| Security |
| Filters are not applied to URLs of the form /widget/c/portal/* | LPE-1124 |
| Unauthenticated users can view content on private pages | LPE-905 |
| Phishing + XSS vulnerability with "Return to Full Page" link | LPE-960 |
| Same error message displayed for incorrect email and password | LPE-961 |
| Guest can have configuration permission | LPE-1014 |
| Malicious JavaScript can be inserted into the Polls portlet | LPE-1100 |
| Login portlet does not properly escape login information | LPE-962 |
| Framework for escaping untrusted data | LPE-934 |
| Performance |
| Filters are not applied to URLs of the form /widget/c/portal/* | LPE-1124 |
| Possible memory leak when using CAS | LPE-1058 |
| Cache files created during staging are never removed | LPE-1158 |
| Performance improvement for the Class system in Liferay's Javascript | LPE-1183 |
| Removed RUON, Mirage, SAW, and Portlet Container | LPE-978 |
| Reduce network traffic and download time with HTTP ETag | LPE-987 |
| WSRP has been rewritten | LPE-1089 |
| Language servlet requests are not cached | LPE-1165 |
| Chat portlet leaves empty database entries in Oracle database | LPE-1190 |
| File descriptor leak prevent themes from deploying | LPE-925 |
| General |
| Monitoring support for portal and portlet operations | LPE-1042 |
| Friendly URLs that cannot start with a locale ID | LPE-1043 |
| Portlets on User Group Pages Do Not Retain Their Custom Names When Assigned to a Member | LPE-1054 |
| Unable to change look and feel of some pages | LPE-1061 |
| Google Apps integration | LPE-1065 |
| Users are not redirected to the correct page | LPE-1067 |
| MVCPortlets can now automatically copy parameters from ActionRequest to RenderRequest | LPE-1071 |
| Portlet errors are not displayed | LPE-1073 |
| Standardized filters to extend BasePortalFilter | LPE-1081 |
| Improve speed of indexing users and ldap import/export | LPE-1092 |
| Validator.isXml does not recognize <root /> as XML | LPE-1101 |
| Cannot restart Liferay portal from WebSphere | LPE-1103 |
| Friendly URL using i18n Servlet Defined in web.xml is Replaced With LanguageId in All Links | LPE-1111 |
| Ant build-lang may translate the languages incorrectly | LPE-1149 |
| New script to build all services and wsdd's automatically | LPE-1151 |
| WSRP support has been moved to a plugin | LPE-1153 |
| Browser does not open after Tomcat 6 starts | LPE-1156 |
| Filters should match against URL plus query string | LPE-1163 |
| Add release.properties to the ext environment | LPE-1175 |
| User's external social ID preferences are not trimmed of extra spaces and set to lower case | LPE-900 |
| ServletContextUtil incorrectly returns class names | LPE-902 |
| JSON services now support two dimensional arrays | LPE-907 |
| Default query string for layouts | LPE-922 |
| ccpp.jar is missing from the Liferay WAR | LPE-924 |
| Cleaned up synchronous messaging | LPE-933 |
| The user information's job title attribute is always blank | LPE-935 |
| AuthenticatingHttpInvokerRequestExecutor can cause a StackOverflowError | LPE-942 |
| PortalUtil getPortletTitle method causes StackOverflowError Exception | LPE-951 |
| Deploying to WebLogic fails because the pre-compiler does not allow folders that start with _ | LPE-970 |
| Deploying to WebLogic fails because of invalid weblogic.xml | LPE-971 |
| Links contains spaces | LPE-991 |
| Some html <input> tags are not closed properly | LPE-1052 |
| SAXReaderImpl & ExceptionTranslator's stack traces are incomplete | LPE-1066 |
| Added Switzerland Region Information | LPE-1117 |
| Incorrect HTML used in loading animation | LPE-1147 |
| The copy page select options contains HTML markup | LPE-918 |
| Added Australia's region information | LPE-963 |
| Source Formatter leaves an extra space when formatting logs | LPE-964 |
| Authentication |
| Unable to change passwords if using LDAP password policy | LPE-1030 |
| Possible memory leak when using CAS | LPE-1058 |
| LDAP users are not imported | LPE-915 |
| Cannot access "Add Application" menu using NTLM and IE | LPE-1017 |
| Option to not require password for basic authentication | LPE-1031 |
| Administrator passwords do not get synced with LDAP | LPE-1045 |
| Static passwords may be displayed to the user incorrectly after account creation | LPE-1056 |
| Cannot use FCKeditor to upload images | LPE-1080 |
| Sample RequestHeaderAutoLogin | LPE-1085 |
| LDAP export may fail if jobtitle is empty | LPE-1133 |
| Updating a user's password may cause an error | LPE-954 |
| Enabling LDAP export throws an exception | LPE-1020 |
| Updating user that does not exist in LDAP throws an exception | LPE-1095 |
| Control Panel |
| New option to prevent users from editing screen name and email | LPE-1041 |
| Some Wiki links do not work in the control panel | LPE-1049 |
| Converting permission algorithms may not work | LPE-1118 |
| Thumbnails in the Image Gallery are overlapping | LPE-1164 |
| Header column is too short in plugins configuration | LPE-1075 |
| Database |
| Quickly adding social activities results in a duplicate key exception | LPE-1015 |
| Liferay does not start if database is sharded | LPE-1064 |
| Counter service's database connection times out | LPE-1102 |
| "Invalid object name" error occurs if using SQL Server 2000 | LPE-1152 |
| Corrupt database do not get upgraded | LPE-1047 |
| ShardLocalServiceUtil is more robust | LPE-1083 |
| Upgrade may fail if database supports altering column name but not column type | LPE-1093 |
| QueryPos can now take an array of values | LPE-1104 |
| Automatically detect and fix incorrect user entries in the database | LPE-1161 |
| Database objects are incorrectly cached | LPE-906 |
| Upgrading a Liferay database does not correctly add new UUID columns | LPE-931 |
| Support for Java Persistence Query Language | LPE-968 |
| Database indexes are added even if the index already exist | LPE-979 |
| Database shard not created for default company | LPE-980 |
| Tags with duplicate properties can not be saved | LPE-994 |
| Added Switzerland Region Information | LPE-1117 |
| Sample database script should use screen names for user friendly URLs | LPE-1160 |
| Export / Import (LAR) |
| Web Content / Journal articles do not show up in searches after a site import | LPE-1046 |
| Portlets on User Group Pages Do Not Retain Their Custom Names When Assigned to a Member | LPE-1054 |
| Journal Content Portlet Exports the Most Recent Article, Regardless of Approval Status | LPE-1055 |
| When importing a Wiki article, comments are imported for every version of the article | LPE-1181 |
| Plugins cannot use LAR's XStream support | LPE-936 |
| Site export / import does not work with permission algorithm 6 | LPE-938 |
| Exporting certain portlets may fail | LPE-939 |
| Option to disable automatically exporting the Journal portlet | LPE-940 |
| Site import fails if there are comments | LPE-998 |
| Extension Environment |
| New mechanism to override the default resource-actions permissions | LPE-1106 |
| Framework / API |
| Quickly adding social activities results in a duplicate key exception | LPE-1015 |
| Added a business rules engine | LPE-1099 |
| Removed RUON, Mirage, SAW, and Portlet Container | LPE-978 |
| JavaScript framework for accessing portal properties | LPE-1016 |
| New method to get the number of message board post across all communities | LPE-1018 |
| Removed spring-test.jar | LPE-1036 |
| New methods to dynamically set headers when using HttpUtil.URLto*() | LPE-1062 |
| Methods in PortletResponseUtil can now take a MimeResponse | LPE-1079 |
| New Axis ServletUtil class | LPE-1082 |
| Service builder will now auto-generate localization methods | LPE-1087 |
| New util method to create a localization map based on a XML | LPE-1088 |
| WSRP has been rewritten | LPE-1089 |
| QueryPos can now take an array of values | LPE-1104 |
| New method to access PortletRequest from a SearchContainer | LPE-1107 |
| Simplify API for sending messages on the message bus | LPE-1108 |
| Allow plugins and ext environment to configure destinations on the message bus | LPE-1109 |
| New constructor for SearchContainer | LPE-1113 |
| Allow plugins to configure PortletBag with other portlets | LPE-1114 |
| New Content-Length constant for HttpHeaders class | LPE-1121 |
| New method to access the latest response's cookies | LPE-1122 |
| New $ constant for StringPool | LPE-1123 |
| liferay-portlet.xml now honors full URLs for CSS and JS | LPE-1125 |
| StringServletOutputStream can now take a ByteArrayOutputStream | LPE-1127 |
| New ResourceRetriever interface for accessing resources | LPE-1128 |
| get*Uuid() methods are now auto-generated | LPE-1130 |
| Classes that extend PrimitiveWrapper are now Comparable | LPE-1157 |
| ServiceBuilder may generate Clp classes incorrectly | LPE-1159 |
| Automatically detect and fix incorrect user entries in the database | LPE-1161 |
| Users with the correct permissions cannot copy a Journal Article | LPE-1169 |
| Unread messages of a Message Board thread are now highlighted | LPE-1170 |
| Upgrade third party libraries | LPE-1177 |
| New Find*Actions | LPE-908 |
| Simplify posting to a site that requires authentication | LPE-909 |
| Unique finders with a Date field throws exceptions | LPE-910 |
| New method to count Liferay instances | LPE-916 |
| Portal level polling mechanism for portlets | LPE-920 |
| Validator.equals() now take objects as arguments | LPE-927 |
| Plugins cannot use LAR's XStream support | LPE-936 |
| Pagination support for getRoleUsers() | LPE-944 |
| Added modified date to business intelligence reporting | LPE-947 |
| Renamed JSPPortlet to MVCPortlet | LPE-950 |
| PortletURL is unable to escape XML when writing to stream | LPE-955 |
| MultiValueMap data type | LPE-976 |
| New method for getting a BaseModel | LPE-992 |
| Source Formatter doesn't convert tabs to spaces correctly resulting in false positives | LPE-941 |
| High Availability / Clustering |
| Load balancing for Solr | LPE-1145 |
| JavaScript |
| Performance improvement for the Class system in Liferay's Javascript | LPE-1183 |
| Unable to expand/collapse all when publishing to live or remote | LPE-1006 |
| JavaScript framework for accessing portal properties | LPE-1016 |
| Cannot access "Add Application" menu using NTLM and IE | LPE-1017 |
| Some javascript is not minified correctly and throws an exception | LPE-1050 |
| The list of pages in Manage Pages does not update when pages are added/deleted | LPE-1090 |
| Freed up the JavaScript namespace | LPE-1155 |
| Portal level polling mechanism for portlets | LPE-920 |
| DelayedTask for JavaScript | LPE-945 |
| Users are able to open multiple Add Application windows | LPE-982 |
| Unauthenticated users can not call Liferay.PortletURL | LPE-993 |
| Star ratings does not work for languages that uses a comma as the decimal separator | LPE-996 |
| Localization |
| New util method to create a localization map based on a XML | LPE-1088 |
| LocalizationUtil may return the wrong XML when removing a language | LPE-1097 |
| Friendly URL using i18n Servlet Defined in web.xml is Replaced With LanguageId in All Links | LPE-1111 |
| Ant build-lang may translate the languages incorrectly | LPE-1149 |
| Language servlet requests are not cached | LPE-1165 |
| Star ratings does not work for languages that uses a comma as the decimal separator | LPE-996 |
| Untranslated text | LPE-901 |
| Untranslated text in Portlet look and feel | LPE-985 |
| Permissions |
| Unauthenticated users can view content on private pages | LPE-905 |
| Guest can have configuration permission | LPE-1014 |
| Allow user groups to be a member of organizations | LPE-1053 |
| Migrating to permission algorithm 5 or 6 fails | LPE-1007 |
| Cannot access "Add Application" menu using NTLM and IE | LPE-1017 |
| Guest users cannot view blog entries | LPE-1021 |
| Improved script for migrating to permission algorithm 5 & 6 | LPE-1084 |
| Default permissions for the Owner role | LPE-1105 |
| New mechanism to override the default resource-actions permissions | LPE-1106 |
| Users with the correct permissions cannot copy a Journal Article | LPE-1169 |
| Impersonating a user may redirect to a restricted url | LPE-1174 |
| Plugin Hooks |
| Hooks can overwrite additional portal properties | LPE-977 |
| Plugin Portlet - Chat |
| Chat portlet leaves empty database entries in Oracle database | LPE-1190 |
| Portal level polling mechanism for portlets | LPE-920 |
| The alt attribute is missing from the image tags in Chat/Weather/WOL portlets | LPE-1142 |
| Plugin Portlet - Google Gadget |
| Google Gadgets portlet does not work | LPE-1132 |
| Plugin Portlet - Google Maps |
| Get directions does not work in Google Maps Plugins | LPE-1098 |
| Plugin Portlet - Google Search |
| Google search portlet does not work with new API keys | LPE-1116 |
| Plugin Portlet - Weather |
| The alt attribute is missing from the image tags in Chat/Weather/WOL portlets | LPE-1142 |
| Plugin Portlet - WOL |
| WOL Summary portlet shows Twitter account | LPE-1004 |
| WOL Friends Portlet should not show deactivated users | LPE-943 |
| The alt attribute is missing from the image tags in Chat/Weather/WOL portlets | LPE-1142 |
| Plugin Portlets |
| Christianity portlets are now plugin portlets | LPE-984 |
| Class loading issues with PluginsMessagingConfigurator in plugins | LPE-1048 |
| Allow plugins to configure PortletBag with other portlets | LPE-1114 |
| liferay-portlet.xml now honors full URLs for CSS and JS | LPE-1125 |
| Redeployed plugins uses old cache | LPE-914 |
| Plugins cannot use LAR's XStream support | LPE-936 |
| Eliminate the need for a portlet.xml file in simple MVC portlets | LPE-972 |
| Plugin portlets can leverage the IFrame portlet | LPE-981 |
| Plugin Web - Solr Search Engine |
| Added ability to toggle auto-commit in Solr plugin | LPE-1143 |
| Basic authentication for Solr | LPE-1144 |
| Load balancing for Solr | LPE-1145 |
| Plugins |
| Unable to specify a portlet's available window states in portlet.xml | LPE-1096 |
| Deploying plugins to WebSphere no longer requires adding ibm-web-ext.xmi | LPE-1138 |
| Plugins are easier to deploy to WebLogic | LPE-973 |
| Portlet |
| Portlets With Refresh Enabled Do Not Retain Their Window State | LPE-1060 |
| Adding tags with special characters may cause javscript errors | LPE-1069 |
| Refresh icon disappears | LPE-1074 |
| The refresh portlet icon only works once | LPE-1077 |
| Unable to specify a portlet's available window states in portlet.xml | LPE-1096 |
| Thumbs up/down ratings does not work in IE6 | LPE-1171 |
| Pasting text into a discussion comment box does not enable the Reply button | LPE-1173 |
| Ratings star selector does not work in IE6 | LPE-1178 |
| Portlet - Activities |
| Unauthenticated users can view content on private pages | LPE-905 |
| Quickly adding social activities results in a duplicate key exception | LPE-1015 |
| Activities portlet now tracks Image Gallery activities | LPE-1119 |
| Activities portlet does not work on community and organization pages | LPE-1136 |
| Standardized social activities entries | LPE-904 |
| Portlet - Admin |
| Converting permission algorithms may not work | LPE-1118 |
| Thumbnails in the Image Gallery are overlapping | LPE-1164 |
| Server uptime is incorrect in Server Administration | LPE-1179 |
| Portlet - Asset Publisher |
| Cannot select Journal articles in a staging community | LPE-921 |
| Portlet - Blog |
| Links in BlogAggregator broken for articles with non-english title | LPE-1168 |
| Guest users cannot view blog entries | LPE-1021 |
| Some javascript is not minified correctly and throws an exception | LPE-1050 |
| Blogs trackback requires a HTTP POST | LPE-926 |
| Blog Entry Titles With Special Characters Such As "?" Cause Blog Entry Links to be Invalid | LPE-929 |
| The "public" checkbox for blogs and messages board messages is disabled by default | LPE-959 |
| The Blogs portlet default value for Maximum Items to Display can cause confusion | LPE-1011 |
| Portlet - Breadcrumb |
| Guest can have configuration permission | LPE-1014 |
| Portlet - Calendar |
| Web crawlers trying to export calendar events causes an exception | LPE-903 |
| Calendar portlet does not cleanup temporary files after export/import of events | LPE-912 |
| Portlet - Document Library |
| Old versions of Document Library files may not fully download | LPE-1000 |
| Cannot change the folder of a document in Document Library | LPE-1019 |
| Document Library, Image Gallery and Wiki allows files up to 3GB | LPE-1026 |
| An empty path causes WebDAV to throw an exception | LPE-1035 |
| No error message when uploading multiple files | LPE-1162 |
| Cannot delete or edit comments | LPE-1166 |
| New Find*Actions | LPE-908 |
| Portlet - Enterprise Admin |
| Malicious JavaScript can be inserted into the Enterprise Admin portlet | LPE-1135 |
| New option to prevent users from editing screen name and email | LPE-1041 |
| A non-administrator user may be unable to use the Organization Admin portlet | LPE-911 |
| Adding additional organization addresses causes an error | LPE-937 |
| Untranslated text | LPE-901 |
| Portlet - IFrame |
| Allow IFrame portlet to use dynamic user credentials | LPE-974 |
| Plugin portlets can leverage the IFrame portlet | LPE-981 |
| Improved accessibility for IFrame portlet | LPE-990 |
| Portlet - Image Gallery |
| Document Library, Image Gallery and Wiki allows files up to 3GB | LPE-1026 |
| Activities portlet now tracks Image Gallery activities | LPE-1119 |
| No error message when uploading multiple files | LPE-1162 |
| Portlet - Journal / Web Content |
| Web Content Display indexes are not removed when removing the portlet from a page | LPE-1028 |
| Dynamically generated links in Web Content / Journal articles | LPE-1032 |
| Some javascript is not minified correctly and throws an exception | LPE-1050 |
| Journal Content Portlet Exports the Most Recent Article, Regardless of Approval Status | LPE-1055 |
| Cannot delete or edit comments | LPE-1166 |
| Users with the correct permissions cannot copy a Journal Article | LPE-1169 |
| Cannot select Journal articles in a staging community | LPE-921 |
| Option to disable automatically exporting the Journal portlet | LPE-940 |
| Velocity stops rendering if the template calls a non existing service | LPE-975 |
| Portlet - Message Boards |
| "My Post" in Message Boards causes exception on MySQL | LPE-899 |
| Message Boards does not work after upgrade from 5.1.4 to 5.1.5 | LPE-952 |
| New method to get the number of message board post across all communities | LPE-1018 |
| Message Board threadcounts and postcounts may be incorrect | LPE-1150 |
| Unread messages of a Message Board thread are now highlighted | LPE-1170 |
| New Find*Actions | LPE-908 |
| Permalink to individual message board messages | LPE-917 |
| The "public" checkbox for blogs and messages board messages is disabled by default | LPE-959 |
| Portlet - Navigation |
| Guest can have configuration permission | LPE-1014 |
| Portlet - Plugin Installer |
| Header column is too short in plugins configuration | LPE-1075 |
| Portlet - Polls |
| Malicious JavaScript can be inserted into the Polls portlet | LPE-1100 |
| Portlet - RSS |
| Cannot set a footer Journal / Web Content for RSS portlet | LPE-986 |
| Portlet - Shopping |
| Guest can have configuration permission | LPE-1014 |
| Shopping portlet using foreign currency will display and save values incorrectly in currency fields | LPE-1172 |
| Portlet - Sign In |
| Same error message displayed for incorrect email and password | LPE-961 |
| Guest can have configuration permission | LPE-1014 |
| Login portlet does not properly escape login information | LPE-962 |
| Screen names are changed by Liferay | LPE-956 |
| Portlet - Site Map |
| Guest can have configuration permission | LPE-1014 |
| Portlet - Tags Admin |
| Freed up the JavaScript namespace | LPE-1155 |
| Tags Admin Does Not Throw an Error When Adding Tags With Invalid Characters | LPE-930 |
| Tags with duplicate properties can not be saved | LPE-994 |
| Portlet - Wiki |
| Document Library, Image Gallery and Wiki allows files up to 3GB | LPE-1026 |
| Some Wiki links do not work in the control panel | LPE-1049 |
| Links in the Wiki RSS is broken | LPE-1154 |
| Cannot delete or edit comments | LPE-1166 |
| When importing a Wiki article, comments are imported for every version of the article | LPE-1181 |
| Wiki's recent changes feed links are incorrect | LPE-923 |
| Wiki's summary field is pre-populated with old data | LPE-958 |
| Search |
| Web Content / Journal articles do not show up in searches after a site import | LPE-1046 |
| Tags with multiple words are not searchable | LPE-1070 |
| Lucene search is more robust | LPE-1091 |
| Star ratings does not work for languages that uses a comma as the decimal separator | LPE-996 |
| Improved search term highlighting in search results | LPE-1023 |
| Staging |
| Cache files created during staging are never removed | LPE-1158 |
| Unable to expand/collapse all when publishing to live or remote | LPE-1006 |
| Links in staging results in a redirect loop after a session timeout | LPE-1072 |
| Scheduling a publish to live and then publishing to live manually causes errors | LPE-1182 |
| Publishing a workflow proposal should not show options for scheduling | LPE-913 |
| Publishing a staged site broadcasts an event | LPE-928 |
| Publishing a staged site may not work | LPE-932 |
| Option to disable automatically exporting the Journal portlet | LPE-940 |
| TagLib |
| Javascript Validation of Maximum Length on text (area) fields does not work correctly on cut and paste | LPE-1057 |
| Adding tags with special characters may cause javscript errors | LPE-1069 |
| Freed up the JavaScript namespace | LPE-1155 |
| Impersonating a user may redirect to a restricted url | LPE-1174 |
| Cannot use CSS to change the column width in <liferay-ui:search-iterator> | LPE-1022 |
| Themes |
| Phishing + XSS vulnerability with "Return to Full Page" link | LPE-960 |
| Community logo is not used on private pages | LPE-1001 |
| Themes do not display correctly when using Jboss | LPE-1063 |
| File descriptor leak prevent themes from deploying | LPE-925 |
| Velocity stops rendering if the template calls a non existing service | LPE-975 |
| Improved SEO for the default theme | LPE-1025 |
| Upgrade |
| Upgrading an Oracle database fails because it cannot modify column type | LPE-1008 |
| Upgrade will fail if a job title is over 75 characters | LPE-1009 |
| Upgrading may delete comments and cause you to be unable to add comments | LPE-1039 |
| Some subscriptions are lost during upgrade | LPE-1059 |
| Christianity portlets are now plugin portlets | LPE-984 |
| Corrupt database do not get upgraded | LPE-1047 |
| Improved script for migrating to permission algorithm 5 & 6 | LPE-1084 |
| Upgrade may fail if database supports altering column name but not column type | LPE-1093 |
| Upgrading a Liferay database does not correctly add new UUID columns | LPE-931 |