Major Highlights

• Added the ability to manage the Vanity URL prefix
• Added the ability to filter members in the member directory by role
• Fixed issue where the user could inadvertently click the login button multiple times
• Fixed issues where core classes could not be used in out of process cache provider
• Fixed issue where profile visibility submenu was not displayed correctly
• Fixed issue where the member directory was broken when Convert URL to lowercase setting was enabled
• Fixed issue where password checker didn’t work with unicode resource strings
• Fixed issue where ExecuteDataSet had a breaking change in DNN 7.0
• Fixed issue where Super User could not change personal profile URL
• Fixed issue where installing site with blank template caused error
• Fixed issue where upgrades failed when the ProfessionalPreview module is not installed
• Fixed issue where social media auth providers are not properly filling in profile properties
• Fixed issue where admin only content was not visible to Super User
• Fixed issue where user gets an access denied error after password reset
• Fixed issue where client resource manager failed to minify files
• Fixed issue where search didn’t work after adding search results to alternate page

Security Fixes

• None

Updated Modules/Providers

Modules

• None

Providers

• None

Major Highlights

• Fixed issue where vanity URL was not working correctly in FireFox
• Fixed issue where default Friendly URL setting was missing for the doNotRewriteRegex
• Fixed issue where language URLs were not working
• Fixed issue where adding a new page resulted in an error message
• Added the ability to define a standard prefix to vanity URLs
• Fixed issue where the unauthenticated role permissions were not being applied
• Fixed issue where password strength meter was missing for sites upgraded to 7.1
• Fixed issue where the Search Admin was missing a resx file in the mobile site template
• Updated RadControls for ASP.Net Ajax to the Q2 2013 release
• Fixed issue where hard-deleting a user resulted in an error
• Fixed issue where localization would stop working
• Fixed issue where progress bar does not show any progress in the Digital Asset Manager
• Fixed issue where removing a custom page URL causes a redirect to the home page
• Fixed issue where language aliases are not created when importing a site with content localization
• Fixed issue where upgrades from 6.1.5 would cause numerous error log entries regarding potentially dangerous request
• Fixed issue where disabling anonymous authentication with AD provider installed causes 404 error

Security Fixes

• None

Updated Modules/Providers

Modules

• Languages Module

Providers

• None

Major Highlights

• Implemented functionality so that users are able to assign custom CSS to pages without modifying the skin
• Updated to JQuery 1.9.1
• Implemented auto-complete functinoality in the taxonomy module
• Updated the page and user selector controls to improve the experience in larger sites with multiple users
• Implemented a warning message for Azure users when they install a module that does not have the Azure Compatible flag
• Fixed issue where users were being logged out if switching between www.domain.com and domain.com
• Fixed issue when exporting and importing a template where content localization is enabled
• Fixed issue where data was not being cleaned up after removing a folder provider
• Fixed issue that made modules not to render corectly when module caching was enabled through the Client Resource Management Framework
• Added support for accents in profile properties
• Fixed issue where calling the GetUserByVanityUrl function was throwing an error

Security Fixes

• None

Updated Modules/Providers

Modules

• File Manager
• Languages Module
• Pages Module
• Taxonomy Module
• Journal Module
• Membler Directory Module
• Social Groups

Providers

• None

Major Highlights

• Fixed issue that caused broken links when changing the name of a page
• Added search capabilities in the page management section
• Added new funtionality to the Member Directory so that users can choose between the different search options
• When creating a social group the newly created role group is now set as the default group
• Implemented new functionality to allow users to hid the login button in the default skin
• Removed the module and skin templates from the Starter Kit package
• Fixed issue that shows an error when registration is set to unique display name
• Fixed issue that made child site files not to show when managing sites
• Fixed UX issue when changing the file size in the configuration management section
• Fixed issue in the Journal module where followers could see posts that are meant for friends only
• Fixed paging conflict between roles and users in the users' accounts screen
• Added new functionality that allows users to see all the social groups they belong to
• Fixed issue where separating a site from a group would not copy all the users
• Fixed issue when creating a page from a template when the template has modules that are set to display on all pages
• Removed the "-" from the invalid character list for page names
• Fixed the styling in the date time picker to display the time
• Fixed issue that shown the tokens when searching for pages
• Fixed issue that made the site redirection management screen to not work correctly when pop ups are disabled
• Fixed issue where exported templates point to the incorrect site settings
• Fixed issue that caused Social Group Roles to be limited to the Global Role group
• Fixed issue when page names include a ":" colon
• Fixed issue where scheduler runs overlap when retry is set to a short interval
• Fixed issue with modules that are expected to display in all pages and Content Localization is enabled.
• Implemented auto-refresh functionality in the message center so that users can see updates in real time without refreshing the page

Security Fixes

• none

Updated Modules/Providers

Modules

• Device Preview Management Module
• Pages Module
• Journal Module
• Member Directory Module
• Site Groups Module

Providers

• none

Major Highlights

• Fixed issue in the Client Resource Manager where data URL's were removed when running the composite files option
• Fixed issue when switching language from the control panel
• Fixed issue that stopped the Telerik RadMenu and RadTabstring from rendering correctly when an HTML module is added to the same page
• Fixed issue that stopped users from changing login settings
• Fixed issue that stopped users from changing the settings in the event viewer
• Fixed postback issue when copying a page using the control panel
• Implemented module icon override when updating to a new version of the product
• Fixed image upload control rendering issue when using IE or Firefox
• Fixed issue that makes the dashboard fail when running SQL Azure
• Fixed export as XML in Dashboard feature when running on SQL Azure
• Fixed upgrade issue when hosting a site in SQL Azure
• Fixed password validation issue when adding a new user
• Added autocomplete when searching for devices to the Device Preview Management module
• Fix issue when the user is upgrading DNN and recycles the app pool before calling the upgrade page
• Fixed support pop ups feature when creating a new module from a manifest file
• Fixed the To and From logic in the messaging module

Security Fixes

• Fixed permissions issue when uploading files throught Service Framework requests
• Fixed potential javascript injections on sites running multiple languages
• Implemented filters in the rich text editor to avoid the posibility of cross-site scription issues

Updated Modules/Providers

Modules

• Log Viewer Module
• Pages Module
• Taxonomy Module
• Dashboard Module
• HTML Module
• Member Directory Module
• Messaging Module
• Site Groups Module

Providers

• none

Major Highlights

• Fixed issue that caused message replies to now show in the feed
• Fixed errors in Razor DDR Templates when upgrading to a version higher than 7.0.0
• Fixed issue that prevented hosts users from changing their password
• Fixed issue that caused line feeds to be removed from messages when using Firefox
• Fixed UX issue when copying pages from the control panel
• Fixed JS errors when creating pages using IE 10
• Fixed issue where standard asp file input elements were rendered incorrectly
• Fixed drag and drop functionality when updating a user's profile picture
• Replaced the old style icons for modules shown in the control panel
• Fixed issue that caused the server to hang when pages were moved using the Pages Module
• Fixed issue that caused the site logo to not function correctly on child websites
• Fixed issue that caused autocomplete to fail when a Console Module was added to a page
• Fixed module actions positioning issues when using ajax to load content after the page is rendered
• Enhanced the way user names are displayed when liking comments in the Journal Module
• Fixed issue that caused multilingual sites to show duplicate entries in the site switching tool in the control panel
• Fixed issue that caused multiple entries to be added to the ContentItems table when adding tags to modules
• Updated the list of devices in the Preview Management Module to include the most popular devices to date

Security Fixes

• none

Updated Modules/Providers

Modules

• Pages Module
• DDR Menu
• Journal Module
• Messaging Module

Providers

• none

Major Highlights

• Fixed issue that prevented non admins and non hosts to save HTML content as a template
• Fixed potential endless loop when using the device redirection on a new site
• Fixed UI issue where sub menus could go off screen
• Fixed issue that stopped users from switching sites from the control bar
• Fixed CSS issue for disabled menu items
• Fixed issue with link in the Journal when a site is restored in a different server
• Fixed issue that prevented pop ups from closing when a window would not use the default alias for JQuery
• Fixed errors when registering or logging in using a Twitter account
• Fixed issue that stopped users from updating the Max File Size value
• Implemented functionality in the Admin > Advanced Configuration > Languages so that users are able to re install and upgrade language packs
• Fixed error in the HTML Editor Image Manager that stopped users from navigating the complete folder structure
• Improved performance of the File Explorer when looking for files from an HTML module
• Fixed issue where more than one language pack was being shown for each language during installation
• Fixed issue where notification emails were not being sent
• Fixed issue where the wrong timezone would be set in the host user's profile
• Fixed issue where email was not getting delivered when a user received a message from another user
• Fixed issue that prevented users from renaming pages that include special characteres
• Enhanced the flow when downloading documents that can be opened in a browser (like xml)
• Removed non FIPS compliant code from the Client Resource Management component
• Fixed issue where the user was not able to download language packs from the host > languages section
• Implemented functionality to send query strings when redirecting sites using the mobile redirection feature

Security Fixes

• none

Updated Modules/Providers

Modules

• File Manager Module
• HTML Module
• Journal Module
• Messaging Module

Providers

• none

Major Highlights

• Fixed issue that made the edit module icon to not appear when editing pages

Security Fixes

• none

Updated Modules/Providers

Modules

• none

Providers

• none

Major Highlights

• Fixed issue in sitemap priority when hosting services uses commas instead of dots as decimal separators
• This issue affects directly to the no technician user of portal
• Fixed issue where files with special characters were not encoded correctly in the URL
• Fixed error that cause settings to not be saved from the page management module
• Fixed issue in the device redirection module where the isTablet or Both options were not being enabled when upgrading to the 51Degrees Basic data
• Fixed issue where the hyperlink manager threw an exception when running in debug mode
• Fixed issue in the editor provider dialog that caused "My Folder" to not show
• Fixed issue in the Journal where clicking the Get More button threw an authorization error
• Fixed issue that stopped users from deleting role groups
• Fixed module permissions issue when the editor has permissions to edit a module but not the page
• Fixed issue where autosave was not enabled by default when upgrading from CE to PE or EE
• Fixed error when sending a friend request to a member of a child site when the sites are in a group
• Fixed issue in the Journal where the text box would hide when commenting on an existing comment
• Fixed issue in the control panel where the module list would not work correctly with Firefox 17
• Fixed issue that caused only one component to be shown when adding multi-component modules to a page
• Fixed UI issue that caused the control panel to not hide when the HTML Editor is set to full screen mode
• Fixed issue where lists with large recordsets didn't be display all records
• Fixed issue that made images not clickable in the Journal
• Fixed issue that cause the Image or File Upload icons in the Journal to now work when using Firefox 17
• Fixed issue that made the Taxonomy module unavailable
• Fixed issue when using jquery tabs
• Added horizontal scrolling to grids with large record sets
• Removed the Feed Explorer module from the package
• Added the isSmartPhone property to the device redirection module when upgrading to the Basic or Premium data
• Optimized the messaging and notifications html / css to maximize the default.css inheritance
• Fixed issue where the user was not able to download language packs from the host - languages section

Security Fixes

• Enhanced the code that generates profile pictures to avoid performance problems
• Enhanced the member search to avoid data compromise
• A number of browsers incorrectly implement a particular HTML tag, in violation of the official W3C standards. Defensive coding was added to avoid the posibility to use this tag to redirect requests for certain files to another site

Updated Modules/Providers

Modules

• File Manager
• Pages Module
• Taxonomy Manager
• HTML Editor
• Journal
• Member Directory Module
• Device Detection and Redirection Module

Providers

• none

Major Highlights

• Fixed issue that caused profiles of deleted users to be available
• Removed the postback after checkboxes are selected in Page Settings > Taxonomy
• Implemented the functionality required to edit security role names and social group names
• Fixed JavaScript error when using a ";" semicolon as a profile property
• Fixed issue when using DateTime properties in profiles
• Fixed viewstate error when using Facebook authentication in conjunction with "require valid profile for login"
• Fixed issue where cached pages were not sending Content-Type in the response header
• Fixed issue where deleting the razor host module caused the razorhelpers to be deleted too
• Fixed issue where users could not upload a profile picture when a site belonged to a site group
• Fixed issue where the Journal ignores the page size setting
• Fixed issue where URLs were incorrect after moving a site with site groups enabled to a new serer
• Fixed issue in the Journal that made image thumbnails not clickable
• Fixed issue in the Journal where images were played like youtube videos

Security Fixes

• Fixed issue in the Member Directory module that could show members to non authenticated users
• Fixed issue in the Lists module that could potentially be used for script / html injection
• Fixed issue in Module's titles that would allow users to enter html or JavaScript code

Updated Modules/Providers

Modules

• File Manager
• Journal
• Member Directory
• Message Center
• My Modules
• Social Groups

Providers

• none

Major Highlights

• Fixed issue where the application throws an Unhandled Error and an HTTP Response Code of 200 when the connection to the database is lost

Security Fixes

• None

Updated Modules/Providers

Modules

• None

Providers

• None

Major Highlights

• Fixed issue that cause the member avatars to not show in the Member Directory

Security Fixes

• Enhanced the code that generates profile pictures to avoid performance problems
• Enhanced the member search to avoid data compromise
• A number of browsers incorrectly implement a particular HTML tag, in violation of the official W3C standards. Defensive coding was added to avoid the posibility to use this tag to redirect requests for certain files to another site

Updated Modules/Providers

Modules

• Member Directory Module

Providers

• none

Major Highlights

• Updated the system so that it supports nested folders in the App_Code folder
• Updated the Global Error Handling so that when errors within the global.asax handler happen, they are caught and shown in a page displaying the original HTTP error code
• Fixed issue that stopped users from specifying Link URLs that open on a new window

Security Fixes

• Fixed issue in the Member Directory module that could show members to non authenticated users
• Fixed issue in the Lists module that could potentially be used for script / html injection
• Fixed issue in Module's titles that would allow users to enter html or JavaScript code

Updated Modules/Providers

Modules

• none

Providers

• none

Major Highlights

• Fixed issue where the module printing function was only visible to administrators
• Fixed issue where pane level skinning was being assigned to a default container for any content pane
• Fixed issue when using password aging and FB / Google authentication
• Fixed issue that was causing the DateEditControl to not load the assigned value
• Fixed issue that stopped additional profile properties to be displayed in the member directory after modifying the template
• Fixed error that stopped users from saving host settings when a custom port number is used in the SMTP server
• Fixed issue when replying to a message sent to a role by the administrator
• Fixed performance issue when importing site templates with hundreds of pages
• Improved flow when creating profile properties
• Fixed race condition when using the unverified users functionality
• Enhanced the page creation process so that "/", "-", "*" can be used in page names
• Fixed issue where the Enable Localized Content was disabled for newly added languages
• Fixed error shown to the user when the messaging is configured to limit the number of recipients to 1 and the user tries to message multiple users
• Fixed validation issue in the Trial Fee field when creating / editing roles using billing and trial periods
• Fixed UI issue in the biography field in the profile
• Enhanced the deletion process of child sites so that the folder is deleted and the name can be reused
• Updated the DotNetNuke.Data.SqlDataProvider so that the product runs in Azure successfully

Security Fixes

• none

Updated Modules/Providers

Modules

• Member Directory Module
• Messaging Module

Providers

• none

Major Highlights

• Fixed issue where mailto: links were not working when sending bulk email
• Fixed issue where users did not see friendship relationships
• Problem is in 6.2, which does not show in the Versions Affected list above
• Fixed the issue with cascade deletes in comments in CoreMessaging_Notification
• Fixed UI issue when using a date fields as a required profile property during user registration
• Fixed error when running the product in debug mode
• Fixed visibility issue when a user publishes a comment on a friend's wall
• Fixed issue that caused module icons to not appear in the UI
• Fixed UI issue in the datepicker control when using Chrome
• Fixed issue where saving a page removed the page icon
• Fixed issue with effective and expiry dates of roles
• Fixed UI issue when expanding all tabs in the HTML Editor Manager
• Fixed issue that caused the profile picture to disappear when switching from English to French
• Fixed issue where use trial link appeared for a service even if no trial period was setup
• Fixed validation issue in profile properties
• Fixed issue in Member Directory filter by profile property where registered users did not get the correct results
• Fixed issue that caused Social Group Roles to be limited to the Global Role group
• Removed settings that did not apply from Super User Account Module Settings
• Fixed UX issue in the Journal when the product is installed in Dutch
• Fixed issue in the journal when entering URL's of the format www.domain.com instead of http://www.domain.com
• Fixed issue when using '&' in the title of Social Groups
• Updated to the latest version of the Telerik libraries
• Added a warning message when deleting comments from the Journal
• Updated the DotNetNuke.Data.SqlDataProvider so that the product runs in Azure successfully

Security Fixes

• none

Updated Modules/Providers

Modules

• File Manager
• Journal Module
• Member Directory Module
• Social Groups Module

Providers

• none

Major Highlights

• Added the missing (ModuleActionCollection) Actions.Add(GetNextActionID, "~", "") overload
• Fixed issue with the Page Header Tags getting cut off
• Implemented missing French translations in the HTML Editor Manager
• Fixed issue in the member directory module where the advanced search box is not closed when the user moves away from it
• Fixed issue with LinkToMobileSite, LinkToFullSite and Meta skin objects not being registered in the mobile skin
• Fixed issue in the social groups listing counts after posts are deleted
• Fixed issue with the wrong register page being shown when changed in the site settings
• Fixed with the GlobalResouces/Template.resx no appearing in the Language Editor and Resource Verifier
• Fixed issue when page names include a ":" colon
• Fixed issue with the telerik editor not loading in the biography when changing profile properties to required
• Fixed UX issue in the member directory module after updating the search settings
• Fixed issue with links that include non alphanumeric characters
• Changed the login control to display in a pop up
• Fixed rendering issue in the extensions module when using .net 4.0
• Fixed issue in the SitemapCacheDays after updating the search engine sitemap settings
• Fixed issue with the picture not being shown in the Member Directory module when SSL is enabled
• Fixed issue with the picture not showing up in the journal when SSL is enabled and the application uses a port different from 443
• Fixed UX issue when sending messages from the Member Directory
• Fixed issue friending users from the member directory
• Fixed issue caused by missing properties in the data provider
• Fixed issue with some of the host settings not being applied to child sites
• Fixed issue that allowed users to create pages with the name sitemap
• Fixed issue with the datatype list in the registration process
• Fixed rendering issue when deleting profile properties
• Updated to JQuery version 1.7

Security Fixes

• none

Updated Modules/Providers

Modules

• File Manager Module
• HTML Module
• Journal Module
• Member Directory Module
• Social Groups Module

Providers

• none

Major Highlights

• Fixed issue in the return URL after a user is shown the login screen when accessing an unauthorized resource
• Fixed issue that stopped super users from being shown in the auto-suggest user lookup function in the member directory module
• Fixed issue when sending bulk emails and localization is enabled
• Added localization keys to the filter settings in member directory
• Added localization keys to the user profile menu
• Fixed issue that cause the newsletter module to not function properly in child sites
• Fixed issue in the member directory advanced search option where settings were not used correctly
• Fixed UI issue in the user profile when using IE 7
• Fixed language packs installation issue when the product is installed using the auto option
• Fixed issue where the language, if different from English, is not set as the default language after installation
• Fixed backward compatibility issue when using language packs for previous versions of the product
• Fixed issue in the profile when single quotes are used
• Fixed issue when creating pages with a pound "#" in the name
• Fixed issue that stops the install wizard when a language pack has errors
• Fixed UI issue when uploading a logo
• Fixed issue that stopped forge modules from being deployed through the extensions catalog
• Fixed issue in when page names contain dots
• Improved performance when accessing user permissions
• Fixed issue that stopped super users from uploading icon files
• Fixed issue when creating the path for the icon in custom desktop modules
• Fixed issue in the HTML editor that was causing links to not work when tracking clicks
• Fixed issue in Social Groups where users were not shown as group members when upgrading from previous releases
• Fixed styling issue in the Journal when importing links information
• Fixed object reference error when calling SaveMessage in MessagingController.cs
• Fixed knockout exception in the MyProfile template
• Fixed issue when upgrading from 4.9.5 to the latest version
• Fixed issues with JavaScript in the user biography
• Fixed issue that stopped additional profile properties to be displayed in the member directory after modifying the template
• Fixed issue that caused the password fields to be cleared after selecting the country during registration
• Fixed issue in the file manager that stopped users from creating folder mappings
• Fixed the can not create type 'DotNetNuke.Modules.Journal.ProfilePic' error when using DotNetNuke.Modules.Journal.dll
• Improved the performance of the login control
• Fixed issue in the DDR Menu that was causing rendering issues when visiting the site using a mobile device
• Updated the Dark Knight skin to use HTML5 as the doctype and dded HTML5 doctype as an option under fallback skin doctype

Security Fixes

• none

Updated Modules/Providers

Modules

• Newsletter Module
• File Manager Module
• Pages Module
• HTML Module
• Journal Module
• Member Directory
• Social Groups
• Device Preivew Management Module

Providers

• Google Authentication Provider
• Facebook Authentication Provider

Major Highlights

• Fixed issue in the Site Settings when single quotes were being treated as escape characters
• Fixed issue loading the Mobile Premium Data after upgrading from CE to PE
• Fixed errors logged when updating folder provider settings
• Fixed the order of the mobile device capabilities in the Site Redirection Management UI
• The User Profile page was completely rebuilt. We needed User Profiles to have multiple child pages. This would allow for the most flexibility by still following the typical DotNetNuke page and module structure
• The Social Groups module allows users to browse pages for viewing a group details
• One of the more critical pieces to a successful collaboration platform is the activity stream. We have created a Journal Module and API that will allow you to easily display and create activities within your site
• User File Manager. As part of building the new Journal Module, we are providing a better way for users to manage their own files within DotNetNuke
• A member directory that is vital to the success of any collaborative site or site that is based upon user-to-user interaction
• A messaging module that similar to email, provides a mechanism for users to communicate within a site in a private manner
• Implemented User Relationships functionality that allows users to connect with each other as followers or friends
• Implemented API methods to support filtering options for text (both replace and remove). One custom filter for profanity was added to the FilterFlag used by the InputFilter function - this will be used by the Journal function and can be reused by 3rd party module developers
• Implemented changes to how the Tab (Page) Hierarchy is managed. Due to the limitations of earlier versions of SQL Server, prior to these changes, the business layer managed the handling of the tab hierarchy. Whenever a tab was created or moved in the hierarchy, there was a lot of calculation to calculate the effect on other tabs and update them accordingly
• Implemented support for SSL Offloading so that large enterprises can offload SSL support to network devices such as load balancers

Security Fixes

• none

Updated Modules/Providers

Modules

• Device Preview Management Module
• Journal Module
• Member Directory Module
• Message Center Module
• Social Groups Module

Providers

• none

Major Highlights

• Fixed issue that stopped users from creating vocabularies when the portal ID was not zero
• Fixed issue that caused modules configured to be displayed on all pages to be added to the wrong container in new pages
• Fixed page quota restriction issue in the Ribbon Bar
• Removed restriction that would not allow users to use a dash in page names. Now users can create pages with names like "site-map"
• Fixed issue that was causing the wrong container to be loaded in modules when in edit mode
• Fixed exception thrown in modulesettings.ascx.cs when the start or end dates are before the current date
• Fixed ordering problem when restoring pages with children from the recycle bin
• Fixed issue when applying a skin and a container to the host pages from the Pages module
• Fixed issue when a page is given a name that ends with the word "install"
• Fixed issue where the delete folder action did not function as expected within the Image Manager
• Fixed issue that caused pop up not to close when the retrieve password action was cancelled
• Fixed UI issue in the HTML Editor Manager
• Fixed issue in the DDRMenu when setting pages as hidden
• Fixed error logged when Banners was clicked
• Fixed issue in LinkClick when port numbers are used
• Fixed issue in SiteWizard.ascx where the "SelectedValue" is set to an invalid attribute
• Fixed issue where SendPassword.ascx fails because the ReturnURL was not specified in the querystring
• Fixed issue in the Search Input Settings page when the module was manually added to a page
• Added module load exceptions to the event log
• Fixed issue when creating extensions from Host > Extensions
• Fixed issue in the Site Settings when single quotes were being treated as escape characters
• Fixed issue with PDF's getting corrupted when sending them as attachments in the Newsletter Module
• Fixed font styling issues in the installation flow
• Fixed issue with adding modules to single culture pages when Content Localization is enabled
• Fixed error when accessing the online help from the tools menu
• Fixed issue with the Telerik editor removing html tags from pages
• Removed unnecessary confirmation dialog when unzipping folders
• Fixed error logged when uninstalling modules
• Fixed issue in the DDR Menu that was causing rendering issues when visiting the site using a mobile device
• Back-Ported the Site Redirection Management Module to CE
• Enhanced the UX in the Site Configuration Wizard
• Enhance the UX of the Create Page Wizard
• Migrated from the WURFL device data repository to the 51Degrees data repository

Security Fixes

• None

Updated Modules/Providers

Modules

• Pages Module
• DDR Menu
• HTML Editor
• Device Detection Management Module

Providers

• None

Major Highlights

• Fixed issue with loading the splash page skin in the login, privacy and terms of use pages
• Fixed issue when searching for words with special characters in them
• Fixed redirection issue when the user does not have permissions to access a resource
• Fixed issue when clearing the cache using the ClearHostCache() function
• Fixed issue when displaying the site structure in the link to page feature
• Fixed issue when inline editing the title of modules
• Fixed issue with incorrect redirection when portal alias mapping mode is set to redirect.
• Fixed issue with closing the Newsletter preview
• Updated the controls in the schedule UI to match the rest of the application
• Fixed issue where the hosts' profile picture is not copied to child sites
• Fixed issue with useFullyQualifiedRedirectUrl in medium trust environments
• Added a regular expression validation when creating User Name validation rules
• Fixed upgrade issue when upgrading from 5.6.3 to 6.0.1
• Fixed duplicate key exception in the File Manager
• Fixed issue in the creation of language packs for the RadEditor Provider
• Fixed issue with the font used in the Dark Knight skin and languages that contain accents
• Fixed issue with language retention when using stating localization
• Fixed issue that stopped host users from deleting their lists entries
• Fixed CSS problem in the login / registration pages when using IE7 and IE8
• Fixed issue cause by URL's changing to small caps after login
• Created a new configuration that forces the host user to change the default password on the first login
• Updated the Dark Knight skin to use HTML5 as the doctype and dded HTML5 doctype as an option under fallback skin doctype
• Fixed issues created by the system requiring multiple configurations for the applyCSS dropdown in the Telerik Editor Provider

Security Fixes

• Fixed issue in the File Manager when validating file extensions

Updated Modules/Providers

Modules

• File Manager
• HTML Module

Providers

• RadEditor Provider

Major Highlights

• Fixed issue during CE to PE upgrade that caused the Google Analytics module to not be shown in the control panel or the Admin page
• Fixed issue in the HTML Template Manager
• Fixed unhandled exception when creating new extensions of type Dashboard Control
• Fixed issue where hidden pages were not being shown in Admin > User Accounts > User Settings > User Account Settings > Redirect After
• Fixed issue with non-standard folders in the RadEditor
• Fixed issue where Calendar Popups were not rendering in IE9
• Fixed installation flow when the user did not have the right file and folder permissions to finish the installation
• Fixed issue that was stopping users from logging in because of corrupt data in the Profile table
• Fixed issue in the class ContentController when trying to retrieve the metadata of content items
• Removed deprecated file TimeZoneEditor.ascx.resx
• Fixed issue that caused invalid values to be entered in the UserProfile table
• Fixed issue with folders not being shown when they were created from the HTML Module
• Fixed error logged when marking an item as ready for translation
• Fixed upgrade issue in the files table when upgrading from 5.x.x to 6.x.x.
• Fixed issue when creating module from the Newsletter module
• Fixed UI issue in the Tabs Module where the legend didn't wrap
• Updated assemblies to Telerik Q3 2011 Ajax
• Included missing key in the GlobalResources.resx file ("//Admin//Lists.text")
• Fixed issue where language key were missing in the RadEditor
• Implemented work around for a bug in the browser definition files that were causing ASP.NET to not be able to detect certain browsers
• Fixed issue with localization files not being handled correctly by the Telerik DNN Grid
• Fixed issue with large files that were causing a YSOD
• Fixed issue where the modal dialogs were inheriting from the site styles
• Fixed issue in the Cache Provider when using a PE template in a CE site
• Fixed casting issues to support Oracle data provider

Security Fixes

• Pending

Updated Modules/Providers

Modules

• Pages Module
• Newsletter Module
• File Manager
• HTML Module

Providers

• none

Major Highlights

• Updated XmlMerge to support location tags in web.config
• Added a date picker control to prevent users from entering the wrong date format when assigning security roles to users
• Fixed issue with deleting the homepage of secondary languages when using Content Localization
• Fixed issue with SSL and popups that caused the website to load in Popup
• Fixed issue loading attachments in the Newsletter module
• Fixed issue in the Text Editor that stopped the user from resetting values to empty or null
• Fixed issue with Telerik Folder Browser generating incorrect LinkClick urls for child portals
• Fixed issue when using Windows authentication after upgrading to DNN 6.0
• Fixed an issue during upgrade caused by the client dependency framework updating web.config for each extension installed - this was causing a problem with web.config file access
• Fixed issue with XmlMerge which could cause extension uninstalls to fail
• Fixed RadEditor Localization issue
• Fixed issue in Site Settings that prevented admins from updating fields
• Fixed Ribbon Bar issue related to apostrophe in Localization
• Fixed the errors generated when the Preview pop-up is opened
• Removed Log4Net Config file from the upgrade package
• Fixed issue with the User Account Photo
• Fixed issue with the sitemap generating TabId's instead of friendly URL's
• Fixed issue when synchronizing secured folders. Files were not being renamed to the correct extension
• Fixed error when updating the default alias
• Fixed issue during the creation of Language Packs
• Fixed issue that prevented help text from being shown in the Pages Module
• Fixed issue that prevented help text to be shown during installation
• Enhanced the create new website flow
• Fixed issue in the File Manager that was causing folder not to be shown after sync
• Added a missing localization key in the installation flow
• Fixed issue when moving more than one file in the File Manager
• Updated the Telerik Editor Provider to the latest version
• Fixed XHTML Compatibility issues in SkinController.cs
• Removed hard coded settings from the Banner SkinObject

Security Fixes

• Fixed issue where setting up a site with insufficent permissions would show an unauthorized access error that showed the folder the site was in - the path has now been removed from the exceptio
• Fixed issue where cached failed passwords could theoretically be retrieved from browser cache

Updated Modules/Providers

Modules

• File Manager Module
• HTML Editor Module
• Newsletter Module
• Banners Module

Providers

• RadEditor Provider

Major Highlights

• Fixed problem with the core skin object rendering CSS above the other framework inserted files, which caused problems when using core style skin objects
• Fixed issue with iFrames getting removed when content is saved
• Fixed issue with the HTML module removing styling and scripts from the content
• Fixed issue with inserting the link to jquery after the header of the page

Security Fixes

Updated Modules/Providers

Modules

• HTML Module

Providers

• none

Major Highlights

• Implemented a new way of managing client resources which dramatically improves the performance of the product
• Implemented a device capability API that allows module and skin developers to build mobile solutions
• Implemented a site redirection API that allows mobile visitors to be shown a custom experience
• Implemented a Site Groups API that empowers organizations to implement single sign on in multitenant environments
• Removed the whitespace filter, this was used for stripping whitespaces from the generated page content following a Regular Expression.
• In a previous release, the DotNetNuke.Entities.Content.Common.ContentExtensions namespace was renamed to DotNetNuke.Entities.Content.ContentExtensions. In this release, the namespace was changed to its original name
• Fixed the order of the pages in the Control Panel when adding new pages
• Improved usability in the Edit Extensions Page
• Telerik resource files were updated to version 915 release
• Updated the Portals Module and Site Settings to consistently display "site" instead of "portal"
• The community modules have been removed from the installation package and will be available through the Extensions Catalog

Security Fixes

• Browsers support the ability to remember common strings such as usernames/addresses etc. Code was added to ensure this does not occur when dealing with a password.
• The messaging component was added in DotNetNuke 5.5.0 and allows for inter-user communication. Text entered into it was failing to validate for certain XSS issues and has now been updated to resolve this issue.

Updated Modules/Providers

Modules

• HTML Module

Providers

• none

Major Highlights

• Fixed issue in the module editing drop-down caused by GZip compression
• Fixed issue where SendMail API was throwing validation error on valid email address
• Fixed errors generated when clicking on the help button in the Module Manager Popup section
• Fixed issue in the Import / Export features
• Fixed help text in the Edit Extension Settings Section
• Updated to the Q2 2011 release of Telerik RadControls for ASP.NET AJAX
• Added new video and audio formats to the list of default allowed extensions
• Fixed issue when creating lists with the same name in a site
• Added a new log type when a page is created
• Updated the Extensions Feed to display the Extension Name instead of the Unique Package Name
• Fixed issue in the FormatEmail function
• Fixed issue in the HTML Template Manager
• Integrated the latest version of DDR Menu
• Changed default regular expression in the user name creation to remove the 5 chars minimum

Security Fixes

• none

Updated Modules/Providers

Modules

• HTML Module
• DDR Menu

Providers

• none

Major Highlights

• Fixed behavior of Language detection when Content Localization is not enabled.
• Fixed issue in the HTML Module with links to secure pages (https)
• Fixed issue with subfolders in Cloud providers
• Fixed issue with the Telerik Editor in full screen mode when popups are disabled
• Included the RadEditor in the upgrade package
• Fixed issue caused by loading a DotNetNuke site in an iFrame with Modal Popus enabled
• Fixed issue with having the same skin in the _default folder and site skin folder
• Fixed issue with managing Users in Role
• Resolved the conflict between the Whitespace Filter and the File Manager
• Fixed issue with setting the icon of the homepage
• Fixed issue with folder duplicates in the File Manager
• Updated extension catalog to show "friendly" extension name, rather than the extensionname field
• Added regular expression validation to the account creation process. This allows admin to enforce policies like: user names must be valid email addresses
• Users can now use CAPTCHA during the password retrieval process
• Reordered text on screen to make default site warning more obvious

Security Fixes

• none

Updated Modules/Providers

• HTML Module
• Messaging Module
• Taxonomy Manager

Modules

• none

Providers

• none

Major Highlights

• Updated the UI / UX to a more simplified interface that accelerates productivity by making it much easier to set up and maintain websites
• Updated the DotNetNuke Core to be compatible with Windows Azure and SQL Azure which allows users to host their websites at Microsoft Data-centers
• Updated the DotNetNuke Core to C#. From this release on, every new feature, enhancement and bug fix will be implemented in C#
• Added support for .NET/Windows TimeZones - this allow for the correct management of Daylight Savings.
• Fixed issue with Telerik Editor not rendering correctly in IE9
• Fixed issue where users in the Administrator role are unable to see the users folder in the File Manager
• Fixed the UnderlyingDataSource property of the Property Editor that caused wrong data to be loaded
• Fixed the issue with sending the test email in the Newsletter module to the wrong recipient
• Enabled event validation as a best practice

Security Fixes

• none

Updated Modules/Providers

• Added DNNWerk's Page Management Module to the DotNetNuke Core
• Added DNNWerk's RadEditor Provider to the DotNetNuke Core

Modules

• none

Providers

• Implemented a folder provider that enables users to transparently integrate DotNetNuke folder options and modules with Cloud Storage Services and other storage options through an open API

Major Highlights

• Added license folder to the installation that includes the license agreements of third party components

Security Fixes

• Removed the ability to reactivate user profiles of soft-deleted users
• Fixed issue related to Module Settings access rights
• Removed legacy functionality that allowed users to upload skins / containers from the file manager
• Fixed issue with logging private data in text
• Updated the file manager to work well with event validation set to enabled

Updated Modules/Providers

The following modules and providers have been updated in the 5.6.3 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• none

Providers

• none

Major Highlights

• Fixed issue where HTML Editor dialogs were not displaying correctly in alternate languages
• Fixed issue with Regex for email validation
• Fixed race condition in the core scheduler
• Fixed issue where editing Host page settings would result in broken host menu
• Fixed issue where "Apply to All Modules" setting was not propogating settings correctly.
• Fixed issue where browser language detection was not working for child portals
• Fixed issues where ASPX pages in subfolders were returning an error
• Fixed issue where the Host Users list was not showing the correct users
• Fixed issue where SendMail API was throwing validation error on valid email address.
• Fixed issue where adding runAllManagedModulesForAllRequests="true" to web.config would result in some file types not being accessible
• Enhanced Host>SQL module to log module usage
• Enhanced user manager to allow users to be restored or hard-deleted
• Enhanced the way modules are identified in HTML for easier CSS control
• Added the ability to disable the Auto-PortalAlias feature
• Added numerous performance enhancements

Updated Modules/Providers

The following modules and providers have been updated in the 5.6.2 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

•  Blog 04.01.00
• Documents 04.01.01
• Forum 05.00.01
• RazorHost 01.00.01

Major Highlights

• Fixed issue to remove preCondition checks when upgrading to .Net 4.0
• Fixed issue where some valid domains were failing email validation checks.
• Fixed issue where editing Host menu page settings assigns the page to a Portal.
• Fixed issue which caused XHTML validation problems in 5.6.0
• Fixed issue where an aspx page in any subfolder was inaccessible.
• Fixed issue where Config.Touch method signature had an unintentional breaking change in 5.6.0
• Fixed issue which caused error on adding new super user account
• Fixed issue where Google Analytics was broken during upgrade to 5.6.0
• Re-Added Checkbox to Profile Property Types
• Added ability to perform 301 redirects or use canonical URLs when site has multiple portal aliases.
• Changed default viewstate encryption setting to reflect security best practices.
• Added new core module to enable the use of Razor scripts in sites running .Net 4.0
• Added the ability to create Child Portal type aliases to existing portals.

Security Fixes

• Edit Level Users have Admin rights to modules 
• Unauthenticated user can install/uninstall modules 
• Failure to filter viewstate exception details can lead to reflective xss issue
• Remove OS identification code 
• Add additional checks to core input filter
• Change localized text to stop user enumeration 
• Ensure that profile properties are correctly filtered

Updated Modules/Providers

The following modules and providers have been updated in the 5.6.1 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Newsfeeds Module 04.01.00

Major Highlights

• Added Configuration Manager to allow host user to modify application configuration files
• Added automatic portal alias creation for single portal installs
• Updated the file manager upload page to allow user to upload multiple files without returning to the file manager page.
• Updated Google Analytics script to support asynchronous mode
• Updated default indexes on multiple tables to improve application performance
• Fixed issue with Event Log Email Notifications.
• Fixed issue where Telerik HTML Editor was unable to upload files to secure or database folder.
• Fixed issue where registration page is not set correctly during an upgrade.
• Fixed issue where Sendmail stripped HTML and Links from emails.
• Fixed issue where Ribbon Bar CSS was included on the page even when Ribbon Bar was not visible.
• Fixed issue where "My Folder" was not available in the URL control and the Telerik HTML Editor
• Fixed issue where the language skinobject dropdown does not maintain state between postbacks
• Fixed issue where the UserProfile PhotoURL property not set properly
• Fixed issue where Data Caching code could result in race condition
• Fixed issue where a portalalias with a trailing "/" would cause a 404 error
• Fixed issue where reference copies of modules are not copied from the primary to secondary language pages.
• Fixed issue where a disabled language can result in orphaned pages which are not localized with Content Localization
• Fixed issue where content item wasn't being assigned to host tabs resulting in error when changing the host page title
• Fixed issue where localized grid header columns did not sort
• Fixed issue where the ribbonbar control panel was not properly moving pages when localization was enabled.

Security Fixes

• Exception details may leak if logging provider unavailable

Updated Modules/Providers

The following modules and providers have been updated in the 5.6.0 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Events Module 05.01.05
• Forums Module 05.00.00

Providers

• none

Major Highlights

• Added feature to detect if a site is not running the suggested customErrors configuration to mitigate the ASP.Net POET Vulnerability.
• Updated the default web.config to use the recommended customerrors settings to mitigate the ASP.Net POET Vulnerability.
• Fixed Sitemap Provider so it only returns one page when multiple languages are enabled and Content Localization is not enabled.
• Fixed Telerik File Manager to make files stored using database folders visible to the user.
• Fixed issue where module developers using custom aspx pages that inherit from basepage and use codeblocks get an exception
• Fixed issue where the locale was not properly reflecting the querystring and the users browser or portal settings.
• Fixed issue where users were not granted proper permissions for the Templates folder on install.
• Fixed issue where missing objectqualifier would cause upgrade script to fail.
• Updated the url parser to take port 443 and ssl into consideration. its no longer necessary to turn off human friendly or use-port number in web.config
• Fixed behavior of Language detection when Content Localization is not enabled.
• Updated update tab logic to take host tabs into consideration.
• Fixed install template to ensure content localization is defaulted to off for new installs
• Updated the warnning dialog confirmation box to show the user name and the role that the user is being removed from.
• Fixed issue where tab hierarchy was not displayed properly when the tab level was changed in the tab hierarchy.
• Fixed issue where translators were not given the proper edit permissions when content localization was enabled.

Security Fixes

• Added enhancements to patch ASP.Net POET Vulnerability

Updated Modules/Providers

The following modules and providers have been updated in the 5.5.1 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Feedback Module 05.00.02

Providers

• none

Major Highlights

• Fixed issue with UsePortNumber.
• Fixed issue with portals not being created after upgrade.
• fixed issue where incorrect AdministratorRoleId could be added leading to UI incorrectly showing "padlock" icons in permissions grid
• Fixed portal creation so User profile page is set correctly.
• Fixed issue with welcome emails not being sent if system is set to use a double byte langugage.
• Fixed issue with viewing Profile picture.
• Fixed broken link to verify language resources.
• Fixed issue. with Host updating Site Settings.
• Fixed issue with HTML module's database level dependency on the Modules.ModuleTitle field.
• Fixed issue with Host/Admin being able to disable all languages.
• Fixed issue with User Profile Image not showing.
• fixed issue where it was possible to have a disabled portal default language by enabling the applicable values on upgrade.
• Fixed issue with Tab Order starting at -1 when hard deleted from Recycle Bin.
• Improved performance by updating Data Access Block.
• Fixed issue with File Manager when adding new folders, no longer have to Click the root folder first.
• Fixed parent drop down in edit page settings so that users who have edit rights, bt are not Administrators get None Specified option.
• Fixed issue with Profile Image Control.
• fixed issue where wrong portalid was used if accessing site settings via host->portals menu. This could display the wrong set of languages for a portal and lead to portal display language being incorrectly updated.
• Increased Visibility of PresenterBase's public properties' Setters to Public.
• Ensured that the Language Combo is resorted when changed from Native<-->English
• Fixed issue with GetTabPaths Stored procedure to handle null culture pages correctly.
• Fixed issue with case insensitive fonts in Captcha control.
• For ribbon bar control panel - NewRole icon was already present in package - reference was incorrect.
• Fixed issue with Telerik editor file management.
• Fixed issue with exception thrown when creating new languages.
• Fixed issue with upgrades when there are deleted portals.
• Fixed issue where host vendors did not allow selection of an image from a host folder.
• Updated Portal.template.xsd to allow isProtected node.
• If a particular file is moving from a Secure Database type folder to a File System folder, the file content ("Content" field in the Files table) is updated and set to "NULL".
• The Edit Profile link in the View Profile should redirect to the Manage Profile page.
• fixed issue where language editor page size was not defaulting to 10 as required.
• Fixed issue with SendMail removing HTML formatting.
• Updated Telerik components to latest release.
• Packages now support Unit Testing as well as users who do not want to load the Unit Tests.
• Added new Default Visibility setting for Profile Properties.
• Added ability to suppress auto-injected Module css class.
• Added new Settings and Configuration properties to base Presenter class.
• Improved logging during upgrades.
• DotNetNuke currently has 2 types of folder permissions in the open core, READ and WRITE. The READ permission actually serves 2 purposes. First, it defines whether a role or user is able to open/view the files located in a folder. Second, it defines whether a role or user is able to browse the list of files within a folder. Sometimes these 2 purposes are not in alignment with one another. For example, it is possible that you may want All Users to be able to open files in folder if they have the full URL; however, you may not want All Users to be able to browse a listing of all the files in the folder ( beecause exposing the full paths to all files may be a security concern ). Windows IIS deals with this issue by including 3 types of permissions for folders: Read, Write, and Browse Directory. DotNetNuke could benefit by having a browse directory permission on folders as well.
• Improved GetResourceFile method.
• Verify Language Resources to Verify Language Resource Files to match the wireframes for the Content Localization project.
• Fixed UI of Resource Verifier and Language Editor to be consistent with updated Language Module.
• Added support for Media element in styles skin object.
• Updated CoreSitemapProvider to use the ModifiedDate of the Tab and Modules on the Tab for the LastModified date for the PageUrl.

Security Fixes

• Potential resource exhaustion

Updated Modules/Providers

The following modules and providers have been updated in the 5.5.0 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Media Module 03.03.00
• Events Module 05.01.04
• IFrame Module 04.04.00

Providers

• Solpart Menu Navigation Provider 05.01.00

Major Highlights

• Fixed issue with ExecuteSql method overloads to be able to handle ExecuteSQL(string, nothing) again.
• Fixed issue with Indirect Reference to DotNetNuke Library errors.

Security Fixes

• None

Updated Modules/Providers

The following modules and providers have been updated in the 5.4.4 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Media Module 03.03.00

Providers

• None

Major Highlights

• Fixed issue where page level and TabPath were not properly updated for descendents
• Implemented LinkClick functionality in Telerik editor.
• Fixed issue with displaying a module on all pages.
• Fixed issue with page management not working correctly.
• Fixed issue where messaging was using incorrect logic to notify users.
• Fixed issue with Event Log Email Notifications.
• Fixed issue with PurgeExpiredItems when the portal's home folder may not have been mapped correctly.
• Fixed issue where bulk updates did not properly repair existing modules.
• Fixed issue when hitting Enter while in the Tag edit text box.
• Fixed issue with sending Event Viewer exception messages when using Secure SMTP.
• Fixed a bunch of minor HTML formatting issues.
• Fixxed issue with module caching being ignored for non-browser user agents.
• Improved performance by only loading HTML Module menu when user is allowed to see it.
• Fixed issue where the DNNCountryEditControl does not return a value in the PropertyEditor
• Fixed issue with using external URL Rewriters causing error in initWidgets.js
• Fixed the issue with the ToolsFile property of the Telerik Editor to set the appropriate property on the underlying RadEditor.
• protection was added to ensure that a hacker who had a valid login to a site could not use viewstate details to perform a cross-site request forgery to public functions.
• alter log files extension so their existance or contents cannot be useful to potential hackers
• an additional filter was added to the existing core blacklist filter to catch an invalid tag that could lead to a cross-site scripting issue
• at present profile properties automatically strip dangerous XSS characters from data. In addition they support regular expressions to allow sites to configure the allowable characters. We've added an additonal htmlencoding to ensure dangerous html cannot be passed
• due to a logical error in the profile property provider, it's possible for member only profile properties to be displayed to non-members. Code was added to protect against misconfiguration revealing sensitive data.
• added additional encoding to sitelog to follow security best practices.
• Improved security by HTML Encoding taxonomy tags.

Security Fixes

• Logfiles contents after exception may lead to information leakage
• Cross-site request forgery possible against other users of a site
• Update inputfilter for invalid tag that could allow XSS attack
• Mail function can result in unauthorized email access
• Fix issue where member only profile properties could be exposed publically under certain conditions
• Profile properties not htmlencoding data

Updated Modules/Providers

The following modules and providers have been updated in the 5.2.0 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• * None

Providers

• * None

Major Highlights

• Improved performance of Sql script for listing modules by portal.
• Improved DeleteModule method to handle instances where object may be null.
• Increased the size of the Admin - Pages list box to cater for sites with a large number of pages.
• Updated the Installation Wizard's Polish & German language packs.
• Fixed issue with emailing Vendor details to the Admin and conformation details to the Vendor.
• Fixed issue where Sitemap does not work if globalisation culture is a culture that uses comma as separator
• Fixed issue with missing type specification in SiteMapSettings.
• Fixed issue where upgrade fails when site has a non-'en-US' default language
• Fixed issue with link editor showing pages the user does not have View permissions for.
• Fixed issue with registration emails not being sent from Child Portals.
• Fixed issue with Role update email not beiung sent to the user.
• Fixed issue where default tabs for Site Settings were not created when creating settings for a new language.
• Fixed issue where localization upgrade script was incorrect and could result in error on upgrade.
• Increased the number of Users that a DNN installation can handle to 2.14 billion.
• Fixed issue where localization updates were not properly applied to individual portals.
• Fixed an Issue, where Language Editor returned to Language List on update of any file.
• Fixed issue with jQuery not loading early enough.
• Fixed issue with email sending not recognizing HTML properly.
• Fixed issue with port numbers in email address during installation.
• Fixed issue with passing connection information to Sql Module.
• Fixed issue where the User Skin object was ignoring the ShowUnreadMessages attribute
• Fixed issue where the profile ImageEditControl datatype was only added to Portal 0.
• Fixed issue with url formatting when no context exists. Adding "http" is fallback position.
• Removed "obsolete" state from DotNetNuke.Services.Mail.Mail.Sendmail.
• Fixed rare issue where the install wizard could leak useful database connection information under certain conditions.
• Fixed issue where messenging module failed to filter for dangerous html/script.

Security Fixes

• * None

Updated Modules/Providers

The following modules and providers have been updated in the 5.4.2 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• * None

Providers

• * None

Major Highlights

• Fixed issue with assembly version type.
• Fixed issue where system mails are sent from the recipient's email address instead of admin email address.
• Fixed issue with logo in Ribbon Bar.
• Fixed issue with race condition when adding entries to shared Dictionaries.
• Fixed issue with scheduler exceptions when more than one language is defined.
• Fixed issue when creating portals in non en-us culture.
• Fixed issue with adding a new language.
• Fixed issue with AJAX Script Manager
• Fixed issue with Source Package not opening correctly in Visual Studio.
• Fixed issue when logging into a multi-language portal when the user's preferred locale is not set.
• Fixed issue with generation of user links to use new Profile page.
• Fixed issue with multiple cancel buttons on Add User screen.
• Fixed issue with version number in Symbols package manifest.
• Added missing release notes for 5.4.
• Added label explaining portal localization drop-down on site settings. Updated static localization text to more friendly form.
• Updated version of Symbols package in manifest file.
• Improved 5.4.0 and 5.4.1 upgrade scripts to better handle upgrades when multiple languages are installed.

Security Fixes

• * None

Updated Modules/Providers

The following modules and providers have been updated in the 5.4.1 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Form and List Module 05.01.03
• Blog Module 04.00.00

Providers

• * None

Major Highlights

• Fixed issue where portal settings were not saved per portal.
• Fixed issue with importing page templates.
• Fixed issue with updating Site Settings.
• Fixed issue with System.Web.Extensions dependencies when running in ASP.NET 4.0
• Fixed issue with User Profile and Custom Registration modules
• Fixed the View Profile module so it displays a message if it is placed on a page which is not defined as the Portal's profile page.
• Fixed issue with content list module not being added to search results.
• Fixed issue with yellow screen on some upgrades.
• Fixed issue with the packaging of Telerik RadEditor Provider
• Fixed issue with displaying child folders in Telerik RADEditor Provider File dialogs.
• Fixed issue where the registration email was being sent to the user being registered instead of the admin user.
• Support icon in ribbon bar is now hidden in CE.
• security bulletin can be read @ http://www.dotnetnuke.com/News/Securitybulletinno34/tabid/1531/Default.aspx
• Fixed issue with missing fields in new vw_PortalsDefaultLanguage View
• Fixd issue with Tags skinobject which didn't validate for empty strings.
• Check issue DNN-12122, second to last paragraph. This behavior is according to spec.
• Fixed issue with the name of the Content List module
• Included latest release of Telerik controls.
• Ensured compatability with ASP.NET 4.0 runtime.
• Modified code to use more efficient string comparison methods.
• Ported TelerikEditorProvider to Community Edition
• Improved performance of GetTabPermissionsByPortal stored procedure.
• Improved efficiency of core object caching.
• Improved performance by precompiling commonly used regular expressions.
• Ribbon Bar Control Panel –The new ribbon bar control panel provides content contributors with more editing options in a highly convenient format, allowing users to create pages, install new modules, edit content, and preview pages more quickly and easily than ever before.
• added support for localising portal details. If a site is running with multiple active languages, the site settings page allows an administrator the ability to provide different settings for each language (culturecode). In addition, this supports a fallback strategy where if no record exists for a language, a check is made for a record for it's fallback, and if no record exists then it fall's back to the portal default language.

Security Fixes

• User account escalation Vulnerability

Updated Modules/Providers

The following modules and providers have been updated in the 5.4.0 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• FormAndList 05.01.02

Providers

• Telerik Editor Provider 05.04.00

Major Highlights

• Issue fixed where Newsletter module only sent SMTP test email.
• Issue fixed with signature change to Synchronize Folders methods.
• Fixed the issue with the email notifications where the From and To addresses were swapped.

Security Fixes

• None

Updated Modules/Providers

The following modules and providers have been updated in the 5.2.0 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• XML Module 04.03.05

Providers

• none

New Features

• Templated User Profiles - User profile pages are now publicly viewable
• Photo field in User Profile - Users can upload a photo to their profile
• User Messaging - Users can send direct messages to other system users
• Search Engine Sitemap Provider - The sitemap now allows module admins to plugin sitemap logic for individual modules.
• Taxonomy Manager - Administrators can create heirarchical category lists that can be shared and used across modules

Major Highlights

• Fixed issue with the Create New Module form not showing on upgrades.
• Fixed issue where the Create New Module wizard allowed the user to select an invalid 'Owner' folder.
• Fixed the issue where adding query strings such as Mid=Crash showed an error screen.
• Fixed issue where the dashboard controls failed to load if upgrading from a version prior to 5.1.0 to a later one.
• Fixed issue where create new module from manifest was not working
• Fixed issue where the red border around Administrator only content was not displayed after upgrading from 4.x
• Fixed the issue with the Market Place in the Solutions Explorer
• Fixed issue where GrantStoredProceduresPermission and GrantUserDefinedFunctionsPermission ran on every install/upgrade
• Fixed issue where logging in as Registered User throws PageLoadException in Event Viewer.
• Fixed issue with creating new language packs.
• Fixed issue with emails not having http in urls to external resources.
• Fixed issue with caching providers not being defined in web.config in some instances.
• Fixed issue where the User Image showed in the search drop down box in Manage Users.
• Updated the portaltemplate.xsd to cater for new fields.
• Update the Google Verification file content to match the new Google protocol.
• Updated the Installation Wizard's Finished button text to "Start building your new site!"
• Updated the default menu provider to use the DNNMenuNavigationProvider.
• Create Package button is now disabled until a package folder has been created.
• Reduced the number of user events that are logged.
• Optimized retrieving a module by its control key.
• Added code to store the site map priority as a number, which allows any valid localised single e.g. 0.5 or 0,6
• Added new logic to only allow cancelling a module installation if the Core Version is not sufficient for the module to be installed.
• Added extra checks to the upgrade application logic when removing core modules.
• Added a success message when exporting the Dashboard as xml.
• Added more validation around editing a module control definition
• Added the ability to disable portal folder synchronization on "hidden" folders.
• Added a new check to test if all extensions are installed that are present in a site template.

Security Fixes

• None

Updated Modules/Providers

The following modules and providers have been updated in the 5.3.0 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• None

Providers

• none

Major Highlights

• Fixed the issue where LinkClick.aspx links were incorrect for child portals
• Fixed the issue with the PayPal URL settings.
• Fixed the issue with logging into the site on 1st page load after upgrade.
• Fixed issue where hosted jQuery did not use the correct protocol when SSL enabled.
• Fixed issue with inconsistent file/folder permissions tests. Test now runs when the page is shown and user cannot progress until tests pass.
• Fixed the issue with the SynchronizeModule in all install modes causing an object reference error.
• Fixed issue where captcha control showed after succesful registration if the SMTP settings were not correct
• Fixed issue where error message failed to display if control was not created
• Fixed the issue where the Portal name was hard coded as 'PortalName' when assigning modules to portals.
• Fixed issue where security roles were not properly enforced between child portals.
• Fixed issue where large/javascript heavy pages could suffer from an MS Ajax DeserializePrimitiveObject Invocation error
• Fixed issue where the user is unable to change dbowner in the install wizard.
• Fixed issue where spaces in control names caused error in new module control wizard
• Fixed issue with allowing a blank database name in Installation Wizard.
• Fixed the issue where the www. subdomain of a domain is not part of the portal aliases of a portal
• Fixed issue where the Parent Tab was not showing in drop down if the user had no edit rights on it.
• Fixed issue where list values in profile properties only work on Portal with PortalID=0
• Fixed issue when unzipping files in the Host File Manager
• Fixed issue where module message warning was not XHTML compliant
• Fixed the issue where sometimes there were event log errors during installation from importing HTML modules.
• Fixed issue where installer feedback was not using passed parameter to output feeback messages
• Fixed issue with custom name space in Starter Kits.
• Fixed issue where errors were logged during automated installs.
• Enhanced create new module form to split file language and file name onto seperate lines, and updated help text
• Fixed missing objectqualifer in dataprovider script which could fail to update installs without a default language
• Updated data provider reference to use fully qualified typename which could cause compilation issues with third party modules in some rare instances.
• Fixed validation error handling in new module wizard
• Updated text on create new module screen to clarify that make new folder is only available on "New" option
• Fixed issue where it was possible to create a module with a name or friendlyname the same as an existing package
• Fixed issue where invalid control name could crash New Module wizard
• Fixed the validation of Module Control Name when creating a new module manually.
• Enhanced New Module wizard to make friendly name a required field.
• When using the create new module you can specify a control with spaces e.g. "my control". Whilst this is valid for a control definition, as that is used to create the file and also the inherits statement an error is caused as neither of support spaces. To resolve we added code to remove spaces from control names as they're not allowed.
• Modified Install Wizard so that all tests must pass before installtion may proceed. Tests are conducted either on entering the page or on clicking the Next button.
• Updated layout and help text of the "Create New Module" form and added some code to remove spaces from module names to ensure only valid files are created.
• Added the ability to use the PayPal sandbox for validating PayPal configuration

Security Fixes

• User account escalation Vulnerability

Updated Modules/Providers

The following modules and providers have been updated in the 5.2.0 packages. Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Events Module 05.00.03

Providers

• none

Major Highlights

• Fixed issue where tabname lookup's were case-sensitive and caused problems when loading controls.
• Fixed issue where Captcha control did not include a value for the Alt attribute.
• Fixed issue where the Create New Module wizard allowed the user to select an invalid 'Owner' folder.
• Fixed issue where uninstalling a module with 'delete files' unchecked deletes the files anyway.
• Fixed issue where GetMappedDirectory would log an exception during install.
• Fixed issue where the Starter kit was missing the HTML module.
• Fixed issue where the source package did not include the HTML module.
• Fixed issue with missing databaseowner and objectqualifier tags in the 5.2.1 SqlDataProvider script.
• Fixed issue where portal templates ceased working in 5.2.1.
• Fixed issue with page quotas where GetTabCount stored procedure had not been updated for localization changes introduced in 5.2.0.
• Fixed issue where Host email test fails but no email addresses are listed in the error message.
• Fixed issue where temp files were left if extension installation was cancelled.
• Fixed issue where Captcha was not regenerated if login failed.
• Reverted syntax that grants stored procedure permissions to previous version, as GRANT EXECUTE TO was problematic on shared hosts.
• Fixed issue where vendor registration email did not contain the vendor name.
• Added the ability to specify a custom animation function for the Visibility Widget.
• Updated title and help text to make optional for forcing a captcha for associating logins clearer.
• Added documentation to the Dynamic Module template that is displayed when a new module is created using the template.

Security Fixes

• None

Updated Modules/Providers

No modules or providers have been updated in the 5.2.2 packages.

Major Highlights

• Fixed issue where banners were not properly rotated according to the specified views/clicks
•  Fixed issue where upgrades could fail if the the user account did not have permission to update objects in some db schemas
• Fixed issue where list values were visible outside of the Portal where they were created.
• Fixed issue where caching providers were not rendering unicode characters properly.
• Fixed issue with missing Telerik assembly in the source package.
• Fixed issue where Ajax HostSetting was not properly set on upgrade from 4.x installations.
• Fixed issues where upgrades would fail with a unique index violation
• Fixed issue with the Starter Kit which was missing HTML module files
• Fixed issue where page templates were not working correctly
• Fixed default settings for the module and output caching providers
• Fixed issue which prevented Blog module from working after some upgrades to 5.x
• Fixed issue when creating a new module in the Module Definition Wizard if the .ascx extension was not specified.
• Fixed issue where localization was not working if the application virtual directory name was also part of the module name.
• Fixed issue where the FriendlyName for Schedule Items was not being saved.
• Fixed issue where GetUserCountByPortal was making excessive database calls instead of using cached values
• Added binding redirect setting in web.config to prevent versioning issues with Telerik assembly

Security Fixes

• none

Updated Modules/Providers

The following modules and providers have been updated in the 5.2.0 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Form and List 05.01.01

Providers

• FileModuleCachingProvider 05.02.01
• MemoryModuleCachingProvider 05.02.01
• SchedulingProvider 05.02.01

Major Highlights

• Added Module Information to the Help page
• Added ability to view and edit the source files for a module
• Enhanced the module creation wizard to simplify creating new module definitions
• Added the ability to automatically create a test page as a step in the module creation wizard
• Added a core API to support content localization
• Added the ability to import/export page and module settings
• Added the ability to immediately run a scheduled task
• Added module caching provider API
• Converted existing module caching feature to use new provider
• Added page output caching provider API
• Fixed issue where upgraded sites do not properly set the default Language
• Fixed issue where scheduler could execute a a long-running task multiple times
• Fixed issue where improperly formatted email addresses could result in error when sending system emails
• Fixed issue which resulted in incorrect URL for SiteMap in a child portal
• Fixed issue which caused error when deleting files from the Host file manager.

Security Fixes

• Fixed issue where Install Wizard could leak version information to anonymous users
• Fixed issue where search page might be vulnerable to script injection

Updated Modules/Providers

The following modules and providers have been updated in the 5.2.0 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• HTML 05.02.00
• Gallery 04.03.00
• Wiki 04.02.00

Providers

• FileModuleCachingProvider 05.02.00
• MemoryModuleCachingProvider 05.02.00

Major Highlights

• Added the ability to specify a subject line when emailing event viewer logs
• Modified the event viewer to include event logs as email attachments when emailing the event logs
• Added the ability to use dictionary objects for token replacement in system messages
• Fixed an issue which caused an error whenever edititng the Site Settings.
• Fixed issue which caused an error trying to retrieve a role group by name
• Fixed an issue which prevented a skin from being able to be re-installed or uninstalled.
• Fixed issue where Html module was displaying unpublished content
• Fixed issue where URLs for pages within the site were always being created as relative which is a change from previous versions.
• Removed solution explorer page from the Admin menu and removed the Marketplace feed from the OPML file.
• Fixed issue with upgrading DotNetNuke 4.x skins when upgrading site to DotNetNuke 5.x
• Fixed issue which resulted in incorrect URL for SiteMap in a child portal
• Fixed issue which caused error when deleting files from the Host file manager.

Security Fixes

• None

Updated Modules/Providers

The following modules and providers have been updated in the 5.1.3 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• HTML 05.01.04
• Form and Lists 05.00.03
• Forum 04.05.03

Providers

• AspNetMembershipProvider 05.01.03
• DNNMembershipProvider 05.01.03
• FileBasedCachingProvider 05.01.03

Major Highlights

• Fixed issue which caused modules not be properly upgraded to 5.x if they were missing a manifest file
• Fixed issue where register link on the login module did not work when portal was configured for private membership
• Fixed issue where en-US language was always enabled after an upgrade
• Fixed issue where the language pack writer was not creating full language packs.
• Re-added the PageStatePersistence setting to the Host Settings page with additional warning messages.
• Fixed breaking change in ActionBase where properties were inadvertently removed instead of being marked obsolete.
• Fixed issue where User settings were relying on default values, but the email API was not aware of the defaults.
• Fixed issue where the HasObjectDependencies property of ScheduleItem was not properly calculated.

Security Fixes

• HTML/Script Code Injection Vulnerability in ClientAPI
• HTML/Script Code Injection Vulnerability when operating with multiple languages

Updated Modules/Providers

The following modules and providers have been updated in the 5.1.2 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• HTML 05.01.03
• Events 05.00.02

Assemblies

• WebControls 02.02.00
• ClientAPI 04.01.02

Providers

• none

Major Highlights

• Fixed issue which mis-assigned page permissions to new modules
• Fixed issue where a fallback language is not defined
• Fixed issue  where portal administrator could not manage user roles
• Added core sqlconnection pool segmentation to protect core from any module issues
• Fixed issue where Authenticated Caching setting was not getting saved correctly
• Fixed issue where code sub-directories are not properly removed in web.config
• Fixed issue with UpgradeIndicator which could throw an error under some conditions
• Fixed issue where data could become corrupted under extremely heavy load
• Fixed issue where GetPortalRoles stored procedure was missing new audit fields
• Fixed issue where some DataReaders were not guaranteed to be closed if an error occured
• Fixed issue where GetFolders API method was changed resulting in a breaking change
• Improved performance by removing use of regular expressions in Globals.CreateValidId
• Fixed issue where all installed languages are enabled on all portals after an upgrade
• Fixed sitemap priority to use invariant format
• Fixed issue where 05.00.00 SQL Upgrade script is incompatible with SQL Server 2000
• Fixed issue where HTML/TEXT module was not correctly handling Encoded data
• Fixed issue where hierarchical lists are not properly deleted
• Fixed performance issue where delayed loading of some PortalSettings results in race condition
• Fixed issue where banners were not properly rotated
• Fixed issue where "Create Language Pack" creates an empty package
• Fixed upgrade issue when Active Directory provider is installed
• Fixed issue which changed the Edit Module permission in 5.1 and restored the 4.9.4 behavior.
• Fixed issue where the resource verifier misses files to report
• Fixed issue with control panel after installing the Turkish Language Pack
• Fixed issue where deprecated properties of the Membership provider resulted in errors in the Token Replace API
• Fixed PageLoadException errors caused by specific UserAgents being mis-identified by the browser definition files
• Fixed issue where "Premium Modules" settings don't work for upgraded sites
• Removed Classic ControlPanel from the distribution
• Improved locking mechanism of GetCachedData

Security Fixes

• none

Updated Modules/Providers

The following modules and providers have been updated in the 5.1.1 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• HTML 05.01.01

Providers

• FilebasedCachingProvider 05.01.01
• DatabaseLoggingProvider 05.01.01
• AspNetMembershipProvider 05.01.01
• DNNMembershipProvider 05.01.01
• SearchProvider 05.01.01

Major Highlights

• Added Content Versioning and simple workflow to the HTML module.
• Added Admin Console module to simplify access to administrator and host pages
• Added publicly accessbile skin engine lifecycle events
• Added audit trails to core system tables
• Added built in support for Google Analytics
• Added custom sitemap priorities
• Enhanced the permission system to use the provider model, allowing for custom permission providers
• Enhanced caching to enable access by distributed caching systems
• Enhanced installation and upgrade logic to automatically detect .Net 3.5 and to upgrade the web.config as appropriate.
• Enhanced the extensions pages to show which modules are used and to show the pages where they are currently in use
• Enhanced the Scheduler to show a checklist of available servers in the webfarm where scheduled tasks can be executed.
• Enhanced the Scheduler to support multiple instances running on the same server
• Fixed issue with removing SuperUser role from a user.
• Fixed issue with deleting users which was not fully recognized by the rest of the application.
• Fixed issue with upgrades which would fail if .Net 3.5 was installed
• Fixed issue with skins installed using the batch installer.
• Fixed change to GetModulesByDefinition API method which resulted in breaking change from DotNetNuke 4.x
• Fixed CloakText API method which was broken in 5.0.1
• Fixed issue with stored procedure for Dashboard which would fail with an error if database account did not have permissions to the MSDB database.
• Fixed issue where pages added while on a host page will not be associated with a portal.
• Fixed issue where the ReturnURL for the SendPassword and Register links on the Login page were broken.

Security Fixes

• none

Updated Modules/Providers

The following modules and providers have been updated in the 5.1.0 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Forms and List 05.00.02
• Announcements 04.00.03
• Reports 05.01.00
• Events 05.00.01

Providers

• FckHtmlEditorProvider 02.00.04
• AD Provider 05.00.02

Major Highlights

• Added the ability to automatically update user roles without requiring the user to logout and log back in.
• Changed the user deletion code to use a soft-delete rather than removing the user record.  This ensures that modules like the Forums behave correctly for a previously "deleted" user.
• Added IP logging to the User's table to capture the last IP address from which a user logged in.
• Fixed breaking change with case sensitivity in the name of skin panes.  This fix restores the case-insensitivity of previous DotNetNuke releases.
• Fixed breaking change with ModuleId in DotNetNuke 5.0 which changed ModuleId to a readonly value.
• Fixed breaking change in CBO.FillDictionary to restore previous behavior.
• Fixed breaking change which prevented legacy skins from being installed when using the auto-install option.
• Fixed breaking change which prevented updated DLLs from being replaced when repairing a module installation.
• Fixed breaking change in HumanFriendlyUrls which prevented querystrings from being properly read when using HumanFriendlyUrls
• Fixed breaking change in legacy modules which would not store a zip file which was not designated as a resource file.
• Fixed breaking change in legacy modules which ignored zip directories.  DNN 5 changed this behavior.
• Fixed breaking change in default.css which resulted in changes to existing skin layouts.
• Fixed issue with roles module which prevented users from delegating role administration to a non-admin user.
• Fixed issue which prevented some users from logging out due to the inability of the system to detect their country.
• Fixed issue with Module Action Menu which prevented it from opening links in new windows.
• Fixed issue that results in an error when the Cache logs an error under the new CACHE_ERROR event type
• Fixed a packaging issue with FCKEditor which caused the LinkEditor to cause an unhandled exception.
• Fixed an issue which resulted in the system not being able to display the portalaliases screen

Security Fixes

• Fixed version nformation leakage issue in the install wizard

Updated Modules/Providers

The following modules and providers have been updated in the 5.0.1 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Forms and List 05.00.00

Providers

• FckHtmlEditorProvider 2.0.3
• AD Provider 05.00.01

Major Highlights

• Added jQuery support to the core platform.  jQuery will now be distributed as part of the DotNetNuke installation and will be available for use by module developers.
• Added support for Internet Explorer 8 Web Slices.  Administrators can configure any module to use IE8 Web Slices including the ability to set time-to-live and expiration values.
• Removed distinction between admin modules and pages and normal pages.  This allows administrators to easily delegate access to any portion of the application to any group of users.
• Updated the installation services to support manifest files for all extension types.  Now skins, containers, providers and modules are all first class citizens that can be installed and uninstalled.
• Expanded XHTML, WCAG and ADA compliance.
• Refactored core to improve support for Unit Testing.  Refactored several core classes to use interfaces and added a simple component factory to provide dependency injection support. 
• Added ability to deny permissions in the permissions grid.  This new feature extends the permission framework to give administrators greater flexibility in defining permissions.
• Added Widget framework.  The new Widget framework allows you to quickly add JavaScript/html widgets to your site with very little effort.  The framework supports the use of a simple object tag based representation which means you don’t have to know JavaScript in order to add the widgets.
• Added new Object notation for using skin objects in Skins.  Skin designers will no longer need to include separate XML files when creating and packaging skins.  No more funky “[SKINOBJECT]” tags littering your html.  This significantly simplifies the process of creating skins and further opens up skin development to a broader group of designers.  If you include a simple JavaScript reference in your HTML skin, you can even get a full WYSIWYG experience when designing your skin.

Security Fixes

• Includes a rollup of all 4.x security fixes

Updated Modules/Providers

The following modules and providers have been updated in the 5.0.0 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Providers

• AD Authentication Provider 05.00.00

In addition to these highlights there are literally hundreds of bug fixes in this release.

Major Highlights

• Fixed issue which caused the starter kit not to install properly
• Fixed issue where cache was not working properly for web crawlers

Security Fixes

• HTML/Script Code Injection Vulnerability in ClientAPI
• HTML/Script Code Injection Vulnerability when operating with multiple languages

Updated Modules/Providers

The following modules and providers have been updated in the 4.9.5 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• HTML 04.09.05
• Events 05.00.02

Assemblies

• WebControls 02.02.00
• ClientAPI 04.01.02

Providers

• none

Major Highlights

• Fixed a major module caching issue which resulted in empty content for webcrawlers
• Improved performance of FormatRemoveSQL method

Security Fixes

• Low - Errorpage information leakage
• Low - HTML/Script Code Injection Vulnerability

Updated Modules/Providers

The following modules and providers have been updated in the 4.9.4 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Announcements 04.00.03

Providers

• Removed the AD Provider so that it cannot be installed by the Install Wizard.  It can still be manually installed.

Major Highlights

• Add Office 2007 File Extensions to default allowable file extensions in Host Settings
• Add reference to SQL Server 2008 to Install Wizard to make it clear that SQL Server 2008 is supported
• Moved Whats New Module/Page to Host menu as it contains content which is not applicable to the Administrator
• Corrected a problem with "Auto" installation option which would occur when using a non-dbo database user
• Inline updates to Text/HTML were not HTML encoded when stored in the database
• App_Browser renamed to App_Browsers in order for ASP.NET to recognize it incorrectly
• Pages in the navigation menu linked directly to a file no longer served the file correctly
• Can not delete Portal if search items exist in the database which are associated to the portal
• Removed None Specified option for Folders in Page Export feature as it could cause an error if a user clicked Export without selecting a folder.
• Fixed major performance issue when adding new portals which would cause the system to unload and reload all cached objects

Security Fixes

• Low - HTML/Script Code Injection Vulnerability

Updated Modules/Providers

The following modules and providers have been updated in the 4.9.3 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Announcements 04.00.02

Providers

• None

Major Highlights

• Added the ability to perform permanent redirect from an existing page using the page settings screen.
• Fixed issue with the permanent forms authentication cookie which cause problems in SSO environments.
• Fixed issue which required a workaround to import page templates into a portal
• Fixed a caching issue which prevented modules from being properly cached if they used a specific caching method overload
• Fixed issue which resulted in an error installing the Broadcast Polling Provider
• Fixed tab redirect issue which allowed a user to directly navigate to a tab which was supposed to redirect to another URL
• Fixed a continuous redirect issue which occurred when trying to upgrade from early 4.x releases to 4.9.1

Security Fixes

• None

Updated Modules/Providers

The following modules and providers have been updated in the 4.9.2 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• None

Providers

• FckEditor Provider 2.0.3

Major Highlights

• Fixed issue with the cache which was preventing proper operation of the scheduler.
• Fixed issue with web crawlers which could cause thrashing in the cache
• Fixed issue with the EventQueue to remove events that result in an error.  This prevents an event from filling the event log with errors.
• Fixed issue with the RoleController.GetUserRoles method which introduced a breaking change in 4.9.0.
• Added a new column to the version table to distinguish between Community Edition and Professional Edition installs
• Added a new feature for logging server restarts in a web farm environment.
• Added a new admin Dashboard page.  The dashboard provides a single page where hosts can view an overall snapshot of their site.

Security Fixes

• Critical - User can access additional roles for which they do not have permissions

Updated Modules/Providers

The following modules and providers have been updated in the 4.9.1 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Survey 04.60.00

Providers

• AD Authentication Provider 01.00.05

Major Highlights

• Fixed issues with the URL Rewriter.  There were several issues which could result in unreachable pages using friendly URLs.  We have added in validation logic to prevent pages from being created which would violate folder naming standards or which would result in two pages receiving the same Human Friendly URL.
• Fixed longstanding issue in the file based caching provider.  There was invalid logic in the caching provider which prevented it from working correctly.  The provider has been re-written to resolve the problem and provide a stable platform for web-farm scenarios.
• Fixed several dictionary errors.  These errors mostly occurred under heavy load or were otherwise intermittent.  Dictionary usage was evaluated throughout DNN and updated to utilize thread-safe approaches for updating and caching the dictionary.
• Fixed an issue that prevented users in certain locales from adding modules to div based panes.
• Added a new default skin that is more contemporary
• Added a new default template that removes much of the clutter and unnecessary information.
• Added a new Text skin object that allows you to add localized text to your skin.
• Added a new Styles skin object that allows you to insert additional stylesheets into the page header.  Stylesheets can be optionally included using IE Conditional Comments.
• Enhanced the Search skin object to include the option to display a dropdown list of web/site search options.
• Enhanced the Update Notification Service to display information on new language packs that are available for locales which are currently installed.

Security Fixes

• Critical - Authentication blindspot in User functions
• Critical - Validation failure in Repository Module
• Critical - Validation failure when loading skins
• Low - Information leakage in Install Wizard

Updated Modules/Providers

The following modules and providers have been updated in the 4.9.0 packages.  Please see the specific project pages for notes on what bugs or enhancements were corrected with each release.

Modules

• Documents 04.01.00
• Events 04.00.02
• Help 03.00.02
• HTML 04.08.01
• Links 04.00.01
• NewsFeeds 04.00.00
• Repository 03.01.15
• Survey 04.50.00
• UserDefinedTable 03.05.01
• Wiki 04.01.00

Providers

• FCK Html Editor Provider 02.00.02
• AD Authentication Provider 01.00.04