# Release Notes

## Version 2.2.127 (2020-03-23)

This version sets the maximum height of the edit form textarea after reports for a jumping behavior on mobile devices. The core table of content classes "pmtoc-show" and "pmtoc-hide" now replace the previous classes "show" and "hide" to prevent conflicts with other frameworks. The functionality of the recipe Skins:SkinChange was added to the core (disabled by default). The documentation was updated.

This version allows link URLs to be escaped with [=link address=] if they contain any special characters, including quotes, parentheses and pipes. The obfuscated e-mails will now work from headers, footers and sidebars. A form attribute "formnovalidate" was added to the core and to the "Cancel" button in the edit form. Core table of contents will now work better with Cookbook:SectionEdit. Cookbook:RecipeCheck was included in the core -- if you have this recipe already installed, you can simply comment it out from your config.php. The code that handles $EnableRCDiffBytes was refactored to also show the bytes changed in the page histories. New upload extensions "webp" (images) and "opus" (audio) were added. The documentation was updated. ## Version 2.2.122 (2019-11-19) Version 2.2.121 was released by mistake and contained some experimental code that was meant to be tested first. This version fixes a bug with ObfuscateLinkIMap() and international characters. New configuration variables$DefaultUnsetPageTextVars, $DefaultEmptyPageTextVars can set default values for page text variables. The built-in table of contents and numbered headings can now be enabled independently. A pagelist template pseudovariable {$$EachCount} was added, containing the number of the page in the current "each" loop. Input form elements and the (:searchbox:) field now can have ARIA accessibility attributes. The documentation was updated. ## Version 2.2.120 (2019-10-13) This version fixes a bug with existing complex customization of GUIEdit buttons. Very long tables of contents will now be scrollable. A new "input datalist" form element (list of suggestions to other input fields), and a new "details+summary" block section (toggle sections without JavaScript) were added. The documentation was updated. ## Version 2.2.119 (2019-10-03) This version updates the core for PHP 7.4. Required input fields now feature required="required" attributes and modern browsers prevent sending the edit or upload form with empty required fields. Attachlist ext= and names= arguments now accept patterns and negatives like ext=jpg,png, ext=-pdf, or names=-th*---*.jpg. The Redirect function can now have a 3rd argument with the full URL. The scroll position in the edit text area will be remembered on save-and-edit and preview. A bug was fixed with pagelist while preview. The documentation was updated. A number of features currently provided by recipes were added to the core and disabled by default. You can still use the recipes, or you can disable them and enable the core features. The following features were added: The above new features are disabled by default, see the documentation for more information on how to enable them, or test them on pmwiki.org where most of these are enabled. Please report if you notice any problems. ## Version 2.2.118 (2019-08-28) This version integrates the features of the recipe Cookbook:PreviewChanges into the core. If you currently use this recipe, please uninstall it and add to config.php:  EnablePreviewChanges = 1;  The documentation was updated. ## Version 2.2.117 (2019-07-28) This version adds handling of "partial content" requests for file downloads. New video file extensions 'm4v' and '3gp' were added. The Upload form now includes a new text field "Uploader" pre-filled with the name of the editor, and a new variable EnableUploadAuthorRequired was added (defaults to EnablePostAuthorRequired). The documentation was updated. ## Version 2.2.116 (2019-06-19) This version fixes pagelists with case insensitive matches of page (text) variables for international wikis. If your international wiki pagelists rely on case-sensitive variable matches, please see PageListVarFoldFn. The documentation was updated. ## Version 2.2.115 (2019-05-13) In this version the responsive skin in large "desktop" mode changes the search form background to transparent, for easier custom styling of the header. The documentation was updated. ## Version 2.2.114 (2019-04-02) This version adds a skin directive <!--IncludeTemplate ... --> and the variable SkinTemplateIncludeLevel. The core variable documentation format identifiers were moved to the definition term element to allow CSS ":target" styling, and the header and link text of the vardoc table can now be translated. Input forms have a new HTML5 element "tel", a new attribute "pattern" and two bugs were fixed with the classnames of the new elements and with the identifiers of "select" lists. The documentation was updated. ## Version 2.2.113 (2019-03-01) This version adds a new (:input button:) form element. All form elements can now accept custom data-* attributes, which can be disabled by setting EnableInputDataAttr to 0. Both additions are meant for easier integration with custom JavaScript functions or some frameworks. The documentation was updated. ## Version 2.2.112 (2019-01-09) This version includes a fix for PHP 7.3, and the documentation was updated. ## Version 2.2.111 (2018-12-08) This version updates core .htaccess files to be compatible with both Apache 2.4 and earlier versions, and the variable DenyHtaccessContent was added with the updated content. In case of difficulties or questions please contact us. A CSS value in the pmwiki-responsive skin was fixed. The MarkupExpression {(ftime )} now accepts tz= (time zone) and locale= (language locale) arguments. The documentation was updated. ## Version 2.2.110 (2018-11-05) This version prevents a warning with the {(substr )} markup expression when non-number arguments are typed. A new variable PageListSortCmpFunction allows custom functions to order page lists. A new variable MarkupMarkupLevel indicates when the processing happens inside (:markup:) blocks. The default style for [@escaped code@] dropped white spaces inconsistently and was fixed. If you rely on the previous behavior please add this to your pub/css/local.css file to revert it:  code.escaped { white-space: nowrap; }  The documentation was updated. ## Version 2.2.109 (2018-07-09) This version fixes a bug with the Path: InterMap prefix which was broken in 2.2.108. The function pmcrypt() was updated to prevent more strings from causing "invalid hash" warnings in PHP 7. The variable EnableMarkupDiag was added to help diagnose all markup calls. The documentation was updated. ## Version 2.2.108 (2018-07-05) This version adds the PCCFOverrideFunction variable allowing a custom function to override PCCF(). AuthUserPageFmt can now be an array of page names. The page cache file name can now be customized. Form checkbox labels now have the same tooltip title as the checkbox. Ordered lists with the %reversed% WikiStyle will have descending numbers. Minor fixes to refcount.php, vardoc.php, and pmcrypt(). The default InterMap PmWiki URLs have now the HTTPS protocol. The documentation was updated. ## Version 2.2.107 (2018-02-02) This version includes more fixes for PHP 7.2 for forms and pagelists. A new variable MailFunction allows administrators and developers to write replacement functions for the PHP function "mail()". Styles were improved for right-to-left text blocks embedded into left-to-right texts (and vice versa). The documentation was updated. ## Version 2.2.106 (2017-12-01) This version has a rewrite of the function PageListSort() to allow it to work with PHP 7.2, and fixes a bug with the backtick (escape) WikiWord markup. The helper function pmsetcookie() and the variables EnableCookieSecure, EnableCookieHTTPOnly were added to allow easy setting of secure cookies. The documentation was updated. ## Version 2.2.105 (2017-11-07) This version fixes a bug with the PQA() function causing invalid HTML with attributes glued together. The function HandleUpload() was refactored and UploadSetVars(pagename) was added to allow upload-managing add-ons to set variables more easily. If you upgrade from 2.2.98 or earlier, and you have custom markup rules relative to author signatures, please see note about change in 2.2.99 (documented November 2017). ## Version 2.2.104 (2017-10-11) This version fixes a bug with path WikiTrails reported today. ## Version 2.2.103 (2017-10-01) This version is a major upgrade on the internal processing of markups and patterns, all core scripts were updated to be compatible with PHP version 7.2. Whether you use that PHP version or another one, with any local configurations and custom add-ons, there should be no change for what you see, but if any problems please contact us immediately. Pagelists can now have optimized list=grouphomes and fmt=#grouphomes arguments to list only the home pages of your wiki groups, whether they are named Group.HomePage, Group.Group, or a custom Group.DefaultName. Minor bugs in older xlpage scripts were fixed, the responsive skin is now compatible with even older PmWiki/PHP versions, web subtitles (*.vtt) were added as an allowed extension, input form fields can now have a "title" attribute (usually rendered as a tooltip/help balloon when the mouse cursor is over the input element), and a configuration variable AuthLDAPReferrals was added for wikis running AuthUser over LDAP to force enable or disable referrals when needed. The documentation was updated. ## Version 2.2.102 (2017-08-05) This version reverts the patterns for text variables changed in 2.2.99, because we found that a longer text variable content may cause a blank page or an internal server error. In the page SiteAdmin.AuthList an input box was added to allow filtering of the groups or pages. ## Version 2.2.101 (2017-07-30) This version renames the internal constructor of the PageStore class to be compatible with both PHP 5 and PHP 7. Previously, the PageStore class had two constructors for PHP 4 and PHP 5 compatibility of which one was silently ignored, but recent PHP 7 versions display strict or deprecated notices when the PHP 4 constructor is used. If you must use PmWiki 2.2.101 or newer on a PHP 4 installation, please contact me so I can provide you with a workaround. ## Version 2.2.100 (2017-07-30) This version provides a workaround for an incompatibility with our Subversion version control system, where the Author wiki variable was considered a Subversion variable. A fix for the responsive skin adds some spacing above the WikiText block. The documentation was updated. ## Version 2.2.99 (2017-06-26) This version fixes a bug where an incomplete text variable without a closing parenthesis like "(:Var:Value" could hide the remaining of the page. A bug was fixed where previewing a page didn't show changes to be done by replace-on-save patterns (the function ReplaceOnSave was refactored). Markup rules for previewing author signatures are no longer needed and were removed. Note that if you had custom markup rules processed before or after the ~~~ or ~~~~ author signatures may need to be set to '<[[~' (second argument of the Markup call). A bug and a warning for PHP 4 installations were fixed. Two minor bugs with the [[<<]] line break for the responsive skin and the Version variable link in the documentation were fixed. The InterMap prefix to Wikipedia was corrected to use the secure HTTPS protocol and the documentation was updated. ## Version 2.2.98 (2017-05-31) This version adds a new skin that is better adaptable to both large and small screens, desktop and mobile devices (touchscreens). The new skin "pmwiki-responsive" is not enabled by default but available as an option, and as a base for customized copies. It requires a relatively modern browser (post-2009). The old skin is still available and enabled by default. The Vardoc links now use MakeLink() to allow a custom LinkPage function. The function ReplaceOnSave() was refactored to allow easier calling from recipes. Markup processing functions now can access besides pagename, a markupid variable that contains the "name" of the processed markup rule, allowing a single function to process multiple markup rules. The "*.mkv" video extension was added to the list of allowed uploads. A bug was fixed with the (:markup:) output where a leading space was lost. Note that the "markup" frame is now wrapped in a <pre> block with a "pre-wrap" style instead of <code>. A number of other (minor) bugs were fixed: see ChangeLog, and the documentation was updated. ## Version 2.2.97 (2017-04-07) This version fixes a bug concerning ScriptUrl when EnablePathInfo is set, introduced in 2.2.96 and reported by 3 users. ## Version 2.2.96 (2017-04-05) This version fixes a severe PHP code injection vulnerability, reported by Gabriel Margiani. PmWiki versions 2.2.56 to 2.2.95 are concerned. Only certain local customizations enable the vulnerability. Your website may be at risk if your local configuration or recipes call too early some core functions like CondAuth(), RetrievePageName() or FmtPageName(), before the pagename variable is sanitized by ResolvePageName() in stdconfig.php. A specific URL launched by a malicious visitor may trigger the vulnerability. Most recipes call core functions from a HandleActions function, or from a Markup expression rule, these do not appear to be affected by the current exploit. If your wiki may be at risk, it is recommended to upgrade to version 2.2.96 or most recent at the earliest opportunity. If you cannot immediately upgrade, you should place the following line in your local (farm)config.php file:  pagename = preg_replace('![{}\'"\\\\]+!', '', pagename);  Place this line near the top of the file but after you include scripts/xlpage-utf-8.php or other character encoding file. This version filters the pagename variable to exclude certain characters. A new variable pagename_unfiltered is added in case a recipe requires the previous behavior. The documentation was updated. ## Version 2.2.95 (2017-02-28) This is a documentation update version. ## Version 2.2.94 (2017-01-31) This version allows webmasters to configure and use both .html and .htm extensions. The cached information about whether a page exists or not will now be cleared when that page is created or deleted. The documentation was updated. ## Version 2.2.93 (2016-12-31) This is a documentation update version. ## Version 2.2.92 (2016-11-30) This version allows administrators to disable the "nopass" password by setting AllowPassword to false. The function FmtPageName() will now expand PageVariables with asterisks like {*FullName}. The documentation was updated. ## Version 2.2.91 (2016-09-30) This is a documentation update version. ## Version 2.2.90 (2016-08-31) This version adds a parameter to the upload form which can improve analytics from the server logs. Two new CSS classes were added to help skin developers: imgonly and imgcaption, for standalone embedded pictures with or without a caption. A bug with the plus-links was fixed. The documentation was updated. ## Version 2.2.89 (2016-07-30) This version allows to set a default class name for simple tables. The (:searchbox:) directive can now have a "placeholder" attribute, and the input type can be changed from "text" to "search" for HTML5 websites. The edit form elements have now identifier attributes to allow easier styling. All core scripts will now inject CSS into the skin only if it hasn't already been defined. The vardoc.php script now recognizes and links to the documentation for the variables pagename, Author and Skin. The documentation was updated. ## Version 2.2.88 (2016-06-29) This version fixes invalid HTML output of some WikiTrail links. The function PHSC() can now have an optional fourth argument for a safe replacement of htmlspecialchars(). A new page variable {SiteAdminGroup} was added and the documentation was updated. ## Version 2.2.87 (2016-05-31) This version adds the HTMLTagAttr variable to be used in the <html> tag in skins for additional attributes like "lang" or "manifest". To enable it, use it in your skin, for example:  <html xmlns="http://www.w3.org/1999/xhtml" HTMLTagAttr>  The variable EnableRevUserAgent, if set to 1, will cause the User-Agent string from browsers to be stored with each page history entry (as opposed to only storing the last user agent string). The output variable DiffUserAgent can be used in history templates like DiffStartFmt. A wrong page variable in Site.UploadQuickReference was corrected, and the documentation was updated. ## Version 2.2.86 (2016-04-28) This version adds updates for PHP 7, for the PageStore() class and for the DefaultPasswords default/unset definitions (no action should be needed upon upgrades). The documentation was updated. ## Version 2.2.85 (2016-03-31) This version adds Scalable Vector Graphics (*.svg, *.svgz) as allowed uploads and as embeddable picture extensions (with the html tag <img/>). The documentation was updated. ## Version 2.2.84 (2016-02-21) This version fixes "indent" and "outdent" styles for right-to-left languages. A new variable EnableLinkPlusTitlespaced allows "plus links" [[Link|+]] to display the "Spaced Title" of the page instead the "Title". The documentation was updated. ## Version 2.2.83 (2015-12-31) This is a documentation update version. ## Version 2.2.82 (2015-11-30) This version enables stripmagic() to process arrays recursively and updates the documentation. ## Version 2.2.81 (2015-10-31) This version fixes an inconsistency with single line page text variables. International wikis enabling UTF-8 will now be able to use the CSS classes "rtl" and "ltr" to override the text direction when inserting right to left languages. The documentation was updated. ## Version 2.2.80 (2015-09-30) This version modifies the (:searchbox:) directive to use type="search" semantic input, and updates the documentation. ## Version 2.2.79 (2015-08-27) This version adds WikiStyles for the CSS basic colors "fuchsia", "olive", "lime", "teal", "aqua", "orange" and "gray"/"grey". New input elements "email", "url", "number", "date", and "search" can now be used in wiki forms. Note: the "target" attribute of input forms which was added in the previous version broke the PmForm processor, and was removed until we find a solution. If you don't use PmForm and require this attribute (or others), the usual way to add it is to redefine the InputAttrs array in your local configuration. A new variable EnableROSEscape can be set to 1 if ROSPatterns and ROEPatterns should not process source text wrapped with [=...=] or [@...@]. By default "replace on edit" patterns are performed even in such text. The insMarkup() function in guiedit.js was refactored to allow custom input ids and/or custom functions to process the selected text. The documentation was updated. ## Version 2.2.78 (2015-07-21) This version updates the RobotPattern list with currently active user agents. Input forms can have a "target" attribute (removed in 2.2.79). The documentation was updated. Note, this release broke the Cookbook:PmForm module. Please do upgrade to 2.2.79 or newer if your wiki uses PmForm. ## Version 2.2.77 (2015-06-19) This version extends the (:if attachments:) conditional to specify file and page names. A {WikiTitle} page variable was added. A MatchNames() function was introduced as a generic way to match array values the same way MatchPageNames() does currently with lists of pages -- recipe authors can use it to get a subset of attachments for example. The PageStore() class was slightly optimized when recoding pages from-to UTF-8. The documentation was updated. ## Version 2.2.76 (2015-05-31) This version improves support for arrays in form elements: setting default values and recovering values from posted forms. A new "label" argument to checkbox and radio input elements allows easy insertion of clickable text labels after the form elements. Division blocks wrapping standalone images, and standalone image captions, now receive CSS classes allowing greater control via stylesheets. The documentation was updated. ## Version 2.2.75 (2015-04-26) This version adds a pmcrypt(pass, salt) function which can be used as a replacement for the PHP crypt() function when encrypting passwords. From PHP 5.6 on, crypt() should not be used without a salt parameter and would raise a notice. If pmcrypt() is called with a salt parameter it will simply call crypt() in order to check a password. If it is called without a salt parameter, pmcrypt() will create a password hash with the password_hash() function or with crypt() depending on your installation. You can replace any calls to crypt() with pmcrypt(), notably in config.php when defining DefaultPasswords entries. Markup was added for the semantic HTML5 tags article, section, nav, header, footer, aside, address. A bug with the uploads feature was fixed when EnableReadOnly is set, and the documentation was updated. ## Version 2.2.74 (2015-03-28) This version allows the translation of the word "OK" in authentication forms. The documentation was updated to the latest state on pmwiki.org. ## Version 2.2.73 (2015-02-28) This release only updates the documentation to the latest state on pmwiki.org. ## Version 2.2.72 (2015-01-27) This version improves the ?action=ruleset display for markup rules potentially incompatible with PHP 5.5 when the function debug_backtrace() is not available. It restores the ability to set a custom function handling the (:markup:) demos. A variable AbortFunction was added allowing administrators to override the core Abort() function. The documentation was updated. ## Version 2.2.71 (2014-12-29) This version removes the hard word wrap in (:markup:) wikicode examples, and instead of <pre> tags, it wraps it in <code> tags. This allows newcomers to copy and paste the code in their wikis without inserted line breaks (which often cause the markup to not work). The release also adds back-tracing for markup rules potentially incompatible with PHP 5.5. Such rules, often added by recipes, can trigger "Deprecated: preg_replace()" warnings. To find out which recipes may trigger the warnings, enable diagnostic tools in config.php with EnableDiag = 1; then open a page with the 'ruleset' action, eg. [[HomePage?action=ruleset]]. The PHP-5.5-incompatible rules will be flagged with filenames, line numbers and patterns. See also the pages Troubleshooting and CustomMarkup on pmwiki.org. The variable DraftActionsPattern was added, the pagelist "request" parameter can now contain a list of allowed or disallowed parameters that can be overridden by the user, the "input default source" parameter can now contain multiple pages, and a minor bug was fixed in upload.php ('strict' warning). See the updated documentation for more information. ## Version 2.2.70 (2014-11-08) This release only updates the documentation to the latest state on pmwiki.org. ## Version 2.2.69 (2014-10-13) This version fixes a bug when dates are defined as relative to other dates, eg. "2014-10-13 -3 days". The documentation was updated; note that the instructions in Site.UploadQuickReference were updated to reflect the display of the upload form in current browsers. ## Version 2.2.68 (2014-09-01) This version adds a Skins: InterMap prefix pointing to the Skins section on PmWiki.org, a "signature" markup in the edit quick reference, new WikiStyles clear, min-width and max-width and the documentation was updated. ## Version 2.2.67 (2014-08-02) This version fixes an inconsistency with input forms when values are taken from PageTextVariables. The documentation was updated to the latest state on pmwiki.org. ## Version 2.2.66 (2014-07-02) This version fixes a minor longstanding bug in the default Notification format when a page is deleted. In custom patterns, the "_" character will no longer be considered a function name. The documentation was updated. ## Version 2.2.65 (2014-06-07) This version fixes Pagelist handling of {$$PseudoVars} when they contain page variables. File permissions handling was improved when the current directory is owned by "root". The documentation was updated. ## Version 2.2.64 (2014-05-08) This version adds the "{(mod)}" markup expression for modulo/remainder calculations, and the "tel:" and "geo:" URI schemes which, on compatible devices like smartphones, allow the creation of links to dial telephone numbers and open map/location applications. The$SysMergePassthru switch was added, if enabled, it allows the "Simultaneous Edits" conflict resolution to use the passthru() function instead of popen().

The documentation was updated.

  $EnableUndefinedTemplateVars = 1; # keep and display unset {$$variables}  PageList templates now accept the sections  !first  and  !last  for markup to appear for every page in list except the first or last one. "Title" attributes were added to external links. You can have tooltip titles on external links, including InterMap and attachments, by adding the link title in double quotes after the URL:  [[http://www.pmwiki.org"Home of PmWiki"| External link]]  For international wikis, PmWiki now automatically translates the titles of technical pages like GroupAttributes or RecentChanges -- just define these strings as usual in XLPage, for example, in French:  'AllRecentChanges' => 'Tous les changements récents',  Some minor optimizations were done and the documentation was updated. ## Version 2.2.13 (2010-02-21) This release fixes a bug with DiffKeepNum introduced in 2.2.10 -- the count of revisions was incorrect and a page could drop more revisions than it should. The page history layout was modified with a rough consensus in the community. The history now defaults to "source" view with word-level highlighting of the differences. Authors can see the changes in rendered output by clicking on the link "Show changes to output". Admins can switch back the default by adding such a line to config.php:  DiffShow['source'] = (@_REQUEST['source']=='y')?'y':'n';  To disable word-level highlighting and show plain text changes:  EnableDiffInline = 0;  In the page history rendering, a few minor bugs were fixed and the code was slightly optimized. The documentation was updated. ## Version 2.2.12 (2010-02-17) This release adds simple word-level highlighting of differences in the page history, when "Show changes to markup" is selected. To enable the feature, add to config.php such a line:  EnableDiffInline = 1;  This feature is like what the InlineDiff recipe provides, but not exactly the same, and the implementation is simpler. It is enabled on PmWiki.org and can be improved -- your comments are welcome. ## Version 2.2.11 (2010-02-14) This release adds two new table directives for header cells, (:head:) and (:headnr:). They work the same way as (:cell:) and (:cellnr:) except that create <th> instead of <td> html tags. The pagerev.php script was refactored into separate functions to allow easier integration of recipes displaying the page history. A couple of minor bugs were fixed and the documentation was updated. ## Version 2.2.9, 2.2.10 (2010-01-17) Most important in this release is the official change of EnableRelativePageVars to 1. The change is about how {Variable} in included pages is understood by PmWiki. So, if your wiki relies on page variables from included pages, and doesn't have EnableRelativePageVars set to 1, after upgrading to 2.2.9, you can revert to the previous behavior by adding to config.php such a line:  EnableRelativePageVars = 0;  More information about page variables can be found at:  http://www.pmwiki.org/wiki/PmWiki/PageVariables  This release adds a new variable EnablePageTitlePriority which defines how to treat multiple (:title..:) directives. If set to 1, the first title directive will be used, and if a page defines a title, directives from included pages cannot override it. PmWiki default is 0, for years, the last title directive was used (it could come from an included page or GroupFooter). This release also adds a new variable DiffKeepNum, specifying the minimum number (default 20) of edits that will be kept even if some of them are older than the limit of DiffKeepDays. A number of bugs were fixed and the documentation was updated. ## Version 2.2.8 (2009-12-07) This release fixes another PHP 5.3 compatibility issue with conditional markup. The Author field now handles apostrophes correctly. The documentation was updated. ## Version 2.2.7 (2009-11-08) This release fixes most PHP 5.3 compatibility issues. Unfortunately some specific builds for Windows may still have problems, which are unrelated to PmWiki. Notably, on Windows, all passwords need to be 4 characters or longer. Upload names with spaces are now correctly quoted. The documentation was updated. ## Version 2.2.6 (2009-10-04) With this release it is now possible to display recently uploaded files to the RecentChanges pages -- if you have been using the RecentUploadsLog recipe, please uninstall it and follow the instructions at http://www.pmwiki.org/wiki/Cookbook/RecentUploadsLog. The release also introduces MakeUploadNamePatterns to allow custom filename normalization for attachements. It is now possible to replace PageListFilters and FPLTemplateFunctions with custom functions. Notify should now work in safe_mode. Some bugs were fixed, among which one with conditional markup with dates. The documentation was updated. ## Version 2.2.5 (2009-08-25) This release adds a new markup for Pagelist templates, (:template none:) which allows a message to be set when the search found no pages. The FPLTemplate() function was broken into configurable sub-parts to allow development hooks. A number of bugs were fixed, and the documentation was updated. ## Version 2.2.4 (2009-07-16) This release fixes a bug introduced earlier today with HTML entities in XLPages. ## Version 2.2.3 (2009-07-16) This release fixes six potential XSS vulnerabilities, reported by Michael Engelke. The vulnerabilities may affect wikis open for editing and may allow the injection of external JavaScripts in their pages. Public open wikis should upgrade. A new variable EnableUploadGroupAuth was added; if set to 1, it allows password-protected uploads to be checked against the Group password. It is now possible to use  @_site_edit, @_site_read, @_site_admin or  @_site_upload  global passwords in GroupAttributes pages. A number of other small bugs were fixed, and the documentation was updated. ## Version 2.2.2 (2009-06-21) The major news in this release is a fix of an AuthUser vulnerability. The vulnerability affects only wikis that (1) rely on the AuthUser core module for User:Password authentication, -AND- (2) where the PHP installation runs with the variable "magic_quotes_gpc" disabled. All PmWiki 2.1.x versions from pmwiki-2.1.beta6 on, all 2.2.betaX, 2.2.0, and 2.2.1 are affected. The PmWiki SiteAnalyzer can detect if your wiki needs to upgrade:  http://www.pmwiki.org/wiki/PmWiki/SiteAnalyzer  If your wiki is vulnerable, you should do one of the following at the earliest opportunity: • Upgrade to a version of PmWiki at least 2.2.2 or greater. • Turn on magic_quotes_gpc in the php.ini file or in a .htaccess file. Alternatively, you can temporarily disable AuthUser until you upgrade. Note that even if your wiki does not have the AuthUser vulnerability at the moment, you are strongly encouraged to upgrade to PmWiki version 2.2.2 or later, as some future configuration of your hosting server might put you at risk. This release also comes with minor updates in the local documentation; fixes were applied for international wikis - notably global variables in xlpage-utf-8.php and a new variable EnableNotifySubjectEncode, which allows e-mail clients to correctly display the Subject header; and a number of other small bugs were fixed. ## Version 2.2.1 (2009-03-28) This release comes with an updated local documentation; wiki trails now work cross-group; guiedit.php now produces valid HTML, and other small bugs were fixed. We also added EnableRedirectQuiet, which allows redirects to take place without any mention of "redirected from page ....". ## Version 2.2.0 (2009-01-18) This is a summary of changes from 2.1.x to 2.2.0. • Several pages that were formerly in the Site.* group are now in a separate SiteAdmin.* group, which is read-restricted by default. The affected pages include Site.AuthUser, Site.AuthList, Site.NotifyList, Site.Blocklist, and Site.ApprovedUrls . If upgrading from an earlier version of PmWiki, PmWiki will prompt to automatically copy these pages to their new location if needed. If a site wishes to continue using the old Site.* group for these pages, simply set SiteAdminGroup = SiteGroup; when carrying out this upgrade inspect your config files for lines such as BlocklistDownload['Site.Blocklist-PmWiki'] = array('format' => 'pmwiki'); as you may wish to fix then, eg BlocklistDownload[SiteAdminGroup . '.Blocklist-PmWiki'] = array('format' => 'pmwiki'); • Important Change in Passwords in PmWiki 2.2 indicating that the group can be edited even if a site password is set will be done by "@nopass" prior it was done by "nopass" When migrating a wiki you will have to manually modify the permission or by a script replace in all the page concerned passwdread=nopass: by passwdread=@nopass (see PITS:00961) --isidor • PmWiki now ships with WikiWords entirely disabled by default. To re-enable them, set either LinkWikiWords or EnableWikiWords to 1. To get the 2.1 behavior where WikiWords are spaced and parsed but don't form links, use the following: • It's now easy to disable the rule that causes lines with leading spaces to be treated as preformatted text -- simply set EnableWSPre=0; to disable this rule. Important: There is ongoing discussion that the leading whitespace rule may be disabled by default in a future versions of PmWiki. If you want to make sure that the rule will continue to work in future upgrades, set EnableWSPre=1; in local/config.php. • The ROSPatterns variable has changed somewhat -- replacement strings are no longer automatically passed through FmtPageName() prior to substitution (i.e., it must now be done explicitly). • Page variables and page links inside of (:include:) pages are now treated as relative to the included page, instead of the currently browsed page. In short, the idea is that links and page variables should be evaluated with respect to the page in which they are written, as opposed to the page in which they appear. This seems to be more in line with what authors expect. There are a number of important ramifications of this change: • We now have a new {*var} form of page variable, which always refers to "the currently displayed page". Pages such as Site.PageActions and Site.EditForm that are designed to work on "the currently browsed page" should generally switch to using {*FullName} instead of {FullName}. • The EnableRelativePageLinks and EnableRelativePageVars settings control the treatment of links and page variables in included pages. However, to minimize disruption to existing sites, EnableRelativePageVars defaults to disabled. This will give existing sites an opportunity to convert any absolute {var} references to be {*var} instead. • Eventually EnableRelativePageVars will be enabled by default, so we highly recommend setting EnableRelativePageVars = 1; in local/config.php to see how a site will react to the new interpretation. Administrators should especially check any customized versions of the following: SideBar pages with ?action= links for the current page GroupHeaderFmt, GroupFooterFmt Page lists that refer to the current group or page, etc in sidebars, headers, and footers • The (:include:) directive now has a basepage= option whereby an author can explicitly specify the page upon which relative links and page variables should be based. If no basepage= option is specified, the included page is assumed to be the base. • Sites that want to retain the pre-2.2 behavior of (:include:) and other items can set Transition['version'] = 2001900; to automatically retain the 2.1.x defaults. • Text inserted via (:include:) can contain "immediate substitutions" of the form {$$option} -- these are substituted with the value of any options provided to the include directive. • PmWiki now recognizes when it is being accessed via "https:" and switches its internal links appropriately. This can be overridden by explicitly setting$ScriptUrl and $PubDirUrl. • A new $EnableLinkPageRelative option allows PmWiki to generate relative urls for page links instead of absolute urls.
• Draft handling capabilities have been greatly improved. When $EnableDrafts is set, then the "Save" button is relabeled to "Publish" and a "Save draft" button appears. In addition, an$EnablePublishAttr configuration variable adds a new "publish" authorization level to distinguish editing from publishing. See PmWiki:Drafts for more details.

• There is a new {$:var} "page text variable" available that is able to grab text excerpts out of markup content. For example, {SomePage$:Xyz} will be replaced by a definition of "Xyz" in SomePage. Page text variables can be defined using definition markup, a line beginning with the variable name and a colon, or a special directive form (that doesn't display anything on output):
:Xyz: some value            # definition list form
Xyz: some value             # colon form
(:Xyz: some value:)         # directive form


• The (:pagelist:) command can now filter pages based on the contents of page variables and/or page text variables. For example, the following directive displays only those pages that have an "Xyz" page text variable with "some value":
(:pagelist $:Xyz="some value":) Wildcards also work here, thus the following pagelist command lists pages where the page's title starts with the letter "a": (:pagelist$Title=A* :)
• The if= option to (:pagelist) can be used to filter pages based on conditional markup:
(:pagelist if="auth upload {=$FullName}":) pages with upload permission (:pagelist if="date today.. {=$Name}":) pages with names that are dates later than today
• Spaces no longer separate wildcard patterns -- use commas. (Most people have been doing this already.)
• Because page variables are now "relative", the {$PageCount}, {$GroupCount}, {$GroupPageCount} variables used in pagelist templates are now {$$PageCount}, {$$GroupCount}, {$$GroupPageCount}. • One can now use {$$option} in a pagelist template to obtain the value of any 'option=' provided to the (:pagelist:) command. • The (:pagelist:) directive no longer accepts parameters from urls or forms by default. In order to have it accept such parameters (which was the default in 2.1 and earlier), add a request=1 option to the (:pagelist:) directive. • The count= option to pagelists now accepts negative values to count from the end of the list. Thus count=5 returns the the first five pages in the list, and count=-5 returns the last five pages in the list. In addition, ranges of pages may be specified, as in count=10..19 or count=-10..-5. • Pagelist templates may have special (:template first ...:) and (:template last ...:) sections to specify output for the first or last page in the list or a group. There's also a (:template defaults ...:) to allow a template to specify default options. • PmWiki comes with an ability to cache the results of certain (:pagelist:) directives, to speed up processing on subsequent visits to the page. To enable this feature, set $PageListCacheDir to the name of a writable directory (e.g., work.d/).
• The (:if ...:) conditional markup now also understands (:elseif ...:) and (:else:). In addition, markup can nest conditionals by placing digits after if/elseif/else, as in (:if1 ...), (:elseif1 ...:), (:else1:), etc.
• The (:if date ...:) conditional markup can now perform date comparisons for dates other than the current date and time.
• WikiTrails can now specify #anchor identifiers to use only sections of pages as a trail.
• A new (:if ontrail ...:) condition allows testing if a page is listed on a trail.
• The extensions .odt, .ods, and .odp (from OpenOffice.org) are now recognized as valid attachment types by default.
• A new blocklist capability has been added to the core distribution. It allows blocking of posts based on IP address, phrase, or regular expression, and can also make use of publicly available standard blocklists. See PmWiki.Blocklist for details.
• There is a new SiteAdmin.AuthList page that can display a summary of all password and permissions settings for pages on a site. This page is restricted to administrators by default.
• There are new {$PasswdRead}, {$PasswdEdit}, etc. variables that display the current password settings for a page (assuming the browser has attr permissions or whatever permissions are set in $PasswdVarAuth). • Forms creation via the (:input:) markup has been internally refactored somewhat (and may still undergo some changes prior to 2.2.0 release). The new (:input select ...:) markup can be used to create select boxes, and (:input default ...:) can be used to set default control values, including for radio buttons and checkboxes. • The (:input textarea:) markup now can take values from other sources, including page text variables from other pages. • Specifying focus=1 on an (:input:) control causes that control to receive the input focus when a page is loaded. If a page has multiple controls requesting the focus, then the first control with the lowest value of focus= "wins". • PmWiki now provides a scripts/creole.php module to enable Creole standard markup. To enable this, add include_once('scripts/creole.php') to a local customization file. • PmWiki adds a new {(...)} markup expression capability, which allows various simple string and data processing (e.g., formatting of dates and times). This is extensible so that recipe authors and system administrators can easily add custom expression operators. • It's now possible to configure PmWiki to automatically create Category pages whenever a page is saved with category links and the corresponding category doesn't already exist. Pages are created only if the author has appropriate write permissions into the group. To enable this behavior, add the following to local/config.php: $AutoCreate['/^Category\\./'] = array('ctime' => $Now); • Sites with wikiwords enabled can now set$WikiWordCount['WikiWord'] to -1 to indicate that 'WikiWord' should not be spaced according to $SpaceWikiWords. • WikiWords that follow # or & are no longer treated as WikiWords. • Links to non-existent group home pages (e.g., [[Group.]] and [[Group/]]) will now go to the first valid entry of $PagePathFmt, instead of being hardcoded to "Group.Group". For example, to set PmWiki to default group home pages to $DefaultName, use $PagePathFmt = array('{$Group}.$1', '$1.{$DefaultName}', '$1.$1');`
• PmWiki now provides a $CurrentTimeISO and$TimeISOFmt variables, for specifying dates in ISO format.
• Cookbook authors can use the internal PmWiki function UpdatePage (temporarily documented at DebuggingForCookbookAuthors) to change page text while preserving history/diff information, updating page revision numbers, updating RecentChanges pages, sending email notifications, etc.
• Skin templates are now required to have <!--HTMLHeader--> and <!--HTMLFooter--> directives. Setting $EnableSkinDiag causes PmWiki to return an error if this isn't the case for a loaded skin. Skins that explicitly do not want HTMLHeader or HTMLFooter sections can use <!--NoHTMLHeader--> and <!--NoHTMLFooter--> to suppress the warning. • Added a new "pre" wikistyle for preformatted text blocks. • The xlpage-utf-8.php script now understands how to space UTF-8 wikiwords. • Searches on utf-8 site are now case-insensitive for utf-8 characters. • Many Abort() calls now provide a link to pages on pmwiki.org that can explain the problem in more detail and provide troubleshooting assistance. • PmWiki no longer reports "?cannot acquire lockfile" if the visitor is simply browsing pages or performing other read-only actions. • The$EnableReadOnly configuration variable can be set to signal PmWiki that it is to run in "read-only" mode (e.g., for distribution on read-only media). Attempts to perform actions that write to the disk are either ignored or raise an error via Abort().
• Including authuser.php no longer automatically calls ResolvePageName().
• Authentication using Active Directory is now simplified. In Site.AuthUser or the \$AuthUser variable, set "ldap://name.of.ad.server/" with no additional path information (see PmWiki.AuthUser for more details).
• Pages are now saved with a "charset=" attribute to identify the character set in effect when the page was saved.
• The phpdiff.php algorithm has been optimized to be smarter about finding smaller diffs.
• Removed the (deprecated) "#wikileft h1" and "#wikileft h5" styles from the pmwiki default skin.
• The mailposts.php and compat1x.php scripts have been removed from the distribution.

Bugs and other requests can be reported to the PmWiki Issue Tracking System at http://www.pmwiki.org/wiki/PITS/PITS. Any help in testing, development, and/or documentation is greatly appreciated..

Release Notes archive - notes for versions older than 2.2.0.