Bump version for hot fix.
Whitelist allowed filters in /user (s1).
Properly escape discussion name in dashboard summaries (s5).
Check for admin permission in settings/gettingstarted (s4).
Consolidate the permissions for Vanilla.Settings.Manage & Vanilla.Categories.Manage into Garden.Settings.Manage.
Escape the category name in manage categories (s6).
Set the correct content type of application/json for DeliveryType=JSON and also add X-Content-Type-Options: nosniff (s7).
Added a config option to enable jsonp. We'll also whitelist calls for jsonp later.
Whitelist for HTML elements, s#2
Fix autocomplete escaping, s#3
- Added Gdn_Request->IsAuthenticatedPostBack().
- Add the transient key to hijacked links.
- Make /user/verify require an authenticated postback.
Remove utility/redirect (s10).
Do not send password after admin reset by default, s#16
Merge branch 'hotfix/2.1a35' of github.com:vanillaforums/Garden into hotfix/2.1a35
Only allow embed: same origin unless embedded is specifically turned on.
Only use display_errors = 1 when in debug mode.
[S#13] Add password complexity hinting and requirements, with sane defaults.
[S#20] Add userid and source IP login rate limiting.
Merge branch 'hotfix/2.1a35' of github.com:vanillaforums/Garden into hotfix/2.1a35
Change admin password reset to 3-way option, no cleartext email passwords, s#16 redux
Merge branch 'hotfix/2.1a35' of github.com:vanillaforums/Garden into hotfix/2.1a35