Originally Posted by intel352

Funny how the email from Qualiteam minimized the size of this upgrade, yet it's still a pretty sizable changelog. Regardless, gj Qualiteam

Originally Posted by JWait

Looking at the DIFF files, a lot of them do nothing but "update" the version number and date of the file.

Originally Posted by georgewf

Minor disaster doing this upgrade, but I am getting through it. Big problems with some include/func/*.php upgrades, and then some new security mechanism locked me out of my store because the SQL patch had not been applied. So I applied the patch through phpmyadmin.

Noted a discrepancy in

include/templater/plugins/modifier.escape.php ...already patched

In fact the gold version I downloaded for reference does not match the patch version.

include\templater\plugins\modifier.escape.php

case 'htmlall':
$string = func_unhtmlentities($string);

is not the same in the gold version. So should I take it out of the patched version or should Qualiteam add it to the gold version?

George

Originally Posted by georgewf

I found the cause of the discrepancy - there was a security patch dated 7-31 which I applied

+++ include/templater/plugins/modifier.escape.php 2008-07-31 16:23:54.000000000 +0400
@@ -50,12 +50,14 @@

switch ($esc_type) {
case 'html':
+ $string = func_unhtmlentities($string);
if (phpversion() >= '4.1.0')
return htmlspecialchars($string, ENT_QUOTES, $char_set);
else
return htmlspecialchars($string, ENT_QUOTES);

case 'htmlall':
+ $string = func_unhtmlentities($string);
if (phpversion() >= '4.1.0')
return htmlentities($string, ENT_QUOTES, $char_set);
else


But the line after htmlall is not in the gold version distributive nor in the new patch. No idea if this is important or not. Could be nothing, or could be the cause of future subtle bugs impossible to track down.