4.7.x

This release addresses an access bypass security issue, DRUPAL-SA-2007-020. Sites that try to restrict access to projects based on the 'access projects' or 'access own projects' permissions should upgrade immediately.

Other changes since 4.7.x-1.2:

Changes since4.7.x-2.1:

Bugs fixed since 4.7.x-1.1:

This is the backport from Drupal 5. Good luck! I probably won't maintain these as much, except for critical patches, but most of the code is the same. For instance, if you see a provider file in the D5 branch, it should work as is in this branch.

4.7--1.6-1
==========

Hotfix release for CCK 1.6.

Bugfix
------

General
- #167607 Fix '&nbsp' (missing ';') on field display.

Field / widget modules
- #167468 Nodereference : Fixed autocomplete widget w/ 'advanced (Views) mode' and Views 1.6 :
the first set of matches is repeated for subsequent edits (Views query cache)

4.7--1.6
========

IMPORTANT : this release fixes two cross-site scripting (XSS) vulnerabilities
in nodereference.module :
- when a nodereference field is displayed using the 'plain' formatter
- when a nodereference field is edited using the 'autocomplete text field' widget
(only when _not_ using the 'advanced options - Views.module' for the field)

All sites using CCK / nodereference.module should consider upgrading to this release
as soon as possible.

Please see DRUPAL-SA-2007-019 for more information.

Features
--------

General
- #154827 Let modules know the 'dummy' node form built on the 'manage fields' tab
is requested by CCK admin UI (problem with userreviewmodule).
- #153101 Provide better explanation on the 'default value - php code' expected format.
- #151347 Refactor content_field('load') to make it more legible.

Field / widget modules
- #152892 Optionwidgets : Better help text for 'single on/off checkbox' widget label.
- #65133 / #152016 Nodereference : Added 'full node' and 'teaser' formatters.
- #126926 Nodereference : Skip node_load in 'title'-based formatters.

Bugfix
------

General
- #155416 Limit non standard CSS (transparency) to the field overview page.
- #149832 Use 'plain' format for views argument handler ($op = 'title').