Removed depreciated admin column, cleaned code
Implemented IP lock security. Implemented first steps of two factor authentication, fixed various minor user role bugs. Updating user roles will now update the rights of all users that have that role. Added password history, so that the system can now indicate that you are trying an old password (see gmail which uses the same system) has_rights() now accepts an optional second parameter which can be a user array that should be checked for the required rights
Added $_CONFIG[sitemap][enabled] which can completely disable the sitemap script if set to false
Default configuration for "ip_lock" is now false, since only few websites will use it
Removed depreciated functions user_has_rights() has_right() and right_or_redirect() since they all have been replaced by has_rights() and rights_or_redirect()
Added user columns, added user type detection configuration
Added sitemap show_changefreq and show_priority configuration options
Fixed has_rights() call (log_fail no longer supported, now allows user array)
Added http_response_code() PHP implementation in case somebody is running PHP < 5.4.0
Exceptions now accept array messages, which automatically get imploded using "\n", so that html_flash_set later on can explode that to multiple messages. html_flash_set now converts exception messages with "\n" to multiple messages. pdo_error now shows queries with multiple spaces truncated to one (this to make queries readable). html_flash() will now strip the function_name(): part from messages. show() and showdie() will now correctly show "NULL" if no message has been specified. debug_sql() will now show the correct origin file@line where it was called. user_ensure_signin_fields() is now called user_process_signin_fields() which makes a bit more sense.
Added database logging for ip_lock update
Fixed typo in user right
Log table now also registers remote IP. log table now uses "createdby" and "createdon" instead of "added" and "users_id" like all other tables. $_CONFIG[security][signin][ip_lock] now supports multiple IPs on which locks can be made. This can, for example, be limited by configuration to (the last) two IPs. Moved all ip_lock code to the user_ip_lock.php handler. str_log() now uses json_encode_custom() to display array contents so that keys are always retained. http_build_url() is now depreciated and replaced by http_add_variable(). Added (though still under construction) http_remove_variable() html_flash() will now filter messages from the first : instead of (): to also be able to filter the handler prefixes.
Updated admin pages
html_flash() and html_flash_set() will again filter messages from "(): " to avoid cutting messages containing a :
Fixed missing library bug
v0.16.3: Added extra standard rights profile, profile_update, password, Moved redirect() functions to http library since its all webserver stuff, moved store_post() and restore_post() to http since its also all webserver stuff, log_database() now logs the client remote IP (if available ofcourse), added sql_valid_limit() to have a standard test to ensure specified LIMIT is valid, pdo_error() will now show up to 4096 characters of the query on syntax error, html_select() disabled option will now make it both disabled, and readonly, and no longer add any other stuff since its disabled anyway, http library can now only be loaded from webserver
Updated admin pages
v0.16.4: Fixed various blog meta description issues
validator $v->isNumeric() will now ignore empty values, blog photo and thumbnail sizes can now be configured on a per-blog basis in the database.