I've spent the better part of the day syndicating core improvements and bug fixes from our latest WWB build to iWiccle towards the iWiccle 1.3.0 release, and we're almost at the end of the journey. In the process, I have manually reviewed all the changed files in both builds, and fixed several anomalies I spotted for both iWiccle and WWB.

The iWiccle builds have to date omitted a digit marker from the version number — e.g. 1.2.1.1 has been called 1.21.1. As of this iWiccle build, we are normalizing the version numbering to match the (common) convention used with WWB. As such, 1.3.0 in "legacy terms" would be iWiccle 1.30.

I have a few more tests to run on iWiccle (and a bit of quick candy to add in), and then it's pack & release. This will be another painless upgrade with large amounts of core code revised, with very minor database changes (one-click upgrade script) — basically an upload-and-go operation.

WWB with several new features and a good amount of maintenance fixes is also almost there; I need to go over the requests here in the forums one more time to ensure we've covered the bulk of the requests from the community here, and then it's 1.1.0 time. (Again, a painless upgrade upcoming — nothing to worry over with your customizations.)

Thanks for the update, Markus.  Looking forward to iWiccle 1.3.0. 

It seems like the fairy queen brought us a free extra security screening in two parts on Friday and today. =) Thanks to Bogdan Calin of Acunetix and ongoing beta-tests of their advanced web application vulnerability scanner, I now have an additional XSS checklist for iWiccle I need to go over, which should take a couple of hours at the most. (Most noteworthy issues were already addressed in WWB code and reflected in the upcoming build.)

Primarily the issues reported are about adding simple input filtering into some features, or checking if it's actually necessary — much of the list I received were possible cases that hadn't been manually verified as valid, and at a quick glance it looks like there are a number of false positives in. Overall, I'm quite pleased with the results — nothing critical caught in the net!

So lazy as I am (and eager for that extra hour of sleep), I fixed the abovementioned XSS issues wholesale by forcing every single GET and POST variable through our standard XSS filter that was already in use for user-posted content.

This shouldn't cause processing overhead anyone would notice, and should do the trick for all URL hacking attempts now and in the future, including for any modifications you may want to plug in yourself. (Though don't go neglecting security in your own code over this!) Also, this extra layer of filtering shouldn't cause any conflicts in the system, unless your name is Onclick Getcookie or something. To be continued tomorrow.

This is great news... is there a release date please Marcus? Thx

Hi Bob,

We are still in the final stages of misc work (taking up 16 hours per day!) and this will clear during the week so all of us here have some sense of "normal". Watch out over the weekend as we aim to get both releases out the door. As soon as possible. Thanks for waiting

It's such a pity that I never found time to add in extra color themes for the 1.2x series, because they've been supported since iWiccle 1.11 (that had six color options by default). This will change with the upcoming build — see a preview of red theme for the Pro skin. The 1.3.0 build is final testing and polish at the moment, and will be released sometime in the course of tomorrow.

I have been working on iWiccle and WWB releases in tandem, making corrections across builds as necessary. A great deal of good stuff has made its way from WWB to iWiccle, and WWB in turn has grown several new powerful features richer. (And more on that tomorrow.)

Since 1.3.0 was a major update under the hood, I've spent the better part of the last eight hours testing through things one more time. (And in the process, discovered some quirks that are now also fixed in WWB.) I should get around to packing it up within the hour or so.

You can now see an online version of the 1.3.0 build with sample data in at iw130.cms.wiccle.eu.  Everything checks out fine, time to wrap it up. Please feel free to register above and test all you wish.

(I am also test-driving our new Euro server at a Netherlands datacenter— please let me know how well it loads for you, connectivity should be top notch but I haven't had time to fiddle with the box as of yet.)

Ran security sweeps with two other tools just in case, and prepared the installer. Now updating file headers, compiling the changelog, and preparing the release announcement. =)

And here's the link to the release announcement. Upgrade bundle to follow once I return to the land of the living again — it's been another one of those very long coding sessions, and now time for a bit of rest.