIX: AgaviParameterHolder::removeParameter() does not try literal key lookup first (#842) (David) FIX: module.xml must not be per-context (#839) (David) 0.11.3 RC1 (August 31, 2008) ---------------------------- ADD: AgaviMysqliDatabase (#601) (Blake Matheny, David) ADD: Add config option to run arbitrary SQL commands after connecting to a database (#646) (David) ADD: Allow ignoring of (X)HTML parse errors in FPF (#613) (David) ADD: Set current Context instance on Doctrine connections (#800, #808) (David) ADD: Assigning of "inner" content to $slots template array should be configurable (#793) (David) ADD: Support for doctrine connection settings and options (#788) (David) ADD: Allow using the resolved datetime constants for the argument names in the datetime validator (#760) (Dominik) CHG: Improve AgaviInflector performance (#823) (Thomas Bachem, David) CHG: Change the Pricefinder Model in the Sample App to have a more useful name (#819) (Felix) CHG: Enhance HTTP status code validation for AgaviWebResponse::setRedirect() (#804) (David) CHG: Update timezone database to 2008e (#806) (David) CHG: Dump "xhtml" output type from sample app and introduce a replacement (#802) (David) FIX: AgaviEqualsValidator's docs do not match the actual validation process (#833) (Dominik) FIX: Invalid argument name in AgaviValidationManager::hasError() (#832) (David) FIX: The gettext translator doesn't interpret the plural forms like the original gettext implementation (#821) (Dominik) FIX: AgaviView::initialize() incorrectly assigns container's response to a property (#813) (David) FIX: AgaviExecutionTimeFilter runs only once (#801) (David) FIX: PEAR installations place src/routing/soap files in the data directory rather than the source directory (#799) (Noah) 0.11.2 (July 8, 2008) --------------------- FIX: Several config handlers are missing checks for existance of element(s) inside (#796) (David) FIX: Namespace for disabled module forwarding information is wrong (#792) (David) 0.11.2 RC2 (July 2, 2008) ------------------------- FIX: Exception templates incorrectly fix information about exception origin (#790) (David) FIX: Markup is escaped by accident in shiny exception template (#791) (David) FIX: Using '#' in a routing pattern triggers a warning (#789) (Dominik) 0.11.2 RC1 (June 27, 2008) -------------------------- ADD: Support trimming of input string in AgaviStringValidator (#745) (David) ADD: Add support for native doctrine model autoloading (#759) (David) ADD: Add support for doctrine manager attributes (#783) (David) ADD: Add SecurityUser::hasCredential and SecurityUser::getCredentials for convenience (Noah) (#772) ADD: Add convenience methods to AgaviUploadedFile (#607) (David) ADD: Allow arrays as values for web request sources. (#675) (David) ADD: Allow arrays as setting values in settings.xml (#670) (David) ADD: Ability to return data from view as inner content for first layer in a rendering batch (#655) (David) ADD: Allow nested routing structures with concatenated name or action attributes in ancestors other than immediate parents (Dominik) (#764) CHG: AgaviController::dispatch() should accept module and action names in the request data argument with routing disabled (#776) (David) CHG: Routing should not just bail out of execute() if routing is enabled, but no routes are defined (#779) (David) CHG: Refactor AgaviContext::initialize() and the passing of "profile" (#778) (David) CHG: Arguments passed to AgaviController::dispatch() should have precedence over routing results (#777) (David) CHG: Introduce generic AgaviStreamLoggerAppender (#773) (David) CHG: Make AgaviLoggerAppender an AgaviParameterHolder (#774) (David) CHG: Change error class handling in FPF to set classes on elements returned by the respective XPath expressions, not the original elements (#768) (David) CHG: Use file locking everywhere files are written (Dominik) (#766) FIX: AgaviValidationManager::hasError() is inconsistent with AgaviValidationManager::getError() regarding severity (#784) (David) FIX: Routing tests do not reset core.use_routing in tearDown() (#781) (David) FIX: stdout/stderror log appenders are broken (#751) (David) FIX: Caching configuration blocks might be merged incorrectly (#755) (David) FIX: Caching and validation configurations cannot be per-context (#754) (David) FIX: Form Population Filter incorrectly inserts XML prolog into HTML documents (#771) (David) FIX: Calling move() twice on the same uploaded file will cause a bogus exception (#770) (David) FIX: shiny.php exception template does not use htmlspecialchars() when outputting file paths (#765) (David) FIX: Static method AgaviBaseConfigHandler::replacePath() is used in object context in two config handlers (David) (#762) 0.11.1 (May 9, 2008) -------------------- FIX: UTF-8 Special characters in exception messages get garbled in exception output (Tanaka Koichi, David) (#758) 0.11.1 RC3 (May 2, 2008) ------------------------ ADD: Add ability to cache complete request attribute namespaces in Execution Filter (#740) (David) CHG: Non-Agavi exceptions should be clearly marked as such (#749) (David) CHG: Change execution filter to run action again if action is cached, but output type of the view isn't (#742) (David) CHG: Update timezone database to 2008b (#728) (David) FIX: Arrays exported by a validator do not survive validation cleanup (#756) (Dominik) FIX: AgaviArrayPathDefinition::getFlatKeyNames() returns nonsense if the prefix is "0" or an empty string (#757) (Dominik) FIX: Request is not properly unlocked if an exception occurs (#753) (David) FIX: logging.xml in code templates does not work out of the box (#750) (David) FIX: Actions that return no View are never cached (#746) (David) FIX: AgaviDateFormatter::translate() might kill DateTime's DateTimeZone object (#743) (David) FIX: Reusable renderers do not work (#741) (David) FIX: AgaviInflector::singularize returns the wrong singular form of "caches" (#739) (Dominik) 0.11.1 RC2 (March 22, 2008) --------------------------- CHG: Make AgaviView::createForwardContainer() forward arguments from the current container if no arguments given (#707) (David) CHG: AgaviView::create*Container() should use null as default for arguments (#735) (David) CHG: Routing, GettextTranslator etc should use AgaviToolkit::expandVariables (#708) (David) CHG: Speed up unique ID generation (#731) (David) CHG: Bring sample app and code templates up to date (#719) (David) CHG: Update timezone database to 2008a (#727) (David) CHG: List of matches for a route should be populated by the time onMatched() is called on a callback (#730) (David) CHG: Check for existing X-Powered-By header before setting it in WebResponse (#716) (David) CHG: Execution Filter should read action attributes for caching from Action, not Container (#706) (David) CHG: Cache write order in execution filter should be reversed (#703) (David) CHG: AgaviExecutionFilter::writeCache() could use third argument with lifetime (#702) (David) CHG: AgaviExecutionContainer::createExecutionContainer() should copy over container parameters (#699) (David) CHG: Improve the speed of array key lookups (#693) (Noah) CHG: Change *val() functions to proper typecasts (#697) (Noah) CHG: dist.htaccess in code templates should have RewriteEngine On (#678) (David) CHG: Bumped and fixed copyright years (#664) (David) CHG: Update timezone database to 2007k (#660) (David) FIX: Given arguments object is not cloned for Container execution if Action is "simple" (#736) (David) FIX: Form Population Filter handles boolean false values incorrectly (#737) (David) FIX: Percent signs are incorrectly escaped in AgaviRouting::parseDynamicSet() (#733) (David) FIX: routing.xsd does not allow dynamic expressions in output_type attribute (#734) (David) FIX: AgaviToolkit::expandVariables replacing is too greedy (#732) (David) FIX: AgaviPhpRenderer::$moreAssigns is not declared or initialized (#729) (David) FIX: AgaviWebRequest cannot map arbitrary HTTP verbs (#725) (David) FIX: AgaviWebRequest does not write all changed factory parameters back (#724) (David) FIX: Charset in Content-Type http-equiv meta tag might be parsed incorrectly (#722) (David) FIX: Generating the current route without additional arguments results in unescaped single quotes and square brackets, potentially incorrectly replaced argument separator (#718) (David) FIX: Generating the current route with additional or changed arguments allows code injections (#717) (David) FIX: Unsetting a user parameter that in a routing callback's onGenerate() was passed to gen() produces strange behavior (#714) (David) FIX: Setting a user parameter that was undefined in a routing callback's onGenerate() has no effect if a default is defined (#713) (David) FIX: Form Population trips over entities in error messages when inserting them into the document (#715) (David) FIX: Routing config handler cannot handle parameter arrays (#712) (David) FIX: XML config parser only applies the xsl stylesheet defined in the first processing instruction (#711) (David) FIX: Execution Filter does not restore cached action attributes on cache hit (#705) (David) FIX: caching.xsd has incorrect rules for elements (#704) (David) FIX: View cache validity check does not use lifetime, might cause usage of stale data (#701) (David) FIX: Container info is not retained on internal forward due to disabled module (#700) (David) FIX: Incoming routing parameters can possibly overwrite routing parameters set in a callback (#698) (Dominik) FIX: AgaviReturnArrayConfigHandler creates an numerical indexed array of elements if child and parent have the same names (#694) (Dominik) FIX: AgaviConfig does not handle empty strings properly (#692) (Noah, David) FIX: onGenerate() method in callback is not run for routes with a source (#695) (David) FIX: Values in long request arrays are not decoded with magic_quotes_gpc on (#684) (David) FIX: WebRouting does not clean up in long request arrays (#685) (David) FIX: WebRouting does not clean up in $_REQUEST (#681) (David) FIX: $HTTP_RAW_POST_DATA is not removed on request startup (#679) (David) FIX: Copies of $_SERVER values in $_ENV are not cleaned (#674) (David) FIX: Request data is not cleaned for variables affected by register_argc_argv or register_long_arrays (#673) (David) FIX: AgaviWebRequest::startup() does not call parent startup() (#677) (David) FIX: AgaviCreoleDatabase does not support various Creole driver settings (#672) (David) 0.11.1 RC1 (December 26, 2007) ------------------------------ ADD: Creole session storage supports configurable date formatting (#639) (David) CHG: Session storages should reveal server error message in exceptions (#645) (David) CHG: Update timezone database to 2007j (#642) (David) CHG: Always send HTTP/1.0 responses in shiny exception template (#620) (David) CHG: Perform special multislash cleanup for all Apache 2.x versions (#619) (David) FIX: Content-Length header is sent regardless of "send_content_length" setting when a redirect is performed in a WebResponse (#659) (David) FIX: Validator names cause parse errors if they don't meet PHP label requirements (#658) (David) FIX: Agavi:boostrap() without arguments ignores writeable core.environment setting (#657) (David) FIX: PDOSessionStorage is unlikely to work properly in case of exceptions (#644) (David) FIX: PHP 5.2.5's completely ruined glob() can lead to unhappy foreach loops (#649) (David) FIX: RotatingLoggerAppender should complain about a rotation cycle smaller than 1 (#654) (David) FIX: validators.xsd is missing the "source" attribute in validators (#653) (Dominik) FIX: FPF's CDATA fix for