

<h2>Upgrade Note</h3>
<p>This upgrade is <strong>required</strong> in order to install 5.5.0 or greater.</p>

<h2>Bug Fixes &amp; Security Improvements</h2>

<ul>
<li>Fixed SQL security bug in ItemList::sortBy</li>
<li>Fixed path disclosure bug in RSS tools in page list block</li>
<li>Fixed path disclosure bug in block passthrough.</li>
<li>Fixed XSS bug in RCID value on login page.</li>
<li>Fixed minor XSS bugs in the guestbook block view after post</li>
<li>Fixed minor XSS bugs in Add/Edit Page Types (Dashboard)</li>
<li>Fixed minor XSS bugs in Single Pages (Dashboard)</li>
<li>Fixed minor XSS bugs in Dashboard Groups (Dashboard)</li>
<li>Fixed minor XSS bugs in User Create</li>
<li>Make it so that blocks can be loaded from core packages (thanks Mnkras)</li>
<li>Fixed Attribute Type tool so an invalid action doesn't result in an error</li>
<li>Localization fixes (thanks concrete5russia)</li>
<li>Made package tools overrideable in the root level tools folder</li>
<li>Updated JavaScript ccm_addHeaderItem() to be more reliable with CSS in Internet Explorer (thanks Shotster)</li>
<li>Fixed bug where a packaged block couldn't be refreshed if it was overridden in the core (thanks Shotster)</li>
<li>Fixed missing quotation in form block that could cause nesting problems on post (Thanks arcanepain)</li>
<li>jQuery UI datepicker uses LANGUAGE instead of ACTIVE_LOCALE (thanks concrete5japan)</li>
<li>Removed second type attribute in form block edit interface (thanks Christiaan)</li>
<li>Fixed default date format retention bug in rss_displayer block (thanks janscarton)</li>
<li>Fixed bug in file properties dialog that would cause the properties to become un-editable if a user was deleted and there was a statistic record for that user and file</li>
<li>Fix bug where setting email address as user name in login form when logging in via email would strip certain characters (pull request by Mnkras)</li>
</ul>

<h2>Behavioral Improvements</h2>

<ul>
<li>Added index / db schema change to: Pages and CollectionVersionBlocks to speed up Block::getOriginalCollection() method</li>
<li>Setting LANGUAGE constant in the default core themes (pull request by patrickheck)</li>
<li>Allow any header item to be added to JavaScript addHeaderItem function.</li>
<li>Automatically populate additional URL with old URL (only used in JavaScript when editing page paths through the UI) (thanks xenyz)</li>
<li>Added site URL before page path (thanks melat0nin)</li>
<li>If a page is edited by a user, that information is present in the edited by overlay now (thanks 12345j and Mnkras)</li>
<li>Change attribute "Searchable" checkbox labels to be more informative (thanks jordanlev)</li>
<li>Added youtubeBlock class to the YouTube video block so it can be styled by CSS (thanks christiaan)</li>
<li>Added max username validation length to the concrete5 User validation helper. (thanks Mnkras)</li>
<li>Zend_Locale data will now be stored with the default cache files (pull request by stefangr)</li>
<li>Fixes occasional issue when downloading files via any web browser. File size was showing up as unknown and the progress bar wouldn't work. (pull request by hi-voltage)</li>
</ul>

<h2>Developer Updates</h2>

<ul>
<li>Added View::addFooterItems() support (Pull Request from jdmill)</li>
<li>Added priority and sorting by priority to site events so developers can manage the order of execution for different site events.</li>
<li>Added default log type (Pull request by mnkras)</li>
<li>Added new events (pull request by Mnkras):

<ul>
<li>on_file_set_password</li>
<li>on_file_add</li>
<li>on_file_version_add</li>
<li>on_file_download</li>
<li>on_file_version_duplicate</li>
<li>on_file_version_update_title</li>
<li>on_file_version_update_tags</li>
<li>on_file_version_update_description</li>
<li>on_file_version_approve</li>
<li>on_file_version_deny</li>
<li>on_user_enter_group</li>
<li>on_user_exit_group</li>
<li>on_user_friend_add</li>
<li>on_user_friend_remove</li>
</ul></li>
<li>Modified all helper classes that stored local data to call a reset method when retrieved with Loader::helper()</li>
<li>Added shortenTextWord() to Text Helper (pull request by patrickheck)</li>
<li>Improved documentation for Text Helper (pull request by Mnkras)</li>
</ul>



