Foswiki Release 1.0.10 - 08 Sep 2010

Foswiki - The Free and Open Source Wiki

Foswiki is an enterprise collaboration and information sharing tool targeted for professional use in many types of companies: from small businesses to large organizations.

Foswiki is a wiki: fundamentally, a website with editable web pages. It looks like a normal web site but it encourages contributions, edits, updates, questions, and answers from its users. It's a powerful way of enabling a community to communicate asynchronously using intranet and public internet websites. Foswiki is simple to learn and use. It aims to provide a transparent way for you to publish and exchange your ideas with others over the web and eliminates the one-webmaster syndrome of outdated intranet content.

Foswiki is a structured wiki with tools that enable users without programming skills to build powerful yet simple applications to process information and support workflows. Developers can extend the functionality of Foswiki with plugins.

Foswiki is the old TWiki project under a new name. Restrictions on the use of the TWiki brand resulted in many of its developers continuing the project under the new Foswiki name. Foswiki is backwards compatible with all content from older TWiki installations. Foswiki 1.0 ships with a TWikiCompatibilityPlugin installed and activated by default, thus enabling most extensions made for TWiki to work under Foswiki. Foswiki is released under the GNU General Public License.

Foswiki 1.0 Releases

• Foswiki 1.0.0, the first Foswiki was released on 09 Jan 2009.
• Foswiki 1.0.1 was released internally in the development community 23 Feb 2009 but we found a few important bugs that made us decide not to publish it and instead release a 1.0.2. It is a patch release with around 70 bug fixes and only very few minor enhancements.
• Foswiki 1.0.2 was built 25 Feb 2009 and again we decided to stop the publishing for quality reasons because of one important bug.
• Foswiki 1.0.3 was built 28 Feb 2009. We decided to stop the publishing because of a severe bug in EditTablePlugin introduced in 1.0.1 when fixing another bug.
• Foswiki 1.0.4 was built 19 Mar 2009. It is a patch release with more than 120 bug fixes relative to 1.0.0 and only very few minor enhancements.
• Foswiki 1.0.5 was built 25 Apr 2009. It is a patch release with more than 150 bug fixes relative to 1.0.0 and a few enhancements. This patch release further enhances the robustness and the security of the Foswiki software.
• Foswiki 1.0.6 was built 21 Jun 2009. It is a patch release with more than 200 bug fixes relative to 1.0.0 and some enhancements. This version introduces a major enhancement in security against Cross-Site Request Forgery. Further more a central translation framework got introduced which ease the translation process and enables all users to contribute to translations.
• Foswiki 1.0.7 was built 20 Sep 2009. It is a patch release with more than 240 bug fixes relative to 1.0.0 and some enhancements. This release fixes some serious issues introduced by the CSRF fix and the redirect cache fix in 1.0.6. Major enhancement that also fixes many annoying editor bugs is the upgrade of the Tiny MCE editor to version 3.2.2.
• Foswiki 1.0.8 was built 29 Nov 2009. It is a patch release with more than 280 bug fixes relative to 1.0.0 and some enhancements. This release fixes a short list of quite annoying old bugs incl a bug that prevented efficient use of MailerContrib for producing newsletters. The Wysiwyg editor has been upgraded with the latest Tiny MCE editor release 3.2.7.
• Foswiki 1.0.9 was built 17 Jan 2010. It is a patch release with more than 320 bug fixes relative to 1.0.0 and several enhancements. This release fixes many bugs in the Wysiwyg editor, bugs related to more advanced wiki applications and bugs in the Plugin API. It contains several bug fixes and enhancements related to security and spam fighting.
• Foswiki 1.0.10 was built 08 Sep 2010 as a patch release with more than 410 bug fixes relative to 1.0.0. It is assumed to be the last 1.0.X release.

Pre-installed Extensions

Foswiki 1.0 is shipped with the following:

• Plugins: CommentPlugin, EditTablePlugin, EmptyPlugin, InterwikiPlugin, PreferencesPlugin, RenderListPlugin, SlideShowPlugin, SmiliesPlugin, SpreadSheetPlugin, TablePlugin, TinyMCEPlugin, TwistyPlugin, WysiwygPlugin
• Contribs: BehaviourContrib, JSCalendarContrib, MailerContrib, TipsContrib, TopicUserMappingContrib
• Skins: PatternSkin
• Compatibility support - TWikiCompatibilityPlugin

What's new — highlights

• Foswiki 1.0 is built on a new platform called Foswiki Stand Alone which adds support for FastCGI and enables more optimized functionality in mod_perl and other similar runtime environments. Foswiki Stand Alone also enables future features such as running Foswiki by itself without a separate web server (for example, from a memory stick). You can ensure your applications and plugins will work properly on the new platform (and thus with any future capabilities dependent on the new architecture) by testing them out now with Foswiki 1.0.
• A TWikiCompatibilityPlugin has been created that enables most extensions made for TWiki to work under Foswiki, and to support seamless migrations from TWiki to Foswiki.
• The PatternSkin has been given a facelift: The PatternSkin topic offers a choice of multiple themes, the sidebar can be placed either on the left or right, a frame can be added around the main content area, and a TWiki theme is available to make it easier for those upgrading from TWiki (dimensions such as the top bar size match the dimensions in the TWiki PatternSkin).
• The "Advanced Search" page now supports a query-based search.
• A new section type, "expandvariables", adds better control over macro expansion in topic templates. You can now create template topics with sections where all macros contained within the sections are expanded.
• A "Copy topic" feature is now present in the "More topic actions" tools.
• IF conditions have been expanded with an "isempty" test condition.
• viewfile script can be used as a webserver ErrorDocument enabling both more secure attachments and user focused error dialogs.
• The Foswiki tgz / zip distribution file now has a top-level directory — Foswiki-x.y.z (x.y.z representing the version) — in which all of its files and subdirectories are contained.

Security Updates

• Foswiki 1.0 has secured the powerful but also vulnerable URLPARAM macro against cross site scripting (XSS) attacks. URLPARAM now by default encodes a short list of unsafe characters '"<>% which eliminates most XSS possibilities encountered with URLPARAM. This protects all topics using the URLPARAM macro without requiring any changes to them.
• Functions QUERYPARAMS, ORIGURL (skin macro) are secured against XSS attacks. QUERYPARAMS, like URLPARAM, is now encoded with the new, safe encoding.
• The print preview link is no longer vulnerable to XSS attacks.
• Additional security fixes have been made, based on security audits performed by the Foswiki team. Sensitive data from the topic text and web client requests are validated for safety.
• From Foswiki 1.0.5 an additional security feature has been added so that saving data now requires the http method POST.
• Foswiki 1.0.6 introduces a major security enhancement, protecting against Cross-Site Request Forgery. The extra safe "double submit" algorithm, as recommended by the Open Web Application Security Project (OWASP) project has been used. This is the same algorithm used by several major banks and other security-conscious institutions, and requires that users have Javascript enabled.

See Foswiki:Support.SecurityFeatures for more information on these, and other, Foswiki security features. This is recommended reading for all Foswiki administrators.

• Foswiki 1.0.7 extends the strikeone protection to also include attachment of files
• Foswiki 1.0.9 extends the strikeone protection to also include user registration. Default minimum password length is now 7 characters (does not apply when upgrading)

Upgrading From TWiki

Foswiki is compatible with content generated using TWiki releases up to and including 4.3.1, as part of its design. This compatibility is at the disk file level, and means that upgrading from TWiki is easy and reliable.

As part of the creation of the Foswiki project, the Foswiki community is evaluating all of the hundreds of extensions that are available for TWiki. All that are working are ported over to the Foswiki name space. Many of them are being enhanced through the removal of bugs and security vulnerabilities, resulting in better, more functional plugins for Foswiki. The most popular plugins are already ported and more are added every day.

Terminology changes from TWiki

As part of the first Foswiki product release, various topics and terms were changed to avoid using the TWiki brand name and to more accurately reflect their purpose, including the following:

• The TWiki web is now called System, as it contains configuration information for the entire Foswiki installation. The TWikiCompatibilityPlugin provides backwards compatible support for references to the TWiki web, in order to facilitate migrations from TWiki to Foswiki.
• The %TWIKIWEB% and %MAINWEB% variables are now called %SYSTEMWEB% and %USERSWEB%
• Topics in the Foswiki distribution have been renamed to eliminate the TWiki word and to make the titles more readable (for example, Plugins, Skins, and so forth).
• All templates, CSS and Javascript names have been changed from twikiXxxxx to foswikiXxxxx
• Key terminology changes:

Topic names changed in System web (former TWiki web)

TWikiPlannedFeatures, TWikiReleaseNotes04x00, TWikiSite, and WhatDoesTWikiStandFor have been removed.

Topic names changed in Main web

These changes have the following consequences when upgrading from TWiki to Foswiki:

• You can either continue to use TWikiAdminGroup as your administrators group, or migrate your admin users to the Main.AdminGroup topic.
• The users in the TWikiUsers topic must be merged into the Main.WikiUsers topic.
• Your site preference settings from Main.TWikiPreferences must be copied to the Main.SitePreferences topic.

Please see UpgradeGuide#CopyUsersAndCustomizations for more information.

Important Changes since Foswiki 1.0.9

This release is expected to be the final bug fixing release for foswiki 1.0, and wraps up about 70 fixes found since 1.0.9.

Importantly, this release fixes an issue running configure on Perl 5.12, improves compatibility with proxy and enterprise search indexers, and updates the shipped plugins to the latest versions.

It resolves a number of issues for running foswiki on MS Windows.

Important Changes since Foswiki 1.0.8

This release fixes some of the new bugs that Tiny MCE Editor 3.2.7 introduced in previous release. This relates to bugs that are only seen in specific browser versions but are quite annoying to the users affected. This upgrade will improve the Wysiwyg experience.

The release includes many more minor bug fixes seen only by very advanced application developers and plugin developers.

It contains several bug fixes and enhancements related to security and spam fighting. The very advanced strikeone CSRF protection that was introduced in 1.0.6 has now also been implemented to make it harder to create registration bots. Reset of password and change of email address features are now both strike one protected and you can no longer change to an empty email address. Additionally logging has been added enabling the administrator to see both old and new email address after an email address change.

Default password length is now 7 instead of 1 character. Upgraders will be not be affected by this as the current used setting will already be in the LocalSite.cfg file.

A rare race condition has been identified where .htpasswd files could be truncated on a very busy site or during a spam robot attack. Foswiki now uses a file locking with a semaphore file to efficiently protect .htpasswd file from ever being changed by more than one process at a time.

Important Changes since Foswiki 1.0.7

The Wysiwyg editor is now using Tiny MCE editor version 3.2.7

The mailnotify feature has been fixed/enhanced so you can run newsletter in both 'changes' and 'news' mode so you can use the feature to automatically send newsletters independant of the normal change notices

Important Changes since Foswiki 1.0.6

The Wysiwyg editor has been upgraded to using Tiny MCE editor version 3.2.2 which solves many editor related bugs. The pickaxe icon has been replaced by a "Wiki Text" button as the pickaxe was hard to guess the function of. And the editor now has a full screen editing feature.

Several bugs fixed related to the Cross-Site Request Forgery feature.

Cross-Site Request Forgery feature has been enhanced to also protect against unwanted attachment of files

TablePlugin sorts numbers and dates better

EditTablePlugin handles SpreadSheetPlugin in footer rows correctly

Fixed a problem where Windows installations of Foswiki would create new users with non-working passwords

"Managing webs" feature redesigned for better usability

Important Changes since Foswiki 1.0.5

A major security enhancement against Cross-Site Request Forgery has been added. See Security Updates above.

EditTablePlugin has been through a major rewrite fixing many bugs and making it work much better with SpreadSheetPlugin.

Three new standard escapes $lt, $gt and $amp have been introduced to be used in formatted searches and other places that supports escapes in a format parameter.

A new footer parameter has been added to SEARCH

Two new parameters $ntopics and $nhits can be used in formatted searches to show the number of found items.

Important Changes since Foswiki 1.0.4

An additional security feature has been added so that saving data now requires the http method POST. This means that it is no longer possible to store data via an "<a href=..." link or img tag. It also means that if you have an application with an HTML form that creates new topics you must specify in the form tag method="post". This change is done to further tighten the security of Foswiki.

<form name="new" action="%SCRIPTURLPATH{save}%/Sandbox/" method="post">
    ...
</form>

The template webs _default and _empty are frequent targets for spammers because these webs are normally not monitored very carefully by the community around a Foswiki installation. These webs are now write protected so on an administrator can edit topics in these webs. When an administrator creates a new web it is important to remember to remove the access restriction from the WebPreferences in the new web.

SpreadSheetPlugin now has the new functions: $EMPTY(), $LEFTSTRING(), $RIGHTSTRING(), SUBSTRING(), $INSERTSTRING()

Important Changes since Foswiki 1.0.0

Fixed 70 bugs since Foswiki 1.0.0. Quite many of these are bugs that originate from TWiki 4.2.3. The most important bugs are

• Fixed some bugs related to expired sessions and date in session cookies.
• Fixed a number of bugs in configure related to installation of extensions
• Fixed a bug that prevented proper operation with https
• Fixed a bug related to VIEW_TEMPLATE and preview
• Fixed a bug related to RcsLite corrupting topic history
• Enhanced the user interface of configure
• Added approx. 30 more bugs to the list of bugs fixed in 1.0.0 that we missed in the 1.0.0 version of these release notes.
• Foswiki ships with {Sessions}{UseIPMatching} disabled by default now because the problems are getting bigger than the minimal security it gives

See full list of fixed bugs below.

Important Changes since TWiki 4.2.3

If this release had been a TWiki release it would have been 4.3.0

Since the fork of Foswiki happened while TWiki 4.2.3 was the current release, all changes since this release are listed below.

Foswiki Release 1.0.0 Details

Fixes

Enhancements

Foswiki Patch Release 1.0.1 Details

Fixes

Enhancements

Foswiki Patch Release 1.0.2 Details

Fixes

Enhancements

None

Foswiki Patch Release 1.0.3 Details

Fixes

Enhancements

None

Foswiki Patch Release 1.0.4 Details

Fixes

Enhancements

Foswiki Patch Release 1.0.5 Details

Fixes

Enhancements

Foswiki Patch Release 1.0.6 Details

Fixes

Enhancements

Foswiki Patch Release 1.0.7 Details

Fixes

Enhancements

Item310	Managing webs redesigned for better usability.
Item400	unit test runner should be more magical
Item1793	remove topic summary in list of backlinks in rename-topic
Item2070	Upgrade TinyMCE editor to v 3.2.2
Item8114	Replace the pickaxe icon by something more meaningful

Foswiki Patch Release 1.0.8 Details

Fixes

Enhancements

Foswiki Patch Release 1.0.9 Details

Fixes

Enhancements

Foswiki Patch Release 1.0.10 Details

Fixes

Enhancements

Related Topic: ReleaseHistory