This release is now available at GitHub.

We strongly recommend that everyone upgrade to this version, for security and quality of life updates.

Security Enhancements

XML/XSL Module

• Added a hostname whitelist
• Only Admins can adjust the hostname whitelist.
• Prevents non-admins from using a potentially hostile URL in the XML URL/XSL URL fields
• Hostname comparison is done by converting the user provided URLs into URI, this formats and validates the URL
• Converting to a URI and comparing to a hostname prevents a "file://" URL, which could lead to leaking root level configuration
• Changed the way the files are brought in, stopping loopbacks and after DNS resolution, but this will break referencing files in a shared environment.

Setup Page

• Changed DisableSetup to true by default.
• Disabled showing connection error on setup.

Bug Fixes

• Fixed issue with bad SiteCount cache causing the site to go into a setup loop.
• Fixed issue where blog comments could not be submitted
• Fixed missing GROUP BY clause breaking viewing blog posts with PostgreSQL

Other

• Added "ClearAll" method to cache manager.

You can see the full changelog here.