Yope, that's right, they did it again! :|

The previous XML-RPC fix may not be secure enough, so...

It is highly recommended you fix you installation by downloading this NEW patch file and unzipping it into you /blogs/b2evocore/ folder. This should overwrite the two following files AGAIN:

• _functions_xmlrpc.php
• _functions_xmlrpcs.php

This patch has been tested on the latest 0.9.0.12 "Amsterdam" release but is believed to work on all 0.9.0.x versions.

The patch will be included in future releases.

By popular demand, here's a preliminary list of the new features and the changes introduced in the "phoenix" ALPHA release...

The main focus of this new version was to remove the b2 legacy code from the evoCore framework in order to move to a more stable, reliable and scalable architecture (with Objects and all the rest...). This was mostly behind the scenes work without immediate features to show off for gratification. However, the new evoCore now allows to add functionnality more quickly and more efficiently.

Anyway, there are already quite a few new features available: (This is by no way a final list!)

• File manager (blueyed)
• Multiple domain support (blueyed, fplanque) (TODO: (cookie/admin) Debugging!)
• Mailing lists: Subscriptions for new posts and/or new comments (fplanque)
• Who's online? (jeffbearer, blueyed, fplanque)
• Email form to contact authors without revealing their email address (jeffbearer, blueyed, fplanque)
• Paged display in antispam (fplanque)
• Improved hit logging (bluyed, fplanque)
• Stats enhanced with Flash charts (fplanque)
• Added options to allow a blog stylesheet or a user stylesheet to override the skin stylesheet. (edgester) (TODO: Only the "custom" skin works with the options at the moment. Other skins must be modified.)
• Lost password: sends a link to allow password changing instead of generating a new password right away (blueyed)
• New setting in the blog's advanced tab for choosing the comment's policy on a per blog basis. You can now choose if you want to allow comments on a blog, if you want to be able to disable them on each post, or if you don't want any comments at all (gorgeb)
• Post editing extensions:
  • Alternative backoffice layout(s) (fplanque) (TODO: get this out of the conf files and make it available in the UI).
  • "Deprecate now" function (fplanque)
• Post browsing extensions:
  • Complete contextual browsing: you can combine several filters: author, month, category, etc (fplanque)
  • Browse by author (fplanque)
  • Calendar: Links to next/prev month/year are only provided if there are posts in that direction (blueyed)
  • Fixed ability to select multiple authors at once (via URL params) (fplanque)
  • Added ability to combine categories in search (fplanque)
  • New URL parameter 'dstart' allows to start browsing at specified date (same fprmat as 'm'). useful with unit = 'days'.
  • New URL parameter 'unit' allows overriding of configuration to select what to display: 'posts' or 'days' (fplanque)
  • Slightly enhanced week handling (weeks start on sunday or monday depending on user locale) (requires MySQL >= 4) (fplanque)
• Post extensions (fplanque)
  • Extra status
  • Post type
  • Popup calendar for dates
  • Assigned to
  • Priority
  • Deadline
  • Counting number of views for each item (template tag $Item->views()) (jeffbearer, blueyed, fplanque)
• Permissions:
  • Group based blog permissions (halton)
  • Extended group permissions (fplanque)
  • Blog permissions presets; Member, Editor, Admin (blueyed, fplanque)
• Packaged plugins:
  • Wacko markup plugin (fplanque)
  • WikiLinks plugin (fplanque)
  • LDAP authentification plugin (blueyed) (TODO: finish)
  • "poplog" (change name) plugin (blueyed)
  • Some previously built-in features have been moved to plugins (fplanque)
• Code:
  • Day at the start of the week moved to properties of the locales (blueyed)
  • Subpaths now include trailing slashes (that was another odd b2 legacy...) (blueyed, fplanque)
  • User profile validity checking (fplanque, blueyed)
• Experimental:
  • Added experimental memcached support. Use at your own risk! Change $use_memcached in conf/advanced.php to activate. Requires phpca memcached client and memcached server. See Memcached Homepage for more info.

A critical security issue has been discovered in the XML-RPC for PHP that most applications use, including b2evolution.

It is highly recommended you fix you installation by downloading this patch file and unzipping it into you /blogs/b2evocore/ folder. This should overwrite the two following files:

• _functions_xmlrpc.php
• _functions_xmlrpcs.php

This patch has been tested on the latest 0.9.0.12 "Amsterdam" release but is believed to work on all 0.9.0.x versions.

The patch will be included in future releases.

It's been quite a long time since the last major release of b2evo. The good thing about this is that our 0.9.0.x series are pretty nice and stable. The not so good thing is that a load of new features are still stuck in the development version on the SourceForge CVS... and if you're not into hacking with CVS code, you might even wonder what the hell is going on... Thus, I thought we should go for a quick update...

My first releases of b2evolution were built upon cafelog/b2 which happened to be the tool I had picked for my own weblog. Over the last two years, the code, the community and the usage of b2evo have grown far beyond my original intent. Besides, I could no longer maintain such a big project on my own personal spare time...

Fortunately, there have been two major events affecting the development of b2evo. First, the development team has grown significantly, and second, most of us have come to actually use b2evolution professionally, as part of our day jobs... with the nice side effect of virtually bringing commercial company support to the project - read: "paid development time" ! :)

At my own employer's we use that thing we've come to call "evocore" as the framework for a major application we are building internally. This application has not much to do with blogging, but reusing all the existing framework/core code saves us a lot of time. We've also been extending the evocore significantly and I'm working on taking advantage of the new features in the higher level b2evo features and interface.

Another interesting side-effect of this is that all the original cafelog/b2 code is slowly being wiped out in favor of brand new evocore code. This wasn't originally planned until version 2.0 of (b2)evolution. However, what we have in CVS now is getting pretty close to that. So I don't know what the next release will be numbered nor when it will occur, but it might be a major one! ;)

I don't want to talk too much for the other devs since most of what they've told me about what they are developing is still confidential, but I hope a few of them will add a few comments here and let you know.

Anyway, if you want to know where we're headed we could put it like this: we're extending the "Multilingual multiuser multi-blog engine" by focusing on these points: versatility ("multipurpose" blogging), stability, maintainability, security, professional grade codebase. We may omit to focus specifically on some fashion features but we're extending the plugin architecture so that anything you need could be hooked. (If you need some hooks in order to develop a plugin, feel free to contact me, but please use the CVS version for development.)

Finally I'd like to take the opportunity to thank all members of the development team B) for their contribution to the project as well as the forum moderators and daily users B) for their invaluable time and effort in supporting the newcommers. Not to forget the supporting users and fans B) who encourage us to maintain the public blog app after our already-overloaded-work-days...

Thank you all! :)

Stay tuned for more... or check out CVS if you can't wait! ;D

-François.

A moderately critical security advisory has been posted here: http://secunia.com/advisories/13718/

Methods to fix this issue are described here: http://forums.b2evolution.net/viewtopic.php?t=2695

We are encouraging all b2evo users to update their installation.

We don't really like to throw out lots of promises here. What we really like instead is to deliver!

However, since we keep getting requests for this in the forums, here's a quick rundown of what we'll be working on this summer:

• Extended plugin system;
• Support of multiple domains through a single software installation;
• Increased user isolation, for example: each user might want to use his own skins and not share them with the others. This also includes additional user and group permissions;
• Better user interface.

Of course these are only the main guidelines; there are also handfuls of little additional features under development... but I think I already made enough promises today. Gotta work on delivery now ;)

Stay tuned!