-
VaultWiki News
by Published on March 3, 2011 12:36 AM
Early Monday our staff discovered a security vulnerability in the VaultWiki software, and we have released VaultWiki 3.0.11 to patch this and other issues. Customers have been contacted via email to alert them of the issue before a public announcement was made.
All versions of VaultWiki prior to 3.0.11 are vulnerable. This particular exploit can allow an attacker to access and modify the database. If any customer is not already running 3.0.11, we urge you to upgrade immediately to protect your site.
Aside from a security fix, 3.0.11 also resolves some other issues, and includes some notable changes: the mobile style, and the single-column version comparison. For a full list of changes, see: http://www.vaultwiki.org/projectsear...suereportid=20
Mobile Style
vBulletin 4.1.2 comes packaged with an optional mobile style with a clean, simple interface. Unfortunately, most forums will not be able to use the style because minor modifications to vBulletin cause the style to become unstable and the forum to not load at all.
While many other modifications will likely also need to be updated, VaultWiki 3.0.11 takes the necessary steps to be compatible with vBulletin's mobile style itself. VaultWiki will detect if the user's style selection is indeed the mobile style, and it will efficiently disable features and skip any processing that isn't used in the style.
Updating the mobile style with VaultWiki's mobile templates requires some additional steps after upgrading. These steps are discussed in my blog here: http://www.vaultwiki.org/blogs/49/
Version Comparison Changes
In order to work in a mobile style, the side-by-side approach for comparing old versions of an article could not be used, because of the inherent limits of mobile devices' small screen sizes.
We instead adopted a system similar to patch files, where only one column is used:
We were so pleased with the result that we updated the default style with this change also. Now you get a comparison that uses less HTML, is easier to read, and is more likely to fit on a variety of screen resolutions.
VaultWiki 4 Release Date
We have reached a point in the development of VaultWiki 4 where we feel like we can give a static release date that we can stick to. Keep in mind that the first release will still be an Alpha version, but will be available for Premium subscribers to download and start testing on April 4.
Upcoming Server Move
Over the past several months we have started to become more aware of the technical limitations of our current web server. We have taken steps to increase efficiency, specifically in our distribution code, but those limits are still in sight.
Most notably, our server had difficulty handling the volume of emails and subsequent mass downloading immediately following the release of 3.0.11, an important security update. Whether the problem was us actually reaching a limit or an unrelated technical issue doesn't really matter. The fact is that a number of paying customers were not able to reach the web site at a critical time, and this is unacceptable.
If we expect to continue growing this year, especially with the aforementioned release of VaultWiki 4, we need to be ready. So we will be changing to our new server on April 1 (no joke).
Our address will not be changing, but we expect that the site will be unavailable for a day or so. We will keep everyone informed as this day creeps nearer.by Published on December 18, 2010 12:25 AM
VaultWiki 3.0.8 was released earlier today. This release covers a number of bug fixes:
- a number of BB-Code and import system quirks
- moderators not receiving edit notifications in their assigned forums
- island pages giving user permission errors
In addition, VaultWiki 3.0.8 solves some long-standing issues with article attachments, including:
- Users not being able to edit attachments if an article was started by another user
- Users not being able to insert images using the Asset Manager if the image was uploaded by another user
- Users being able to edit attachments even if they don't have permission to edit the article they belong to.
Because of the 3rd issue, we highly recommend that customers upgrade if attachments are an important part of your wiki. However, it's also important to note that exploiting this issue is only possible in wikis with certain combinations of admin and user-selected settings.
New Upgrade Service
We have received a number of requests for such a service, and it's now here. Customers who own a VaultWiki license can purchase the Upgrade Service for $14.98, and a member of the VaultWiki Team will perform 1 maintenance update for them. This allows busy forum admins to spend their time on other things than worrying about downloading and applying VaultWiki patches.
Changes to the Members Area
We have updated the Members Area so that customers can more easily locate and purchase add-on services like Branding Removal and the new professional Upgrades.
In the case of Renewals or Branding Removals, we've further improved the system so that they are automatically applied to the corresponding license if purchased via this form.
Other services, specifically professional Installs, Imports, and Upgrades, require additional input from the user after purchase and still need to be applied separately. However, un-applied purchases have been moved above the licenses so they are more likely to be noticed and addressed.
Manual Breakdown
The VaultWiki Documentation has been broken down into a number of sub-sections to help users find the information they're looking for more readily.
In the past, all the sections had been merged together in one list.
by Published on December 1, 2010 10:14 PM
VaultWiki 3.0.7, released today, is the first version of VaultWiki to be compatible with vBulletin 4.1.0. vBulletin 4.1.0 became available as a public beta early last week, and unfortunately it did not include many of the features new to 4.1 (like the CKeditor). Because of this, it is likely that any future releases for vBulletin 4.1 will not be compatible with VaultWiki until we release additional patches for each.
Regardless, VaultWiki 3.0.7 is compatible with vBulletin 4.1.0 (Beta 1, not Beta, and PL 1), and it also includes a small roll-up of bug fixes made since 3.0.6 Build 001.
Shopping Cart Woes
Earlier this week we discovered an exploit in our site's shopping cart. At first it seemed to be only an issue in which customers paying via E-Check might not be handled automatically. But closer investigation revealed that the same flaw could be exploited by a user to purchase VaultWiki licenses and support products like renewals or branding removals for a significantly lower-than-normal price.
If anyone were able to take advantage of this, it could have potentially devalued the product for other customers who have legitimately paid for it full. Existing customers can rest easy that we have fixed this issue before anyone could exploit it.
In order to properly fix the issue without invalidating any pending purchases, we had to apply the fix incrementally. If any customers had noticed any delay in order processing yesterday and today, it was likely due to this. Thank you for your patience and understanding in this matter.by Published on November 22, 2010 10:38 PM
Thanks to the recent release of vBulletin 4.0.8 Patch Levels 1 and 2, we were able to identify and address 3 security vulnerabilities in all previous versions of VaultWiki. VaultWiki 3.0.6 and VaultWiki 2.5.7 Patch Level 4 both address these issues.
Even though 2 of these vulnerabilities only affect users with Internet Explorer 6, we still highly recommend that customers upgrade as soon as they are able. Keep in mind that these issues affect customers on all versions of vBulletin, not just those with vBulletin 4.
VaultWiki 3.0.6 Performance Improvements
Along with other bug fixes in 3.0.6, we also have some rather large performance savings where wiki revisions are concerned. As an example, 1 query on the Recent Changes list was separated into 3 queries, and the total time needed to execute them unbuffered was reduced by a factor of nearly 10.
On Discounts
We recently made some changes to our order process that will allow us to support adding a number of different discount types in the future. You can follow crackedeggs1 on Twitter to keep up-to-date on VaultWiki development and special offers.
In anticipation of the imminent holiday season, we've reduced the price of a new VaultWiki license to $69.98. Customers who purchased since September 22, 2010 and paid a higher price should receive a partial refund in the amount of the difference within the next few days.
Download Options
We also recently made some significant changes behind-the-scenes to the way the VaultWiki point-releases are stored and distributed on our servers. The changes allow a more straightforward release process and more efficient use of our server resources.
Existing customers will notice a related new feature in our site's Members Area. When downloading VaultWiki, customers now have the option to only download the files that have changed since an earlier release. So, for example, if an image was not modified in 3.0.6, you will not be required to download it.
The benefits of these changes affect both the customer and the VaultWiki Team:
- The package is prepared and transferred to the customer faster.
- Preparing and transferring the package uses less bandwidth and CPU resources on our server.
- Uploading the package to your server uses less resources because there is less data to upload.
by Published on October 23, 2010 2:30 AM
With the 3.0.5 VaultWiki product update, we also bring you a few changes to our site. First, here are some of the highlights of 3.0.5.
Release Highlights
Private group pages are now as private as they can possibly be. They will not appear in wiki article lists of any kind. However, due to the nature of how pages are saved in VaultWiki 3, there are certain variations on thread lists and notifications that simply cannot be captured.
Internet Explorer 6 is not supported in 3.0.5 and future releases. The wiki should remain functional in the browser, but will not be styled correctly, if at all. It simply is not possible for certain features to work properly in other browsers and be styled correctly in Internet Explorer 6, so we decided working properly was more important.
Columns used in the TABLE BB-Code can now be sorted by applying the sortable class to the table and giving your table a header row using the ! character.
All of the known VaultWiki bugs that can be fixed have been fixed. The remaining ones deal with bugs in vBulletin, or can't be fixed without rewriting the core of VaultWiki itself. At this point, our development efforts will be focused heavily on VaultWiki 4. Barring unforeseen circumstances, we intend for 3.0.5 to be the last release in VaultWiki 3's life cycle.
For a list of template and phrase changes, see this thread.
For a complete list of issues that 3.0.5 addresses, see this report.
Site Changes
The forum home page has been modified in a number of ways. Less important information is now de-emphasized with smaller font-sizes and lower-contrast text. Last post times have been changed to use relative timestamps to make it easier to find out which forums really do have new posts.
As we'll start discussing VaultWiki 4 more and more, with articles and blogs highlighting upcoming features and other changes, we thought that perhaps the articles and blogs themselves might easily be missed by users who have bookmarked the forum home page. The Blogs link was previously especially hard to find. So we added blocks that show the 3 most recent of each and link back to the main areas, where a user can always find more.
We've also made a small change to the Members Area. In the past, fixes to bugs that were considered severe enough were merged with the current download package of VaultWiki. However, users who had already downloaded that release would not know that the code had changed unless they were experiencing the same issue and found the thread that said "ZIP updated".
Now it will be very easy for users to find out if the download was changed, even though the version number has not. Below the Download link are now two lines:
- Latest: shows the last version AND build number AND what day the code was last updated
- Downloaded: shows the last version and build number the user downloaded, and what day it was
by Published on October 3, 2010 1:27 PM
This coming December, we plan to release a completely revamped version of VaultWiki, version 4 (previously discussed as 3.1). After considering the number of core structural and stylistic changes involved in the product, we thought a major version change was in order.
In version 4, there will NOT be a distinction between Standard or Premium versions - there will just be VaultWiki 4. Users with a Premium license will automatically have access at no additional charge, but users with a Standard license will have to upgrade before March 1, 2011.
As of March 1, 2011, users who did not upgrade will have to purchase a new VaultWiki license, because the Premium Upgrade option will no longer be available.
As of today, the Standard version will no longer be available for purchase. This should prevent new customers from purchasing it if they have missed this announcement.
As of today, the cost of a Premium Upgrade has been reduced over 30% to $19.99. This is the difference in current price between the Standard and Premium versions, and we believe the most fair way to enforce this change, rather than paying the full upgrade amount.
Reasons for making this change:
- Developing with multiple product levels in mind causes a reduction in productivity for one level or the other, because time must be spent discussing whether new features become globally available or only in Premium. Discontinuing Standard allows us to streamline the development process.
- Because both levels rely on the same core code, except with snippets being removed from the Standard release, Standard has historically been more bug-prone than Premium. Discontinuing Standard prevents QA from testing levels unequally, because there is only one level.
- VaultWiki 4 will install as a completely new product. There will not be an upgrade process from version 3. Instead, after installing, current users would have to import their old data. Again, this goes back to point #1
Despite these changes, users who choose to continue using VaultWiki 3 Standard will still be able to download the product and renew their license in the case of any Patch Level releases. They can continue using the old product on their sites under the terms of the License Agreement.
For those who are not sure how to upgrade, you must log in to your account, and open the Members tab in our site's navigation bar. Find the license you need to upgrade in the list. Below the "Download" link, you will also see an "Upgrade" link.by Published on September 30, 2010 11:15 AM
Last week we released VaultWiki 3.0.4 and 2.5.7 Patch Level 3, and have delayed this on-site announcement until our existing customers could be properly contacted about the patches. These versions address a total of 3 critical security concerns, 2 of which involved possible Denial of Service attacks. Due to this and other showstopper bugs that have been addressed, we recommended that customers update as soon as they are able.
Also in VaultWiki 3.0.4, we have fixed over 40 other bugs, including redirects not caching correctly or showing the correct comments, and AJAX title edits "disappearing" articles. As for functionality changes, the import system now handles article history properly.
This site uses cookies to help personalize content, to tailor your experience, and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.
By continuing to use this site, you are consenting to our use of cookies.