I'd like to dedicate this release, in the name of all the core developers and the leaders of the different XOOPS teams, to Herko's work and dedication to this project.
Several people have played an important role in the recent Xoops project reorganization, and the switch from a still almost monolitical development method to a more open one wouldn't have been possible without them. But the energy and time this man has offered have been the main ingredient. It's what created links between everybody and made the magic appear:
in the name of all, thanks a lot my friend.

A big thanks also to the members of our japanese community and specially to tom_g3x and gijoe, who contributed a lot of bug reports/patches here and have shown themselves quite helpful in the making of this version.

Have fun...

skalpa

ChangeLog (contributed changes are marked coredev/contributor)
---------------------------------------------------------------------
SECURITY FIX !! preventing code injection in media uploader (skalpa)
SECURITY FIX !! preventing execution of external scripts in shared environments (skalpa/ackbarr)

Fixed bug #963937: Typo in modules/system/admin/findusers/main.php (mithrandir/tom_g3x)
Fixed typo in x2t theme css colteaser class definition (w4z004)
Set formButton class to Xoops popups buttons (w4z004)
Fixed bug #960970: Incorrect display of the graphical pagenav (w4z004)
Modified the Word Censoring fix (#962025) for MySQL 4.x compat (skalpa + quick thx 2 hervet 4 help)
Ensured page title and slogan are escaped for HTML (Onokazu)
Fixed bug #961565: Search form keywords not checked by JS (mithrandir/tom_g3x)
Fixed bug #961118 in XoopsFormElementTray::getElements() (mithrandir/luckec)
Fixed bug #961311: Incorrect definition of headers var in XoopsMailer class (mithrandir/tom_g3x)
XoopsForm::assign() now indexes elements by name if possible (mithrandir/kerkness)
Fixed bug #963197: xoopsHiddenText is hardcoded in formdhtmlarea (mithrandir/tom_g3x)
Fixed bug #963301: XoopsMediaUploader checkMaxHeight() doesn't work (skalpa/Onokazu)
Fixed bug #963327: XoopsImageHandler delete() keeps rows in imagebody table (skalpa/tom_g3x)
Fixed bug #962025: Word censoring can mess db config options up (skalpa/tom_g3x)
Fixed bug #961313: XoopsMailer custom headers are duplicated (skalpa/tom_g3x)
Fixed bug #960683: [code] wrong translation (skalpa/ryuji+gi_joe)
Fixed snoopy bug due to language specific characters (Onokazu)
Fixed a bug preventing deletion of users from the admin user search results (Onokazu)
Fixed a bug preventing deletion of admin users (Onokazu)
Fixed bug #915976: module onInstall feature doesn't display module messages correctly (skalpa/feugy+dave_l)
Fixed bug #898776: Xoops module resolution for http://www.host.com and host.com (wulff_dk)
Fixed bug #906282: XoopsGroupPermForm::render() - throws Undefined variable (mithrandir)
Fixed bug #946621: Comments system extra_param not working with register_globals off (mithrandir/gstarrett)
Fixed bug #932200: Admin > Edit user shows wrong username (mithrandir)
Fixed bug #936753: $xoops_module_header not in all themes (w4z004)
Fixed bug #921930: SQL queries with leading whitespace don't work (mithrandir)
Fixed bug #920480: xoops_substr always adds three dots (skalpa)
Fixed bug #921448: Undefined variable in xoopscodes.php (skalpa/dave_l)
Applied patch #953063: js Calendar first popup date bug fix (mithrandir/venezia)
Applied patch #953060: xoopstree.php selbox - subcategories not ordered (mithrandir/venezia)
Applied patch #928503: Only show search results for modules with granted permissions (mithrandir/malanciault)
Fixed bug #922152 preventing notifications to work with some Windows configurations (skalpa/robekras)
Fixed bug #930351 preventing XoopsThemeForm::insertBreak() to work
Corrected the content of $xoopsRequestUri on IIS fixing bug #895984 (skalpa)