Upgrade to Elgg 1.12.13

.scripts/release.php

@@ -34,10 +34,8 @@ function run_commands($commands) {
 
 $branch = "release-$version";
 
-
 // Setup. Version checks are here so we fail early if any deps are missing
 run_commands([
-	"tx --version",
 	"git --version",
 	"npm --version",
 	"node --version",
@@ -47,25 +45,6 @@ function run_commands($commands) {
 	"git checkout -B $branch",
 ]);
 
-// Update translations
-run_commands([
-	"tx pull -af --minimum-perc=95",
-]);
-
-// Clean translations
-$cleaner = new Elgg\I18n\ReleaseCleaner();
-$cleaner->cleanInstallation(dirname(__DIR__));
-foreach ($cleaner->log as $msg) {
-	echo "ReleaseCleaner: $msg\n";
-}
-
-run_commands([
-	"sphinx-build -b gettext docs docs/locale/pot",
-	"sphinx-intl build --locale-dir=docs/locale/",
-	"git add .",
-	"git commit -am \"chore(i18n): update translations\"",
-]);
-
 // Update version in composer.json
 $encoding = new \Elgg\Json\EmptyKeyEncoding();
 
@@ -77,6 +56,8 @@ function run_commands($commands) {
 
 // Generate changelog
 run_commands(array(
+	"sphinx-build -b gettext docs docs/locale/pot",
+	"sphinx-intl build --locale-dir=docs/locale/",
 	"npm install && npm update",
 	"node .scripts/write-changelog.js",
 	"git add .",

CHANGELOG.md

@@ -1,3 +1,36 @@
+<a name="1.12.13"></a>
+### 1.12.13  (2016-10-02)
+
+#### Contributors
+
+* Jerôme Bakker (3)
+* Steve Clay (2)
+* Sébastien Lemay (1)
+
+#### Bug Fixes
+
+* **core:** page owner entity only returns users/groups user can see ([0d333100](https://github.com/Elgg/Elgg/commit/0d33310031024aa8940f9d3bbe5cdd80f2a4da57))
+* **docs:** Fixed link to 'our supporters page' ([fe144644](https://github.com/Elgg/Elgg/commit/fe144644faa84f9849604abfd4c34efb2df0d165))
+* **notifications:** only prefetch subscribers for ElggEntities ([65be05c5](https://github.com/Elgg/Elgg/commit/65be05c567692694e052ae4711450b7c19f2d571))
+* **profile:** use correct default access for profile fields ([63a01b6f](https://github.com/Elgg/Elgg/commit/63a01b6f8c9314ddae5819e8194938c988871a60))
+
+
+<a name="1.12.12"></a>
+### 1.12.12  (2016-08-05)
+
+#### Contributors
+
+* Steve Clay (11)
+* Ismayil Khayredinov (2)
+
+#### Bug Fixes
+
+* **blog:** pass entity to the object/elements/full ([134c5b83](https://github.com/Elgg/Elgg/commit/134c5b837c476f36ff52ecbe4e1e5b213833df31))
+* **groups:** unfeaturing a group no longer leaves useless metadata ([2f3cf28a](https://github.com/Elgg/Elgg/commit/2f3cf28ac0d879fa13a874e99227faad6ef5bb4c))
+* **logging:** make clearer exception numbers are timestamps ([9c70596e](https://github.com/Elgg/Elgg/commit/9c70596e591198a72a713218ecdaf780f33539c2), closes [#9924](https://github.com/Elgg/Elgg/issues/9924))
+* **plugins:** now checks plugin instances before parsing priorities ([26d21f88](https://github.com/Elgg/Elgg/commit/26d21f886c809517890e8264ee4a6181293cad50))
+
+
 <a name="1.12.11"></a>
 ### 1.12.11  (2016-06-13)
 

COPYRIGHT.txt

@@ -1,14 +1,15 @@
 The follow individuals, companies, or entities have contributed significant 
 code to the Elgg project and share the copyright. (In alphabetical order.)
 
-Organizations:
-The MITRE Corportation (jricher@mitre.org)
-Curverider Ltd (info@elgg.com)
-
-Individuals:
 Steve Clay (steve@mrclay.org)
 Cash Costello (cash.costello@gmail.com)
 Brett Profitt (brett.profitt@gmail.com)
 Dave Tosh (davidgtosh@gmail.com)
 Ben Werdmuller (ben@benwerd.com)
 Evan Winslow (evan.b.winslow@gmail.com)
+
+Organizations:
+The MITRE Corportation (jricher@mitre.org)
+Curverider Ltd (info@elgg.com)
+
+When adding to this list, update the list of copyright owners in LICENSE.txt.

ChangeLog

@@ -1,3 +1,108 @@
+2016-10-02  Steve Clay <steve@mrclay.org>
+
+  	* CHANGELOG.md, composer.json, docs/locale/pot/about.pot,
+  docs/locale/pot/admin.pot, docs/locale/pot/appendix.pot,
+  docs/locale/pot/contribute.pot, docs/locale/pot/design.pot,
+  docs/locale/pot/guides.pot, docs/locale/pot/index.pot,
+  docs/locale/pot/intro.pot, docs/locale/pot/plugins.pot,
+  docs/locale/pot/tutorials.pot: chore(release): v1.12.13
+
+2016-09-28  Steve Clay <steve@mrclay.org>
+
+  	* engine/classes/Elgg/Forms/StickyForms.php, engine/lib/input.php:
+  security(forms): passwords no longer stored with sticky form data  Also makes
+  clearer the documentation for the sticky functions.
+
+2016-08-29  Steve Clay <steve@mrclay.org>
+
+  	* engine/classes/Elgg/Database/AccessCollections.php,
+  engine/tests/ElggCoreAccessSQLTest.php: chore(tests): test entity
+  accessibility in the notifications flow  Adds tests to verify that entities
+  with ACCESS_LOGGED_IN and ACCESS_PUBLIC are treated as accessible with
+  ignored access
+
+2016-09-06  iionly <iionly@gmx.de>
+
+  	* mod/bookmarks/actions/bookmarks/save.php, mod/bookmarks/languages/en.php,
+  mod/bookmarks/lib/bookmarks.php, mod/bookmarks/start.php,
+  mod/bookmarks/views/default/forms/bookmarks/save.php: chore(bookmarks):
+  Removal of unused 'shares' code and unused language strings from bookmarks
+
+2016-09-06  Steve Clay <steve@mrclay.org>
+
+  	* mod/pages/actions/pages/delete.php, mod/pages/actions/pages/edit.php,
+  mod/pages/lib/pages.php: fix(pages): operations keep track of more than 10
+  child pages  Sets `0` limit on queries for child queries, converts to
+  batches, some small refactoring for clarity.
+
+2016-08-29  Steve Clay <steve@mrclay.org>
+
+  	* mod/htmlawed/vendors/htmLawed/htmLawed.php,
+  mod/htmlawed/vendors/htmLawed/htmLawedTest.php,
+  mod/htmlawed/vendors/htmLawed/htmLawed_README.htm,
+  mod/htmlawed/vendors/htmLawed/htmLawed_README.txt,
+  .../vendors/htmLawed/htmLawed_TESTCASE.txt: security(htmlawed): upgrades
+  htmLawed to latest, currently 1.1.22  Fixes #10126
+
+2016-08-17  Steve Clay <steve@mrclay.org>
+
+  	* COPYRIGHT.txt, LICENSE.txt: docs(license): clarifies dual licensing in
+  LICENSE.txt
+
+2016-08-05  Steve Clay <steve@mrclay.org>
+
+  	* CHANGELOG.md, composer.json, docs/locale/pot/about.pot,
+  docs/locale/pot/admin.pot, docs/locale/pot/appendix.pot,
+  docs/locale/pot/contribute.pot, docs/locale/pot/design.pot,
+  docs/locale/pot/guides.pot, docs/locale/pot/index.pot,
+  docs/locale/pot/intro.pot, docs/locale/pot/plugins.pot,
+  docs/locale/pot/tutorials.pot: chore(release): v1.12.12
+
+2016-07-21  Steve Clay <steve@mrclay.org>
+
+  	* .scripts/languages.php, .scripts/release.php: chore(project): separate
+  i18n updates from releases  Language updates are super slow and ruin the DX
+  of cutting releases. Also, pairing them with releases puts a large amount of
+  pressure on core devs to rubber stamp language changes without any public
+  review.  This allows language files (code, not docs) to be updated
+  independently of releases. The follow up to this would be to update the docs
+  in 2.x to recommend running the language intake separately and sending in
+  standard pull requests independently of releases.
+
+2016-06-10  Steve Clay <steve@mrclay.org>
+
+  	* docs/guides/routing.rst, engine/lib/elgglib.php: chore(routing): reject
+  requests for unknown walled garden views  Existing code passed arbitrary
+  input (URL segment) into HTML attributes. Although URL segments are now HTML
+  escaped, we should not invite risk or present bad examples to devs.
+
+2016-07-18  Steve Clay <steve@mrclay.org>
+
+  	* js/tests/ElggSpinnerTest.js, views/default/js/elgg/spinner.js:
+  chore(tests): eliminates setTimeout race in ElggSpinnerTest  Even though the
+  class should be added at 20ms, with a wait of 100ms tests were still failing.
+  Apparently there's no way to reliably test that a timeout of a particular
+  period is used, so now the module fires a test event, allowing the test to
+  directly listen instead of guessing how long to wait. This still at least
+  tests that there is *some* delay.
+
+2016-07-08  Steve Clay <steve@mrclay.org>
+
+  	* mod/web_services/lib/api_user.php, mod/web_services/lib/tokens.php:
+  security(web_services): increase entropy of API keys
+
+2016-06-11  Steve Clay <steve@mrclay.org>
+
+  	* engine/classes/Elgg/Http/Request.php,
+  engine/tests/phpunit/Elgg/Http/RequestTest.php: security(routing): HTML
+  escapes URL segments  Just in case a developer unwisely injects URL content
+  directly into HTML, we escape `&"'<>` with HTML entities.
+
+2016-07-02  Steve Clay <steve@mrclay.org>
+
+  	* engine/lib/elgglib.php, views/failsafe/messages/exceptions/exception.php:
+  fix(logging): make clearer exception numbers are timestamps  Fixes #9924
+
 2016-06-13  Steve Clay <steve@mrclay.org>
 
   	* CHANGELOG.md, composer.json: chore(release): v1.12.11

LICENSE.txt

@@ -1,3 +1,48 @@
+Bundled plugins (the contents of the "/mod" directory) are available
+only under the GPLv2 license.
+
+The remainder of the project is available under either MIT or GPLv2.
+
+Both licenses can be found below.
+
+More info: http://learn.elgg.org/en/latest/intro/license.html
+
+------------------------------------------------------------------------
+
+The MIT License (MIT)
+Copyright (c) 2016 The following parties:
+
+	Steve Clay (steve@mrclay.org)
+	Cash Costello (cash.costello@gmail.com)
+	Brett Profitt (brett.profitt@gmail.com)
+	Dave Tosh (davidgtosh@gmail.com)
+	Ben Werdmuller (ben@benwerd.com)
+	Evan Winslow (evan.b.winslow@gmail.com)
+
+	The MITRE Corportation (jricher@mitre.org)
+	Curverider Ltd (info@elgg.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to permit
+persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+------------------------------------------------------------------------
+
 		    GNU GENERAL PUBLIC LICENSE
                        Version 2, June 1991
 

actions/profile/edit.php

@@ -82,6 +82,10 @@ function profile_array_decoder(&$v) {
 
 // go through custom fields
 if (sizeof($input) > 0) {
+
+	// fetch default access level for the user for use in fallback cases
+	$user_default_access = get_default_access($owner);
+
 	foreach ($input as $shortname => $value) {
 		$options = array(
 			'guid' => $owner->guid,
@@ -98,7 +102,7 @@ function profile_array_decoder(&$v) {
 				$access_id = (int) $accesslevel[$shortname];
 			} else {
 				// this should never be executed since the access level should always be set
-				$access_id = ACCESS_DEFAULT;
+				$access_id = $user_default_access;
 			}
 			if (is_array($value)) {
 				$i = 0;

composer.json

@@ -1,6 +1,6 @@
 {
     "name": "elgg/elgg",
-    "version": "1.12.11",
+    "version": "1.12.13",
     "description": "Elgg is an award-winning social networking engine, delivering the building blocks that enable businesses, schools, universities and associations to create their own fully-featured social networks and applications.",
     "license": "GPL-2.0",
     "minimum-stability": "dev",