TWiki Release 4.3.2 (Georgetown), 2009-09-02

Introduction

TWiki-4.3.0 released on 2009-03-30 introduces security enhancements, usability enhancements, feature enhancements, and adds extensions to strengthen TWiki as an enterprise collaboration platform.

TWiki-4.3.1 released on 2009-04-29 introduces security enhancements. This release also introduces use of ISO date format by default.

TWiki-4.3.2 released on 2009-09-02 introduces security enhancements (CSRF fix). WYSIWYG editing is enhanced as well, the TinyMCEPlugin is upgraded with latest tinyMCE Javascript library.

It is highly recommended to upgrade to TWiki-4.3.2. Users will find this release much more stable and secure in daily use.

Pre-installed Extensions

TWiki-4.3.2 ships with:

• Plugins: CommentPlugin, EditTablePlugin, EmptyPlugin, HeadlinesPlugin, InterwikiPlugin, PreferencesPlugin, RenderListPlugin, SlideShowPlugin, SmiliesPlugin, SpreadSheetPlugin, TablePlugin, TinyMCEPlugin, TWikiNetSkinPlugin, TwistyPlugin, WysiwygPlugin
• Contribs: BehaviourContrib, JSCalendarContrib, MailerContrib, TipsContrib, TWikiUserMappingContrib, TwistyContrib
• Skins: ClassicSkin, PatternSkin, TWikiNetSkin,

Note: HeadlinesPlugin, TWikiNetSkin and TWikiNetSkinPlugin are new in TWiki-4.3.0.

New Features Highlights

• Security Enhancements
  • Reduced risk of XSS (cross-site scripting)
  • Reduced risk CSRF (cross-site request forgery) - added in TWiki-4.3.1
  • S/MIME support to sign administrative e-mails
• Usability Enhancements
  • Replace question mark links with red-links to point to non-existing topics
  • Use ISO date format by default - added in TWiki-4.3.1
• Enterprise Collaboration Enhancements
  • Pre-installed HeadlinesPlugin to show headline newsfeeds in TWiki topics
  • Pre-installed TWikiNetSkin, TWikiNetSkinPlugin for corporate look and feel
• Search Enhancements
  • Add footer parameter to Formatted Search
  • Add number of topics to Formatted Search
• Miscellaneous Feature Enhancements
  • Control over variable expansion at topic creation time
  • 17 new TWikiDocGraphics images
  • Include URL supports list of domains to exclude from proxy
  • Adding Korean language
• Plugin Enhancements
  • SpreadSheetPlugin: 5 new functions

See the full list of bug fixes at the bottom of this topic.

Important Changes

1. Added protection against CSRF (cross-site request forgery) in TWiki 4.3.2 patch release

TWiki protects content updates with a one-time-use crypt token to guard against CSRF exploits. This means that it is no longer possible to hit the browser back button to fix a typo; you get an "invalid crypt token" error message if you try to save again. Workaround: Instead of browser back button, hit the "Edit" button to fix a typo.

There is a balance between security and user convenience. A TWiki administrator can enable and disable the crypt token based CSRF protection with the {CryptToken}{Enable} configure setting. For mission critical public TWiki sites it is recommended to enable the crypt token; for firewalled TWiki sites it is usually OK to disable it.

Deprecation Notices

The %MAINWEB% and %TWIKIWEB% variables have been deprecated. For compatibility reasons they are unlikely to ever be removed completely, but you should use the %USERSWEB% and %SYSTEMWEB% variables instead.

In Func getOopsUrl and permissionsSet have been declared deprecated. There is no plan to remove them yet.

TWiki-4.3.0 Minor Release - Details

TWiki-4.3.0 was built from SVN http://svn.twiki.org/svn/twiki/branches/TWikiRelease04x03 revision 17948 (2009-03-30)

Highlights

• Security:
  • Review code for robustness and security
  • Secure configure script with taint mode turned on
• Rendering:
  • %TOC% does not distinguish two headlines that have the same text
  • TablePlugin produces bad links for sorting when using "short" URLs
  • %SCRIPTSUFFIX% is added twice in %TOC% links
  • Incorrect Content-length breaks HTTP headers, a.o. pound fail results
  • TablePlugin: Date sorting is broken
  • Bullet lists in form fields are not rendered properly
  • TWiki Forms expand variables like $nop, $quote $percnt
  • TwistyPlugin: Twisty can't be placed in TWiki table cells
• Users and groups:
  • TWikiGroups shows all members twice
• Editing:
  • WysiwygPlugin: Bolding single character within a word introduces spaces around bolded character
• Miscellaneous:
  • configure's get more extensions does not work well without LWP
  • CommentPlugin: Lost data if it's targeted before/after a missing anchor
  • Plugin installation fails on windows: extender.pl line 684
  • Statistics script does not handle properly topics with special characters

Enhancements

Fixes

TWiki 4.3.1 Patch Release - Details

TWiki-4.3.1 was built from SVN http://svn.twiki.org/svn/twiki/branches/TWikiRelease04x03 revision 18054 (2009-04-29)

Highlights

• Security:
  • TWiki:Codev/SecurityAlert-CVE-2009-1339: A remote user may gain TWiki admin privileges with a specially crafted image tag. This cross-site request forgery vulnerability existed because TWiki allowed HTTP GET to save content.
• Usability:
  • Use of ISO format date promoted in this release
• Handling URLPARAM:
  • The handling of URLPARAM for empty or missing was corrected in this release.

Enhancements

Fixes

TWiki 4.3.2 Patch Release - Details

TWiki-4.3.2 was built from SVN http://svn.twiki.org/svn/twiki/branches/TWikiRelease04x03 revision 18148 (2009-09-02)

Highlights

• Security:
  • TWiki:Codev/SecurityAuditTokenBasedCsrfFix: Hardening TWiki content update with a crypt token based fix against cross-site request forgery vulnerabilities.

Enhancements

Fixes

Related Topic: TWikiHistory, TWikiInstallationGuide, TWikiUpgradeGuide