glFusion v1.0.0 and v1.0.1 are vulnerable to unsolicited file upload via the FCKEditor.  A malicious user could upload files to the public_html/images/library/ directory of your web server using this hole.  Fortunately, the file types are filtered by the whitelist in FCKeditor so only media type files can be uploaded. This means no PHP or JavaScript files could be uploaded.  Regardless, you should update the upload.php file shipped with glFusion with the latest patched version to prevent any unsolicited uploads.

A fix is published on the glFusion Issues Page.  To manually patch upload.php, make the following modification: edit public_html/fckeditor/editor/filemanager/connectors/php/upload.php, at the beginning of the upload.php file, after the copyright notice but before the first require(...), add this piece of code:

if (strpos ($_SERVER['PHP_SELF'], 'upload.php') !== false)

{

    die ('This file can not be used on its own.');

}

Save the file and you are done. 

Right on the heels of the glFusion v1.0.1 release,  we are pleased to announce the release of Chameleon v2.0.0 for glFusion.  Chameleon v2.0 leverages some of the new features of glFusion's Site Tailor plugin, including cascading menus and logo management.  Now you have the option of multiple layouts and styles with the flexibility of an online menu editor.   This will be the final release of Chameleon.  All of the Chameleon functionality / flexibility will be moved into Site Tailor and Nouveau with the next milestone release of glFusion.  If you have any suggestions on features or enhancements, please post them in the glFusion Development Forum.

The glFusion Community is pleased to announce that glFusion v1.0.1 is now available for download.  This new release squashes several bugs, makes some cosmetic improvements, and includes other enhancements by the glFusion team.

In addition to the standard full install tarball, we have included a zipped version, and incremental archives (available in both .tar.gz & .zip formats as well) that only contain new or changed files from glFusion v1.0.0. Grab the archive that's right for you below!  Visit the glFusion Wiki for full details on installing or upgrading.

Our intent is to make the upgrade as simple and pleasant as possible for the community, but we know we're not perfect. Should you find yourself needing a little help, feel free to visit our Known Issues wiki page, our Troubleshooting Tips, and post your questions in our active support forum.

glFusion v1.0.1 also marks the last release that will echo the Geeklog codebase.  In just a short period of time, the enhancements made by the glFusion Community have proven that trying to keep the code in sync with the Geeklog base is not a realistic goal.  We also want to ensure there is no confusion to the community regarding the Geeklog and glFusion projects.  As a result, all future releases of glFusion will be developed independently from Geeklog v1.5.0+.  We plan to continue in the spirit of collaboration with the Geeklog project, and leverage some of their ongoing code enhancements, and extend the invitation for them to do the same if they wish.

As you have probably already noticed, we have transitioned the gl Labs website to the glFusion web site to support this new direction.  Mark and I are still happy to continue supporting any of the plugins or themes we've published thus far for Geeklog, but we do not plan on releasing any new updates to those plugins or themes for the Geeklog environment.  If you are interested in picking up development of any of these legacy plugins or themes for Geeklog, please feel free to contact us.

For more details on the enhancements and fixes in glFusion v1.0.1, please read on....

Some of you might have noticed the plugin called glPopMail in the subversion repository for glLabs.  This plugin is currently under development, and when finished will be a full fledged email client  for use with glFusion, and Geeklog. I am pleased to announce that the plugin is now in an installable state. I am looking for people to grab a copy from the subversion repository and give it a try and send us feed back via the glLabs tacker. This plugin needs a lot of work so the more input I get the better it will be. Click the read more link for current feature information, and what works or does not work.  Download glPopMail ALPHA now and give it a test.