Check for admin permission in settings/gettingstarted (s4).
Consolidate the permissions for Vanilla.Settings.Manage & Vanilla.Categories.Manage into Garden.Settings.Manage.
Escape the category name in manage categories (s6).
Set the correct content type of application/json for DeliveryType=JSON and also add X-Content-Type-Options: nosniff (s7).
Added a config option to enable jsonp. We'll also whitelist calls for jsonp later.
- Added Gdn_Request->IsAuthenticatedPostBack().
- Add the transient key to hijacked links.
- Make /user/verify require an authenticated postback.
Remove utility/redirect (s10).
Only allow embed: same origin unless embedded is specifically turned on.
Only use display_errors = 1 when in debug mode.
Merge branch 'hotfix/2.1a35' of github.com:vanillaforums/Garden into hotfix/2.1a35