Have 2 sites that are in development and am contemplating which version to use. Tried searching forums and couldn't find any estimate.
swany
Moodle 1.4.x and other things set me back somewhat, but I'm hoping this month sometime. There will be a public beta testing period of at least two weeks.
I just finished reviewing security in Moodle 1.4.x. I can start working on 1.5 again in the second half of January 
(I am too busy with my business now.)
I do not like being a showstopper, but there is a lot of new code that should be checked.
skodak
I do not like being a showstopper, but there is a lot of new code that should be checked.
skodak
Petr, thanks a lot for all your hard work.
Perhaps if we could have a section in the coding guide on the security issues (i.e. things like how to use sesskey in forms) then Petr would have less work.
Petr,
I read your post on the website at work and could hardly wait to get home to respond to it.
Yesterday, I had a look around the bugtracker. I was humbled (as I have been on many other occasions) by the extent of the talent and energy committed to Moodle by yourself and all of those others who contibute so selflessly to further develop and hone Moodle.
Of course having 1.5 released tonight would be great, but the key thing is to have it right not rushed.
Those of us who eagerly await the next release would (I hope) agree that patience is virtue and that even Moodle developers have to find time for the other things in their lives.
Regards and best wishes
Ray
I read your post on the website at work and could hardly wait to get home to respond to it.
Yesterday, I had a look around the bugtracker. I was humbled (as I have been on many other occasions) by the extent of the talent and energy committed to Moodle by yourself and all of those others who contibute so selflessly to further develop and hone Moodle.
Of course having 1.5 released tonight would be great, but the key thing is to have it right not rushed.
Those of us who eagerly await the next release would (I hope) agree that patience is virtue and that even Moodle developers have to find time for the other things in their lives.
Regards and best wishes
Ray
Petr,
I would like to add my voice of gratitude, along with Ray's, for all that you have done to secure Moodle and make it the fantastic tool it has become. Many probably don't even know how much you have contributed to Moodle this past year.
Hoping you have a happy and prosperous New Years,
Bryan
Yeah, sure!
you are doing an incredible
work!! Sincerely!! Thanks!! 
Ciao
Security-Man
you are doing an incredible
Ciao
Security-Man
It was important stuff that had to be done, no question, and it wouldn't have happened without Petr's eagle eyes! I will upgrade the coding guide with
- Using sesskey to protect actions
- Using optional_param and required_param to check input
- Using s() and p() functions when creating output
Anything else I've forgotten?
- Using sesskey to protect actions
- Using optional_param and required_param to check input
- Using s() and p() functions when creating output
Anything else I've forgotten?
I appreciate everyone's response and am extremely grateful for the support and help many in the community give to Moodle, above and beyond what is asked.
As far as upgrading and/or manual writing goes, how much of 1.5 is going to be radically different than 1.4.x? Is upgrading going to be fairly seamless as far as blocks and new features go? My big fear is I need to document using screen caps for extensive manual development and don't want to do it twice. So maybe I hold off on screen caps until 1.5 is open in release.
Again, thanks.
swany
I am not so happy about using s() and p() functions when creating output. These functions currently include a call to stripslashes() which, as the name says, strips slashes. This is only appropriate if the text I want to output had escape slashes added to it which is not always the case. Could we perhaps have similar functions without the stripslashes()?
Perhaps these current p() and s() functions should have default arguments that defines does slashes get stripped or not???
Good idea. I have filed a bug.
Swanny
Anyone deploying a new site should look at only the latest stable version. It does not matter which version you use 1.4.3 or if it is released 1.5.
For people developing sites, unless they desire to push the envelope and support an installation themselves and have tech support people on-hand, then you should only be developing sites using a "known and reliable" system. In my opinion anyone who is developing a site on a "yet to be released" version is on their own. To expect Martin or the developers to fix a site development problem is a little rich.
In a testing phase, I have a seperate development server on a different domain and test my "known site" against the development site. I also ensure I have the required Tech Support personnel "on-hand" to ensure it all works and then feed back issues that we find. To me that is the only way in which ensure a "safe site". People who continually push for the patest and greatest on their "live sites" just ask for permanent headaches.
Just two cents worth
Ah, posting at the same time. lol
I agree on using a stable version and have no problem with testing newer versions hidden away on one of many available servers.
We've had classes running for about a year going from 1.3 to 1.4.2 or wherever we are now with few problems. A bigger project is using Moodle as a CMS/Intranet for a medium size group (~90 users across 9 departments). Documenting everything falls directly on my head and so don't mind waiting a bit if I'm going to need to redo much of it.
I guess my main question should have been, how different is 1.5 going to be when released?
Again, thanks.
swany