NineChime forum

v5.9.0 - May 12, 2015:

NOTES:
- Last major version.  WaxPoteto is officially discontinued, but may get a few bugfixes.
- Upgrade to Wacintaki recommended.

CHANGES:
- Upload access is enabled by default in the installer.
- Finally converted BBS to use OekakiID rather than OekakiU for all authorization and cookies.
- Updated all applet code to eliminate $OekakiU and updated boot to salvage login details from multiple sources.
- Some syntactic cleanup, such as removing trailing "?>", fixing capitalization, alignment issues, etc.
- $user and $flags arrays now cascade, allowing for cleaner defaults.
- Finally using SQL LEFT JOINS for avatars on index page.  Cuts number of SQL queries roughly in half.
- Replaced badly-written PHP version detection with version_compare().
- Microtime handling improved with proper string casting.
- New password hashing using Blowfish if available and Extended DES as a fallback.
- Oekaki automatically updates old password hashes to the strength defined in boot.php.
- Random salt generator for passwords.  Uses mcrypt, openssl, or /dev/urandom/ if available and a decent fallback for Windows.
- Password detection no longer relies on config salt, so salt may be changed.
- Salt removed from installer and is now set automatically during installation (and is virtually useless).
- report_err() now includes "error.php" rather than using a HTTP redirect.  This solves many technical and usability problems compared to passing error messages via CGI.
- Added experimental "X_DISABLE_REPORT_ERR_HACK" to boot to disable the report_err() hack.  Use this if your custom header isn't working with the new error reporting.
- Removed multiple tries from applet picture save code -- potential DDoS vector.
- Added constants to replace mailbox status numbers.
- Debug config no longer overlaps with NineChime.com specific hacks.

BUGFIXES:
- Fixed undeclared debug variable in the updater.
- age_to_date(): fixed problem with $_GLOBALS being confused with $GLOBALS.
- Fixed ability to log in through alternate interface if browser JavaScript is disabled.

FEATURES:
- Many PHP 5.3+ enhancements.
- Page load time now shows SQL time.
- Diagnostics page now shows avatar stats as well as deprecated salt setting.
- Board now recognizes (but does not support) WebP image uploads.