While 1.1.5 is primarily a security focused release, it also comes with more than 120 bug fixes and improvements related to 1.1.4. For those of you that can’t wait to get their hands on it: head over to the download page.

Update: The VMware images , FoswikiOnUsb, RHEL6/Centos6 and Debian/Ubuntu installs have been updated to the Foswiki latest release.

Improvements to User Registration

• The complete fix for CVE-2012-1004 has been integrated, including pluggable field validations in the User Mapper. If your installation uses a custom user mapper, there is a new function in the base user mapper lib/Foswiki/Users.pm, that performs registration field validations. Override this method in your custom user mapper to add site specific validations.
• The user registration and group management API calls now all return error messages describing any failures. All errors are processed through MAKETEXT so that they are translated to the selected language.
• New options can reject duplicate registrations using the same email, and can either white-list or black-list email domains from registering.

Improvements to .htpasswd handling

• The HtPasswdUser password manager has been changed to globally cache the password file if enabled. In an installation running fcgi or mod_perl, this will reduce the overhead of reading the file for each transaction.
• The .htpasswd lock file is now configurable. There was a small risk that when multiple foswiki installations shared a common .htpasswd file, simultaneous updates would not be prevented, resulting in file corruption.
• The default for {Htpasswd}{Encoding} has been changed to apache-md5. We strongly recommend that installations migrate away from crypt encoding – the prior default. crypt truncates passwords at 8 characters.
• The {Htpasswd}{AutoDetect} option is enabled by default. This ensures that an existing .htpasswd file cannot be accidentally corrupted due to the change in default encoding.
• A new password encoding hash has been added. bcrypt encoding. (Ref. http://yorickpeterse.com/articles/use-bcrypt-fool )

Better session support for mixed http and https environments

If your foswiki is set up to accept both https and http requests, your users may find themselves logged out much faster than desired. 1.1.5 fixes this by using separate authentication session cookies when using http and https, but this may mean your users may need to login again. This applies to both TemplateLogin and ApacheLogin.

Changes to the configure password handling

The encoding of the bin/configure and “sudo” admin user has been changed. Sites should change their configure password as soon as possible. Note that this change is not backwards compatible. Once the password has been changed, if fallback to 1.1.4 is required, the password will have to be reset by removing the password from lib/LocalSite.cfg.

Changes to Statistics processing

The WebStatistics topics are no longer shipped with Foswiki. Two new topics have been included; DefaultWebStatistics and WebStatisticsTemplate. The statistics script now has the optional capability of creating the missing WebStatistics topics.

• The Foswiki configuration has a new parameter: {Stats}{AutoCreateTopic} (Default is disabled)
• The statistics script has a new parameter: -autocreate 1 or autocreate=1 (Default is 0 or disabled)
• The statistics script must now only be run using POST. HTML GET should never result in an update.

Changes to PlainFile logger to improve log rotation

In previous versions of foswiki, the default PlainFile logger failed to rotate the logs if any log records were corrupted. This is more likely in the error log file, but can be caused by any log record that is written containing embedded newlines. If a log record is read without the expected | Timestamp | as the first column, rotation stops.

This behavior has been corrected, however sites where rotation was failing may have extremely large log files. When foswiki performs the rotation at the beginning of the next month, rotation can take an extended time, resulting in extended response time.

Rotation is performed when the timestamp of the log file (events.log, error.log, debug.log) is in a month prior to the current month. In order for rotation to proceed:

• The directory containing the log files must be writable.
• Archive files named [logfile].YYYYMM must not exist for any records in the current [logfile].log file.
  • For example, if events.log contains an event dated 2012-01-15:, then the archive file events.201201 must not exist.
• In order to force rotation and avoid extended web server response time:

• Quiesce the web server to prevent logging activity
• Upgrade to 1.1.5, which will install the updated lib/Foswiki/Logger/PlainFile.pm
• Reset the timestamps to the previous month on the logfile requiring rotation
  • touch -t 201202280101 events.log will set the timestamp to February 28th on a linux/unix system.
  • Windows users will need to install a 3rd party tool to change timestamps, or wait for the next month
• Change to the bin directory and run the view script from the shell as the web user.
  • sudo -u www ./view (Actual user will vary depending on the distribution)

The plainfile logger will now report additional information on the rotation process, including displaying bad records to STDERR. Edit lib/Foswiki/Logger/Plainfile.pm and change the line use constant TRACE => 0; to use constant TRACE => 1; to enable more detailed debug messages.

So far 1.1.5-RC1 has been very reliable, and RC2 will be “the release” unless new urgent issues are found. We plan to build 1.1.5 on April 10th.   You can download RC2 for testing from our Download Site.

foswiki.org has been updated to an early beta of release 1.1.5. We are not quite ready for a public beta. There are a number of release blocking bugs that we hope to get fixed over the next week or two, and translations still need to be completed. So don’t look for the 1.1.5-Beta1 download just yet. We installed the early beta to get some live testing of a bug in log file rotation, and will hopefully find that it is fixed when the March 1st rollover occurs.

Details of the release are in the Beta release notes.

Foswiki will have a booth on this year’s CeBIT fair sponsored by Linux New Media AG. So come visit us in Hall 2, Section E58 at the Open Source Forum 6th – 10th March. More information at http://foswiki.org/Community/FoswikiCeBIT2012.

One of the great strengths of Foswiki is that it stores topics in plain text files. This feature has proven its worth time and again, as Foswiki is able to quickly adapt to organisational change, easily support external processes that write to topics, and is quickly accessible for emergency measures. For an admin who has login access to the server, it’s very easy to use the command-line to make bulk changes to many topics simultaneously.

In Foswiki 1.1.4 we addressed a nasty bug that was inherited from the very earliest days of TWiki. This bug could result in serious history errors such as the wrong username being attributed to edits, incorrect revision numbers, and broken revision histories. Unfortunately there was a side-effect of this fix that anyone who modifies topics on the server needs to be aware of, and take action on.

Any process (or person) that changes a .txt file on the server must make sure that the corresponding .txt,v file is left with a file date that is equal to or more recent than the .txt file.

If you don’t do this, Foswiki will be forced to constantly re-read the .txt,v for the correct revision history, which can affect performance. Also, when such a topic is edited, Foswiki will create a new revision attributed to the “UnknownUser” to record that the topic was changed outside of Foswiki’s control. This is the correct behaviour in the general case, and will save less experienced users a lot of pain. However more experienced users may know that their changes are ’safe’ and that no change to the topic history is required. In this case, it is trivial to update the file date on the .txt,v file. In summary,

• After making any manual change to a .txt file on the server make sure that the corresponding .txt,v is ‘touched’ (use the UNIX ‘touch’ command, or simply text-edit and save the file)
• Scripts that make bulk changes to files – and external processes that write .txt files – should be modified to ‘touch’ the .txt,v files after writing.
• If you have already made such a change but can’t remember which files you changed, you can use the following linux command line to ‘touch’ all .txt,v files (this is perfectly safe)

find /path/to/foswiki/data -name '*.txt,v' -exec touch \{\} \;

Foswiki is now over 3 years old, and its still an extremely active project: Congratulations and thankyou!

The Foswiki Association’s Board has just elected the new Office holders:

• Chairman: Sven Dowideit
• Vice Chairman: Crawford Currie
• Treasurer: Oliver Krueger

As the new chairman, I hope to continue the great work that Crawford did in guiding our foundation so far, and take the opportunity I have to thank Kenneth for the work he did the last 2 years, and for the experience he has passed on to the Board in general.

For 2012, I have suggested that we work on improving our communications both within our community and towards the outside world – for example by developing more microblogging tools like the Extension News, and then creating a regular newsletter from those feeds. Given that foswiki is a do-ocracy, that means I just volunteered myself to building some more tools for foswiki.org, and then to write newsletters.

In case you’re still reading this, the Board has a question for you – we now have 1,385 euros in the bank, is there anything we could use this money for that would positively impact on the community, its growth and visibility?

Have a happy and productive 2012

It took 8 months and 2 days since the previous one to come out with yet another release of Foswiki, the Open Source Enterprise Wiki. Just in time before people dash off into Christmas holidays. So don’t forget to fetch your copy now available at http://foswiki.org/Download/DownloadFoswiki.

This release of Foswiki comes with quite some new features and more than 160 crunched bugs relative to the previous release. Here are some highlights:

Read up all the details on the full release notes.

The Foswiki team wishes you quiet and relaxing Christmas holidays. See you next year.

The intrepid Foswiki computer science & engineering team, prepared with appropriate safety gear, about to delve into the core. Boldly seeking new discoveries and features to enhance Foswiki for the benefit of all. More at Sven’s photo stream …

We’ve carried on with the Foswiki Camp today, and wow, has it been a productive camp!

Andrew Jones has done an amazing job leading the effort on using PSGI / Plack to replace the low-level Foswiki engine, for simplified installation and ease of support across a wide range of platforms.

Andrew has also taken significant steps towards simplifying the installation documentation for new users.

Michael Daum has led the development of a super new plugin that helps admins find out what extensions can be upgraded on their installs. A bit of documentation and it’ll be ready for prime-time.

Olivier Raginel has led the move to git – we’ve managed to convert all the hooks, set up the DNS and otherwise get lots of preparation done.

Arthur Clemens has implemented support for displaying each search result differently, based on any attribute of the topic the result was found in. This makes the presentation of search results much sexier.

Arthur has also done a power of work on the awesome new base skin.

Padraig Lennon has led the development of a new “WikiApps” web on foswiki.org that helps people share and explore wiki applications in a simple and effective way.

Everyone at the camp has been fully engaged and productive – even to the extent of turning down free beers in order to keep on working!

We’ve been having fun at the 2011 Foswiki Camp! As well as some great discussions (and surprisingly few arguments) we have turned our hands to some hardcore hacking. Here’s some of what we’ve been working on:

• A new skin that will provide a strong base for the default install, and a good platform to build more sophisticated skins on. We’re applying learnings from many different skin developments to create a modern, HTML5-ready, easy to extend, look and feel.
• An exciting new methodology for packaging wiki applications, including a “play pen” which allows end users to try out applications in their own safe environment on foswiki.org, before deciding whether to install or not.
• Simplified and refined installation documentation for the core.
• First steps in replacing the Foswiki::Engine and low level CGI code, with the modern web ‘Plack’ framework (the Perl equivalent of Ruby’s excellent ‘Rack’).
• A clever new plugin that will notify foswiki admins when extension updates become available, that affect their own installations, saving them from missing out on important releases.
• A nice mind-map

What we haven’t started yet, but hope to get to tomorrow:

• Help people to share their own wiki applications on foswiki.org, in an easily accessible way.
• Ease the handling of attachments, supporting multi-upload using drag and drop, pagination through large lists, and download of zip archives of multiple attachments.
• Attack the “unicode” branch with interactive testing, to see how big the hole is.

Other messages that have come from the last couple of days include:

• We want to make Foswiki something that our users never grow out of, and that means keeping up with the technology curve. Store2, unicode, and Plack are all exciting advances that help us enormously.
• Continuity – ensuring safety of data and applications – always has been, and always will be, incredibly important to us.
• We really need to have more of these camps! The ideas exchanged, and the work done, have been incredible. The more the merrier!