mojoPortal Change Blog - Podcasts powered by Odiogo

mojoPortal 2.3.1.0 Released

noreply@mojoportal.com (Joe Audette) — Mon, 29 Jun 2009 17:03:48 GMT

I'm happy to announce the release of mojoPortal 2.3.1.0 available now on our download page.

This is primarily a bug fix release.

Fixed Issues

Fixed an issue in the WebStore where using EURO currency with PayPal the amounts returned from PayPal were not being correctly parsed.

Fixed a bug in CryptoHelper that was causing an error in some environments when encrypting or decrypting data.

Fixed missing titles on some edit pages that were a side effect of our refactoring of page titles to give more control over them in the last release.

Downgraded YUI from 2.7.0 to 2.6.0 when using the Google CDN, because of a bug in YUI 2.7.0 where an FCKeditor inside a YUI tab sometimes was not visible in IE.

Added required field validators in the Content Style Template editor because leaving the element blank could cause the FCKeditor to throw an error.

Implemented a Content Delete Handler provider system to make a more consistent way of deleting related content when a module instance is deleted. Previously some features were not cleaning out their data when a content instance was deleted.

Last release we introduced support for search results highlighting. This brought with it a possibility for an information disclosure if the user had view permissions on the page but not the module. In the past only the page title was shown so there was no disclosure of the content but with fragments of the actual content now being shown in search results we needed to store the module view permissions in the search index in order to be able to filter search results based on those roles in addition to page view roles. In order to get the view roles into your search index requires rebuilding the search index. In order to not break existing search indexes I had to keep the default to not filter by the module view roles otherwise since the roles are not in the exisiting index all search results would be filtered out. In a new installation the preferred settings are in user.config.sample so that new installations should always filter by module view roles. Those who upgrade and rebuild their search index should add this to their user.config file: <add key="SearchIncludeModuleRoleFilters" value="true" />
This issue only affects those who have content on a page filtered by module view roles in addition to page view roles and only if you are using search results highlighting.

There is a corresponding minor update release for Event Calendar Pro to make it write module permissions also to the search index for events. Customers can download the new 0.0.1.5 version from their purchase history.

Fixed an issue where our App Keep Alive feature did not work in IIS 7 using Integrated Pipeline mode.

Fixed an issue in our SmartCombo dropdown when using Chinese characters.

Fixed an issue in the Image Gallery where the Greybox did not work if the caption had an apostrophy.

Fixed a similar issue in the blog where a script error would occur in IE in the blog if Odiogo was enabled and the blog title had an apostrophy.

Previously some skins had corner rounders surrounding the PageMenu control but if there were no child pages for the current page in the SiteMenu then the PageMenu would not be visible but the corner rounders would still be there. We solved this by moving the CornerRounders into the PageMenu control and out of the layout.master. This way if the menu is not visible neither are the corner rounders.

What Else?

We now force the use of a plain text editor in iPhone because none of the wysiwyg editors can work in iPhone due to the way they create png images of the page for zooming. So even though the editor rendered correctly because javascript is supported, there was no way to click in the editors. So now you can edit site content, make blog posts or anything you like using the iPhone though it does require knowledge of html.

Based on user feedback, I implemented additional CSS classes and and example skin showing how to layout forms with the labels above the form fields. Whereas most of the skins have the label on the left side of the input, andreasvicklund-02 now has forms with the labels above the inputs. Also I think now all the Cancel buttons have been changed to links which was also suggested as a usability improvement.

There was also a request to add a per instance unique CSS class on Html content instances so that it is easier when you want to style a particular content instance different that the others. I implemented this so that there is a wrapper div with class=modulex where x is the module id. This allows you to easily overrid ethe styles for particular instance. I did the same thing for blogs and links and a few other places.

Updated Italian resource files thanks to Diego Mora.

Joe Audette ...
Click here to play

mojoPortal 2.3.0.8 Released

noreply@mojoportal.com (Joe Audette) — Wed, 17 Jun 2009 14:42:23 GMT

I'm very happy to announce the release of mojoPortal 2.3.0.8, available now on our download page.

What's New?

Search Engine Improvements

The mojoPortal search engine now supports filtering results by feature and results highlighting, as well as support for Open Search with automatic discovery. A number of changes were made to what we store in the search index, so to take advantage of the new features requires changing some config settings and rebuilding the search index which may or may not be trivial depending on the size and activity level of your site. For backward compatibility we have kept the default settings such that the exisiting search index should continue to work as it has, but to take advantage of the new features you should put this in your user.config for a new installation before doing a search or for an existing site you can add these settings to user.config and then rebuild the search index.

SEO (Search Engine Optimization) Improvements

I did a lot of analysis using the new free IIS SEO Toolkit and made a number of small changes based on the results. Its now possible for you to control the default title format for pages and to use extensionless urls in IIS 7.

Content Template Editor

Now you can create and save custom content templates and they will show up in the FCKeditor.

Content Style Editor

Its now possible for you to create and save content style templates that appear in the Style dropdown list in FCKeditor.

Skin Improvements

We include about 30 good looking skins in mojoPortal, but a number of the skins were designed for 800x600 screen resolutions so even though they were good looking it seemed to me that some of them were not being used very much because they are too narrow. So I made most of the narrow skins wider. Also we needed good examples of suckerfish style menus. The mitchinson-earthy skin had something close but it did not work very well so I re-implemented it using the jQuery Superfish menu and I made the mitchinson-earthy-alt1 which uses a vertical superfish menu. So now I think we have a lot of skins that be can useful as a starting point for customization. There is also a new Preview/Browse link in the Administration Menu > Site Settings page to allow you to easily preview the available skins.

Other Updates

Upgraded to the newest version of NeatUpload and the newest version of the AjaxControlToolkit.

Upgrade Notes

Customers who have purchased Event Calendar Pro and/or Form Wizard Pro, will need to upgrade to new releases of those products which have corresponding changes partly due to the newer version of AjaxToolkit. You can download the latest version from your order history under the "My Account" link.

Be sure to read an understand the changes to the search index and consider rebuilding your search index. If you have a custom skin you will need to add a new css class that is used to highlight the search results, the included skins all have this new css class:

.searchterm { color:black; background-color:yellow; }

Joe Audette ...
Click here to play

mojoPortal 2.3.0.4 Released

noreply@mojoportal.com (Joe Audette) — Mon, 18 May 2009 18:48:05 GMT

I'm happy to announce the release of mojoPortal 2.3.0.4, available now on our download page.

Whats New?

RPX Instant Open ID Single Sign In Integration

Now you can allow users to easily register and sign in to your site with no new passwords using their existing account from Google, Yahoo, AOL, Microsoft, Facebook, MySpace, Twitter and more. For complete details, see the RPX documentation here.

We've had support built in to mojoPortal for Open ID for a long time but this is much more user friendly, the user doesn't have to know anything about Open ID to use it. We still have suppport for standard Open ID authentication for those who would rather use it as is. In fact we also upgraded to the newer DotNetOpenAuth from the older DotNetOpenId (same project but they changed the name of the dll), and now it can work in Medium Trust environments, where previously, you have to remove the DotNetOpenId dll for Medium Trust to work. Of course the new RPX service also works fine in Medium Trust.

New Content Templates in the FCKeditor

You can now easily use a few UI widgets like the jQuery Accordion, jQuery Tabs, and YUI tabs right in the editor. There is a new toolbar item in the editor for choosing content templates, and we have pre-defined a few templates for these widgets.

In the near future we will also add the ability for you to create and edit your own templates.

TextArea Editor

For anyone who would rather use a plain text area for editing content rather thanone of our WYSIWYG editors, we now have a TextArea editor, thanks to a sponsorship from Felix Schudel. Since the WYSIWYG is much more friendly for most people, the TextArea editor is disabled by default, but it can be easily enabled by un-commenting it in the mojoEditor.config file.

WebStore Improvements

It is now possible to checkout without registration or sign in, if the order has no download products. So now people can buy me a beer without registering on this site ;-). There are also improvements to the offer administration, we added a new product picker dialog, and there is a new product site map for submitting to google and other search engines located at /yoursiteroot/WebStore/ProductSiteMap.ashx.

Blog Improvements

There is now an option in the blog to format the category list as a tag cloud. To use it you just enable the setting in the feature instance settings and then clear your browser cache to get the new css for the tag cloud. Soon we will be implementing categories/tags as a core system feature so it can be re-used by any feature and then we will replace the existing blog categories with the new system. This new category/tag system will then be used to easily add categories to the WebStore, EventCalendar Pro, and possibly other features. Note that if you have a custom skin, you will need to add this css for the tag cloud:

.tag-cloud { list-style-type:none; margin: 15px 0px 3px -30px;}
.tag-cloud li { display: inline; list-style-type:none; }
.tagcount { font-size: x-small;}
.tag-cloud .weight1 { font-size: 90%; }
.tag-cloud .weight2 { font-size: 110%; }
.tag-cloud .weight3 { font-size: 120%; }
.tag-cloud .weight4 { font-size: 130%; }
.tag-cloud .weight5 { font-size: 140%; }
.tag-cloud .weight6 { font-size: 150%; }
.tag-cloud .weight7 { font-size: 160%; }
.tag-cloud .weight8 { font-size: 180%; }
.tag-cloud .weight9 { font-size: 200%; }
.tag-cloud .weight10 { font-size: 210%; }

There have also been a number of minor enhancements and of course bug fixes for things reported in the forums since the last release.

Updated Releases For Event Calendar Pro and Form Wizard Pro

New minor release updates are available for customers who have purchased these features. There were small changes made in these feature to correspond with changes in the core of mojoPortal. The Form Wizard also now uses the full editor toolbar for editing the form instructions and thank you message. Customers can download the updated versions from their purchase history and install them after upgrading to mojoPortal 2.3.0.4.

Update 2009-05-22

Just updated to version 2.3.0.4.b to fix an issue where the breadcrumbs wrapper div was rendering on pages even if breadcrumbs were not enabled and this extra div could affect layout in some skin designs.

Joe Audette ...
Click here to play

mojo Rising! Got To Keep On Rising

noreply@mojoportal.com (Joe Audette) — Sat, 09 May 2009 17:04:57 GMT

Thought I would make a brief post to share the progress in growth of the mojoPortal community and other statistics and milestones of interest.

In recent weeks we reached 5000 commits in our svn source code repository, actually the most recent revision as of this writing is r5086.

We are approaching 5000 voluntary site registrations and could possibly even reach that milestone this month. The chart below is as of 2009-05-09.

Web Traffic is doing well and showing steady growth.

And best of all, downloads have suddenly gone way up from the exposure we have received in the Microsoft Web Application Gallery. You can see, we went live in the gallery on April 6-7 and its been like a tidal wave raisin our 30 day downloads from 3500-3800 previous average to over 18,000 downloads on the current live stats chart.

A little love from Microsoft goes a long way as you can see! Huge thanks to Microsoft and especially the IIS Team for their support and help in getting mojoPortal into the gallery.

The interesting thing to me is that the site registration chart was already going parabolic before we got into the gallery. We got into the gallery around April 6-7, and site registration actually dipped a little in April compared to March. It will be interesting to see where it goes from here. Note that we have never required registration to download or even tried to fool people into thinking they can't download without registration like DotNetNuke does. Our registration numbers mean more because they are strictly voluntary.

Joe Audette ...
Click here to play

mojoPortal 2.3.0.1 Released

noreply@mojoportal.com (Joe Audette) — Mon, 20 Apr 2009 19:36:56 GMT

I'm happy to announce the release of mojoPortal 2.3.0.1, available now on our download page.

What's New?

Content Versioning

The Html Content and Blog features now support keeping a history of every edit (like a wiki). You can compare any historical version of the content to the current version and you can restore any version to the editor so that you can restore it as it is by saving it or modify it further then save it. Versioning can be enabled at the feature instance level or it can be enforced site wide from Site Settings or it can be enforced from Web.config. Site administrators and content administrators can delete history but no other roles are allowed to delete the history. The ContentHistory is built into the core so that it does not have to be re-implemented for each feature. Each feature does implement its own UI to show or restore the previous versions, but they leverage common business classes to store and retrieve their history. In the future we will implement versioning for product and offer descriptions in the WebStore, developers may also leverage this in their own features to keep version history for their own feature data. This is one more thing to mark off our Road Map as complete. Next up is a general Content Tagging/Category system that can be re-used across features, and a Content Comment system that can be re-used across features.

Web Chat using Windows Live Messenger

See my previous post for more information about the new Chat feature. This was not even on the roadmap but when I saw how easy it was to implement I decided to work on it. It was fun and it only took a few days. One of the things I like best about my job is that I can just decide to work on something for a few days because its fun.

New PlugNPay Payment Gateway in WebStore thanks to Voir Hillaire

New Skin - dcarter-bluedesert, based on dcarter-ticktockpro but modified and contributed by Sami Isamil Hassan

Various minor enhancements based on feedback and fixes for bugs reported in the forums since the last release.

More progress moving away from ExtJs by implementing some .NET controls for YUI to replace the ones I previously built for ExtJs

Some of you may have checked out my Site Office UI prototype in the past. Its a separate plug in system than the main content system designed more for a consistent application user interface rather than for creative design like we use for the public facing web site via our skins. You can see the Site Office layout on this site or the demo site if you login and click the "Site Office" link at the top of the page, or you can look at the origianl layout demo for ExtJs here. I still have not implemented any real features for Site Office, but the plug in system itself works and I've even received emails from developers who have implemented their own plug features using it. I got kind of side tracked off of the Site Office idea partly because I had spent quite a bit of time implementing .NET wrapper cntrols around the ExtJs javascript to make it easy to use and then the ExtJs project changed their license to GPL which is not compatible with our CPL license, so I could no longer get upgrades of ExtJs and include them with mojoPortal. Since then we've been stuck on version 2.0.2 of ExtJs which was the last version they shipped under the LGPL (which was compatible). I had also used a little ExtJs in the Contact Form for the messaage list page. For a long time I've been thinking I really need to build new .NET wrapper controls with similar functionality but using the YUI javascript instead of ExtJs.

So again in the name of fun (because I like building .NET controls around javascript) I spent some time implementing some new controls with YUI to replace the ExtJs stuff I've been using. I have now removed the dependency on ExtJs from the Contact Form feature and I've got a good start on the layout framework to replace the current SiteOffice. I still have more work to do to finish, but the goal will be to eliminate all use of ExtJs in favor of YUI. The ExtJs javascript we include in mojoPortal is 6.36 MB, so it will reduce the size of our downloads once we no longer need to it. Anyway, you can see the work I've done so far on the YUI layout here, its very similar as you can see to the current Site Office layout with ExtJs. Once I get some more of the YUI things wrapped up so they are easy to use, I might even change the site administration area so that it uses this kind of layout instead of the site skin.

New Experimental CKEditor

Some of you may have noticed that the FCKeditor project has shifted gears from the next upgrade of FCKeditor to their next generation version named CKEditor. I think they are basically taking the good parts from the FCKeditor implementation but doing a new redesign of the implementation using things they have learned and new techniques that have emerged to improve the architecture. The CKEditor does not yet have image upload or server browsing so I have disabled it by default, but anyone who really wants to check it out can un-comment it in the mojoEditor.config file in the root of the web. It really looks just like the FCKeditor but does not have all the functionality yet, I just figured it was good to get started with it so we can be ready as they make imporvements.

So all of the above (other than the contributions from the community) is work I've done since the last release on March 24, less than 30 days ago, but in that time I've also made a substantial start on my next paid product Web Invoice Pro. It still has a ways to go before release though. Its one of those things where I started out with a very simple vision for it but it quickly changed to a more complex feature the more I thought about it after getting a few little pieces of it built. I needed to step away from it a little to think about it more and that is part of the reason I worked on some fun things as I got to a point where I was frustrated and needed to work on something that made me feel productive.

Joe Audette ...
Click here to play

Web Chat Using Live Messenger

noreply@mojoportal.com (Joe Audette) — Fri, 17 Apr 2009 11:20:09 GMT

Several people have asked about a chat feature for mojoPortal in the past and I've had my eye on a few ways to implement chat but have mainly been too busy working on other things to try and tackle it because I viewed it as a complex feature to implement. But recently I found out about the Live Messenger Web Toolkit and that seemed to lower the bar so that it was pretty mch low hanging fruit to implement chat. There are actually quite a few things developing in Microsoft Live Services that are very interesting. Much of it was announced at Mix 09, I still haven't watched all the videos but I plan to watch them soon and learn about tha various scenarios that can be implemented. But, so far I have implemented chat and it will be in the coming release of mojoPortal as a built in feature that can be enabled/disabled.

There will be a new "Live Messenger Chat" feature that you can put on a page, as a supplement to the contact form for example and your web visitors will be able to chat with you no matter whether they have a Live Messenger account or not. You will chat using your desktop Live Messenger and the web control will display your availability and if you are online it will allow web visitors to initiate a chat with you.

In addition to the new "Live Messenger Chat" feature that plugs into the content system, you can also enable your site users to have web chat controls on their profile page so that site users can initiate chat with one another. To receive chats a user will need the Live Messenger desktop software but chats can be initiated by web site visitors directly in the web page with no need for a Live account.

I invite you to try the chat here on mojoPortal.com to help iron out any kinks before the release (which I hope to make on Monday). To enable chat on your mojoPortal user profile, visit the "My Account" page using the link at the top (after you sign in), click the profile tab, then click the link that says "Acquire/Refresh a Live Messenger Permission Token" (ok its mispelled in the screen shot but I will fix that before the release)

You'll note that te checkbox is disabled until you have the token. Once you have the token the checkbox becomes enabled and if you check it ans save, the chat will appear on your public profile page like this:

You can see it on my profile here, there are links to member profiles also on the member list page and in the forums.

Now I'm not really big on using chat myself because I'm very busy and generally don't like things popping up and interupting me, so don't expect me to be generally available for chat. I built this feature mainly for others (who have requested it) to use. I'm not going to be using it for support, the forums are much better for that because they are searchable. But it would be great if people could test this out and give some feedback in the forums if you find any problems or have suggestions for improvements. I know lots of you out there use chat all the time whereas I hardly ever use it, so your feedback is important. For me its just a really cool feature that I'll hardly ever use ;-) so I'm not the best judge of it.

Joe Audette ...
Click here to play

mojoPortal Is Now Available in The Windows Web App Gallery!

noreply@mojoportal.com (Joe Audette) — Tue, 07 Apr 2009 10:58:48 GMT

I'm very excited to announce that mojoPortal is now available in the Windows Web App Gallery, and can be installed easily using the Microsoft Web Platform Installer 2.0 Beta.

If you've already installed the Platform Installer you can start the download and installation with 1 click.

Huge thanks to Microsoft and the IIS team for helping us get listed in the web app gallery! I think this is going to help a lot in spreading the word about mojoPortal. Now we need some reviews so if you like mojoPortal why not visit our page in the gallery and give us a good rating and review.
http://www.microsoft.com/web/gallery/mojoPortal.aspx

The mojoPortal package in the gallery is for MS SQL, but our packages for other databases can also be installed using the MS Web Deployment Tool, which is installed using the Platform Installer.

Joe Audette ...
Click here to play

Mono 2.4 Released

noreply@mojoportal.com (Joe Audette) — Tue, 31 Mar 2009 14:42:29 GMT

Congrats to the Mono team on their release of Mono 2.4 and MonoDevelop 2.0!

Time to play with the latest bits and see how it works with mojoPortal!

Joe Audette ...
Click here to play

mojoPortal 2.2.9.6 Released

noreply@mojoportal.com (Joe Audette) — Tue, 24 Mar 2009 16:10:09 GMT

mojoPortal 2.2.9.6 is available now on our download page.

The primary reason for this release is to fix a security issue reported yesterday in our forums. This is only the second security vulnerability ever confirmed in mojoPortal in the entire history of the project since 2004. When a security vulnerability is confirmed we feel it is very important to release a fix within 24 hours and to disclose it with full transparency.

Description

The issue is a cross site scripting vulnerability. The cause of the problem was failure to sanitize a query string parameter that is used for previewing skins. We use a printer friendly skin to produce our printer friendly view using a simple parameter in the url like this skin=printerfriendly. It can also be used to preview any existing skin. Since the skin name is output into the page as part of the url for the css handler it needs to be sanitized to prevent manipulation. The new release sanitizes the input to remove any possibility for javascript being inserted into the page.

The vulnerability was reported by Aaron King who discovered it using the free version of Acunetix Web Vulnerability Scanner. The scanner identified an url that could be constructed that would inject javascript into the page and cause an alert message to be displayed in the page. While the demo exploit causes no harm, in theory other exploits are possible including the possibility of altering the content of the page or stealing a session cookie which could make it possible to take control of a user account. Note that actual malicious exploits have not been proven, but the ability to inject a javascript alert means more malicious exploits may be possible.

Mitigating Factors

In order to exploit this vulnerability the attacker would have to somehow trick a user who is already logged into the mojoPortal site to click a malicious link. The link itself must contain the exploit code and this would be obvious to more experienced users unless the url of the link was masked in some way. So a targeted social engineering attack would have to be used to exploit this. A hacker could email a site user with a link to the site or create a link on a web page on some other web site and convince the user to click it.

What Versions are Vulnerable?

I’m pretty sure this vulnerability was introduced in version 2.2.7.7 when we implemented the CssHandler to combine and minify css. Older versions are probably not vulnerable. To determine if your installation is vulnerable, just visit http://yourdomain/Default.aspx?skin=1%00'"><ScRiPt%20%0a%0d>alert(403326057258)%3B</ScRiPt> If it causes an alert message then the vulnerability does exist.

Upgrade is Highly Recommended

Ugrading to mojoPortal 2.2.9.6 will eliminate this vulnerability. All users are recommended to upgrade as soon as you can. If you are upgrading from version 2.2.9.5, you can skip uploading the ClientScript folder, it will save you some time since its a large folder and nothing in that folder has changed.

Anything Else New This Release?

There was a bug fix in WebStore for MS SQL. Previously when updating the quantity of an item in the cart, the stored procedure was declared incorrectly as having 10 parameters instead of 8 which it actually had.

There is a new Site Setting for Company Name, which is used to automatically populate the CopyrightLabel in the skin.

Our release packages now support easy installation in IIS using the Microsoft Web Deployment Tool aka MsDeploy. See this article for easy step by step installation instructions. Its only for new installations not upgrades. This is actually a pretty exciting development, though I post it here as if it were a footnote. Supporting MsDeploy now should make it possible to get mojoPortal listed in the Microsoft Web Application Gallery, I have submitted a form and am waiting to hear back from them.

Joe Audette ...
Click here to play

mojoPortal 2.2.9.5 Released

noreply@mojoportal.com (Joe Audette) — Mon, 16 Mar 2009 13:24:53 GMT

I'm happy to announce the release of mojoPortal 2.2.9.5, available now on the download page.

This release is primarily a bug fix release but it does have some new things.

Whats New?

A new option in Page Settings, "Show Home Crumb", adds a home link to the breadcrumbs when "Show Beadcrumbs" is enabled. Thanks to Damien White for help with this.

Added a setting to the blog to control whether google maps are displayed in Excerpt view. Previously they were displayed, but now they are not by default, but can be displayed if the setting is enabled.

Added a feature on the Member List page to allow Admins to lookup users by ip address

Implemented a Discount feature in WebStore that allows defining discount codes supporting percentage and dollar amount discounts with various rules. The user can apply the discount by entering the discount code on the cart page. The apply discount feature is only visible on the cart page if there are currently active discounts.

Forum Improvements: added an email icon to make it more obvious that you can subscribe to forum post notification emails. Added the forum description to the forum post page so that its easier for users to remember which forum they are in and what the forum description says. For example on this site it helps users remember to post certain details like OS, db platform, and version of mojoPortal when reporting bugs.

Bug Fixes

Fixed bug in url re-writer where paths could be re-written incorrectly in folder based child sites if the folder name was a substring of a page name.
Fixed broken background image in css for one of the skins.
Fixed broken image urls on MyPage when used in folder based sub sites.
Fixed bug where an error would occur when removing users form roles under SQLite.
Fixed broken folder image url in forum UserThreads.aspx.
Fixed an issue with the css handler incorrectly resolving site id for folder based sites.
Remove unused files as these cause errors when people try to use the release packages in Visual Studio. I still think people should use the source code for development not the release files but people keep trying to use release files so I'm trying to make that possible.
Fixed a bug in the MS SQL install/upgrade scripts where one procedure was not compatible with SQL 2000.

Upgrade Notes

If you are upgrading from 2.2.9.2, you can skip uploading the /ClientScript folder as nothing has changed there.

Joe Audette ...
Click here to play