1.8.8 (unreleased)

# 1.8.8 (unreleased)
- Updated: ezjscore.ini [ezjscServer_ezjscnode] HardLimit is 500 instead of false, so ezjscnode::subtree and the
  admin's expsubitems rows return at most 500 items per request, the largest page size the sub-items list offers;
  a request for more is cut to 500. false or 0 switches the limit off as before.
- Updated: jQuery Migrate is switched off: ezjscore.ini [eZJSCore] LocalScripts[jqueryMigrate] and
  ExternalScripts[jqueryMigrate] are empty, so ezjsc::jquery loads jQuery 4.0.0 alone. Migrate 4.0.2 is still shipped;
  the comment in ezjscore.ini names the settings that switch it back on.

# 1.8.7 (2026-10-29)
- Updated: every file header and the metadata name the copyright holders as "Copyright (C) 1998 - 2026 Exponential
  Foundation and 7x. All rights reserved."; contributors assign their copyright to both through the CLA.
- Updated: Version 1.8.7 in ezinfo.php and extension.xml.

# 1.8.6 (2026-10-29)
- Fixed: ezjscore/call, the json_encode template operator and the ajax uploader never answer with an empty JSON
  value for a string that is not valid UTF-8 (a truncated multibyte character, a Latin-1 value of an old import):
  ezjscAjaxContent::jsonEncode() replaces the invalid bytes with U+FFFD, and a value that still cannot be encoded
  (INF, NAN) is logged and answered with the error object ezjscore/call uses for every other failure.
- Added: translations into 135 more languages, so ezjscore carries 156 locales: afr-ZA, aka-GH, amh-ET, arc-IQ,
  asm-IN, ast-ES, aze-AZ, bam-ML, bel-BY, ben-BD, bho-IN, bod-CN, bos-BA, bre-FR, brx-IN, bul-BG, cat-ES, ceb-PH,
  che-RU, chi-CN, chi-TW, ckb-IQ, cym-GB, div-MV, doi-IN, dsb-DE, dzo-BT, ell-GR, eng-AU, epo-EO, est-EE, eus-ES,
  ewe-GH, fao-FO, fas-AF, fas-IR, fil-PH, fin-FI, fry-NL, ful-SN, gla-GB, gle-IE, glg-ES, guj-IN, hau-NG, haw-US,
  hin-IN, hsb-DE, hun-HU, huy-IL, hye-AM, ibo-NG, ind-ID, isl-IS, jav-ID, jpn-JP, kab-DZ, kal-GL, kan-IN, kas-IN,
  kat-GE, kaz-KZ, khm-KH, kik-KE, kin-RW, kir-KG, kok-IN, kor-KP, kor-KR, kur-TR, lao-LA, lav-LV, lin-CD, lit-LT,
  ltz-LU, lug-UG, mai-IN, mal-IN, mar-IN, mkd-MK, mlg-MG, mlt-MT, mni-IN, mon-MN, mri-NZ, msa-MY, mya-MM, nep-NP,
  nqo-GN, oci-FR, ori-IN, orm-ET, pan-IN, pcm-NG, pnb-PK, por-PT, pus-AF, que-PE, roh-CH, ron-RO, run-BI, rus-RU,
  san-IN, sat-IN, ser-SR, sin-LK, slk-SK, slv-SI, sme-NO, sna-ZW, snd-PK, som-SO, sqi-AL, srp-RS, sun-ID, swa-KE,
  syr-IQ, tam-IN, tat-RU, tel-IN, tgk-TJ, tha-TH, tir-ET, ton-TO, tuk-TM, uig-CN, urd-PK, uzb-UZ, vie-VN, wol-SN,
  xho-ZA, yid-US, yor-NG, zgh-MA and zul-ZA. They are complete and machine-assisted.
- Updated: the Spanish (Mexico) and Ukrainian translations correct one message each.
- Updated: comments and the rad.ini registry name the documentation at its new place, doc/eng-us/.
- Updated: Version 1.8.6 in ezinfo.php and extension.xml.

# 1.8.5
- Added: Croatian, Czech, Danish, Dutch, Italian, Norwegian Bokmål, Polish, Portuguese (Brazil), Swedish and
  Turkish translations (cro-HR, cze-CZ, dan-DK, dut-NL, ita-IT, nor-NO, pol-PL, por-BR, swe-SE, tur-TR), and the
  Arabic one (ara-SA) of the kernel copy. They are complete and machine-assisted, and would benefit from a review
  by native speakers.
- Updated: Version 1.8.5 in ezinfo.php and extension.xml.

# 1.8.4
- Added: French and Ukrainian translations (fre-FR, ukr-UA). They are complete and machine-assisted,
  and would benefit from a review by native speakers.
- Updated: Version 1.8.4 in ezinfo.php and extension.xml.

# 1.8.3
- Updated: the global functions of the ezjscore/run and ezjscore/call views have names of their own
  (expModuleViewEzjscoreRunExitWithInternalError, expModuleViewEzjscoreRunHasAccessToBySetting,
  expModuleViewEzjscoreCallMultipleServerCalls) instead of exitWithInternalError,
  hasAccessToBySetting and multipleezjscServerCalls. A server with persistent workers keeps every
  function a worker ever defined, so a generic name defined first by other code (eztags' tree menu
  defines an exitWithInternalError of its own) would have served these views.
- Updated: generated script and style content of the packer (a server function such as
  ezjsc::jqueryio with packing off, or content that is never cached) is linked as a file of its own,
  named after its hash in the packer's cache directory, instead of being written inline into the
  page, so a page under a Content Security Policy without 'unsafe-inline' can use it. When the file
  cannot be stored the content is written inline as before.
- Fixed: ezpublishingqueue::status answers only a user who can read the object or the registered
  user who created the version, and gives the node's address only to a reader; anyone else gets the
  answer of a version that does not exist.
- Updated: Version 1.8.3 in ezinfo.php and extension.xml.

# 1.8.2
- Updated: ezjscnode::updatepriority takes the reorder lists of admin4's sub items table
  (PriorityList, ExpectedPriorityList, Renumber with PageOrder and PageOffset): it refuses to write
  when another user changed the order meanwhile and answers which nodes differ, renumbers the
  children in steps of 10 when a page has no room between its neighbours, and runs the check and the
  write in one transaction. Children with equal priorities are listed in node id order.
- Updated: ezjscnode::subtree lists the account status (disabled, locked) of the users among the
  children, when the kernel provides it.
- Updated: ezjscajaxcontent gives a node's is_hidden and is_invisible flags and the object's
  initial_language, for the language badges and the hidden marks of admin4.
- Updated: the ajax uploader sanitizes an uploaded SVG image before it is stored, and refuses one
  that cannot be read or has nothing that can be shown safely.
- Updated: Version 1.8.2 in ezinfo.php and extension.xml.

# 1.8.1
- Added: Spanish (Spain and Mexico), Hebrew, Latin and Klingon translations (esl-ES, esl-MX,
  heb-IL, lat-VA, tlh-QO). They are complete and machine-assisted, and would benefit from a review
  by native speakers.
- Updated: Version 1.8.1 in ezinfo.php and extension.xml.


# 1.8.0
- Updated: the ajax uploader's browse step asks the upload handler's canUpload() like the other
  steps, before it reads the node, so it answers no one without upload rights. The call names the
  handler: ezajaxuploader::browse::<handler>::<node>::<class>[::<offset>], and the script posts the
  upload target with it. An override of ajaxuploader/browse.tpl puts {$handler_id|wash()} in its
  links; the admin designs of Exponential 6.0.15 carry the new links.
- Updated: a missing or incomplete AjaxUploadHandlerData is refused with "Arguments error." instead
  of an ArgumentCountError from the handler's constructor.
- Updated: with packing off (DevelopmentMode, Packer=disabled) script and stylesheet URLs are the
  files' own addresses, without any version query; ezjscPacker::isFileURL() tells a file URL from
  inline content. Packed files keep the newest file time in their name.
- Updated: Version 1.8.0 in ezinfo.php and extension.xml.


# 1.7.0
- Removed: the older jQuery copies nothing loaded: jquery-3.7.1.js, jquery-3.7.1.min.js,
  jquery-migrate-3.4.1.min.js and jquery-ui-1.10.3.custom.min.js (jQuery UI 1.10.3 has known
  vulnerabilities). design/standard/javascript/ holds one release of each library: jQuery 4.0.0,
  jQuery Migrate 4.0.2 and jQuery UI 1.14.2. A template or an ezjscore.ini of a site that names one
  of the removed files loads nothing for it: name ezjsc::jquery / ezjsc::jqueryUI or the shipped file.
- Updated: on a siteaccess that requires a sign-in (RequireUserLogin=true, normally the admin),
  ezjscore/call needs a signed-in user: site.ini.append.php no longer lists it in
  [SiteAccessSettings] AnonymousAccessList. Front ends are not affected.
- Updated: the ajax uploader keeps the stored file on the server between its steps. The location
  form carries a one-time token, bound to the user and the upload target and valid for an hour,
  instead of a path; the file is taken only from the storage directory; every step checks the
  handler's canUpload(). A location form override replaces the UploadFile field with UploadToken;
  the admin designs of Exponential 6.0.15 carry the new form, so on an older kernel override
  ajaxuploader/location.tpl the same way.
  [ezjscServer_ezajaxuploader] RequirePolicy (disabled) can also ask for ezjscore/call with the
  function list ezajaxuploader.
- Updated: ezjsc::search passes only positive integer ids to the search engine (subtrees, sections,
  class attributes, the time limit) and looks up a class named by its identifier to its id; the
  offset and the limit are at least 0 and 1.
- Updated: German translation of the uploader's new message.
- Updated: Version 1.7.0 in ezinfo.php and extension.xml.


# 1.6.0
- Added: [ezjscServer_<group>] RequirePolicy (ezjscore.ini). Not set: Functions[] is checked as
  before. disabled: not checked. enabled: checked, and a request whose calls are all refused is
  answered with 403 Forbidden. ezjscnode ships RequirePolicy=disabled, so nothing changes until a
  site switches it on (FunctionList[]=ezjscnode for the policy limitation).
  ezjscServerRouter::getInstance() takes an optional fourth argument that is set to why a call was
  refused, and ezjscServerRouter::refusedStatus() gives the HTTP status for those refusals.
  Derived from LoveStack (mugoweb/ezpublish-legacy, commit aa307a7ff3), with thanks to Mugo Web.
- Added: the ezjsc::search server function sorts eZ Find results by ezfind.ini
  [SearchSettings] SortBy[] (field => asc|desc). settings/ezfind.ini.append.php ships
  SortBy[published]=desc, the order search always used. Derived from LoveStack (commits
  3d2d337b0d and 3af1ec3aee), with thanks to Mugo Web.
- Updated: the ajax uploader checks an uploaded image by its content against the image types
  the installation allows before the file is stored (derived from LoveStack commit c8e45fced7),
  and its location form asks for an alternative text when the image's class requires one
  (derived from LoveStack commit a28863d9c0). Both use the image checks of the Exponential 6.0.15
  kernel (eZContentUpload::imageUploadError(), eZImageType::classAltTextRequired()).
- Updated: ezjscore/run reads the policy omit list through expPolicyOmitList when the kernel has
  it (idea from LoveStack commit 98854ab935).
- Updated: ezjscore/call answers a PHP Error in a server function with a generic error text and
  logs the details, instead of breaking the JSON response.
- Updated: the module definition reads its function list without ezjscore.ini (an inactive
  extension, a test), and htmlspecialchars() is called with explicit flags, which gives the same
  output on PHP 8.0 as on 8.1 and later.
- Added: settings/rad.ini.append.php declares the server function registry for the extension
  point survey of Exponential.
- Updated: Version 1.6.0 in ezinfo.php and extension.xml.


# 1.5.0
- Removed YUI: the YUI 2 and YUI 3 libraries (design/standard/lib/yui), the packer keys
  ezjsc::yui2, ezjsc::yui3, ezjsc::yui3io and their config functions (yui2conf, yui3conf),
  the [YUI3] settings and the yui entries of ExternalScripts, LocalScripts and
  LocalScriptBasePath. PreferredLibrary is jquery. Code that still requires ezjsc::yui*
  must move to jQuery (ezjsc::jquery, ezjsc::jqueryio) or Exponential UI (extension expui).


# 1.3.0alpha1
- Change index_ajax.php to not include / call functions that have been deprecated since 4.3
  and take advantage of session lazy loading on 4.4
- Change use of old templateInit() api and use class based api introduced in 4.3 instead
- Updated jQuery to 1.4.3
- Fixed bug #017355: admin2: js error prevents context menu in children items table to pop up
- Fixed bug #017573: (tc-458) utf8 names are no rendered properly in admin2 interface
- Added a new server call for the content publishing queue
- Fixed bug #017970: (tc-150)(teamroom) "Error loading box" in teamroom home page

# v1.2.0rc1
- Fixed bug #017223: Make LoadFromCDN disabled by default

# v1.2.0beta2
- Added jQuery.ez() post param string support like jQuery.post()
- ezjscnode::load added to load json data about object / node
- Update YUI to 3.1.2
- Fixed bug #017079: ezoe: IE8 Insert MEDIA/IMAGE browse: Tree Nodes not shown

# v1.2.0alpha6
- Make index_ajax.php compatible with 4.4 eZSession change

# v1.2.0alpha4
- Fixed bug #016900: [patch] eZJSCore: clearing Packer cache in DB cluster

# v1.2.0alpha3
- Implemented #16495: Improvements of ezjscPacker::optimizeCSS()
- Fixed bug #16635: ezjscore: @charset "utf-8"; is not stripped
- Fixed bug #16831: ezjscore create one js cache file for all siteaccess (patch)
- Remove ezwebin template override to simplify webin + ezjscore setup (loading order does not matter anymore)
  BC: Means ezjscore v1.2.0+ will not work on older ezwebin versions, only ezwebin 1.7.0 and up!
- Updated YUI to 3.1.1 and 2.8.1

# v1.2.0alpha2
- Fixed bug #16726: Src for original image in "Insert image" has a pipe ("|") at the end
- Fixed bug #16761: ini settings and ActiveAccessExtension
- Fixed bug #16669: wrong content-type header for packed js/css files using clustering
- ezjscAjaxContent: Make sure image attribute has content before we add it to json image array

# v1.2.0alpha1
- Fixed bug #16393: TC-36 - eZFlow + eZFind show-facets and enable-spellchecker always enabled
- Upgraded YUI 3.x from 3.0.0 to 3.1.0


# v1.1.0rc1
- Fixed bug #16456: ezjscore not cluster aware?

# v1.1.0beta1

- Fixed #016129: hasAccessToLimitation ezjscore 1.0.1 function does not properly check multiple policies
  Added: has_access_to_limitation now has a fourth parameter 'debug', that needs to be true to get debug
      on unmatched policy's
- Added a fourth parameter on ezjscore/call to be able to enable debug in response
- Make ezjscServerRouter use hasAccessToLimitation to support multiple policies
- Add support for spellchecker and facets support for ezfind
- Add support for serializeArray() format as post parameter on jQuery.ez
- Updated jQuery to 1.4.2
- Changed back to using ajax.googleapis.com for jQuery like 1.0, reported in #016229


# v1.1.0alpha1

- Fixed bug: ie6 issue with Y.io.ez
- Updated YUI 3.0.0 to GA
- Fixed bug #15606: Admin Content Tree images not found
- Fixed bug #15699: eZJSCore: possible function mixup for ezscriptfiles template operator
- BC: Removed charset attribute from all html tags but script with src attribute (html validation)
- Deprecated charset parameter on ezcss, ezcss_load and ezcss_requried template operators!
- Only use POST parameters for ezjscore/call parameters to avoid reaching url limit and 
  logging parameters in wwwserver logs
- Add missing include_once('kernel/common/i18n.php'); in index_ajax.php
- Make sure admin user has access to /call even if PolicyOmitList/AnonymousAccessList is commented
- Add support for c.arguments on Y.io.ez() like Y.io() has
- Added support for setting ContentType with get parameter on ezjscore/call for development use
- Added ezjsc::search for re use by other extensions (same parameters as the one in ezflow and ezoe)
- Fixed ezjscore/run issue with eZ Publish 4.0.0 / 4.0.1 on eZURI::instance()
- Disabled language attribute by default on ezscript() for xhtml strict / xhtml1.1 / html5 validation
- BC: Fixed setting typo LocaleScript -> LocalScript in ezjscore.ini
- Added support for more general use of has_access_to_limitation including array values for limitations
- ezjsc::search: Added support for SearchContentClassIdentifier (requires ezp 4.1 or higher)
- ezjsc::search: Return SearchString as part of returned result for js callback use
- Bump required eZ Publish version to 4.1
- Implemented #15811: ez JS Packer option to include modified time in file url
- Packer: Don't waste cycles on packing and caching if there is only one file, serve it directly
- Fixed bug #15972: ezcache.php --clear-all does not clear ezjscore cache
- Implemented enhancement #16059: DEPRECATED CSSFileList|JavaScriptList in favour of [Frontend|Backend][CSSFileList|JavaScriptList] settings
- Updated jQuery to 1.4.1
- Implemented enhancement #16068: ezjscore Packer option to specify domain for js/css url
- Add possibility to use GET method if specified (yui3io: in c parameter, jqueryio: with false post parameter)



# v1.0.0  29 Sept 2009

- Added FAQ and CHANGELOG
- Moved [eZJSCore]Packer=disabled from site.ini to ezjscore.ini to comply with eZ Network certification



# v1.0.0rc2  19 Sept 2009

- Added link to project website in ezinfo page
- Don't store $moduleResult['content_info']['persistent_variable'] unless it's already defined (to avoid confusing code that checks for presence of $moduleResult['content_info'])
- Flatten persistent_variable array to make sure array_unique can actually remove all duplicates
- Fixed bug: Access to a kernel module via index_ajax.php
- Added note in ezinfo about jQuery
- Fixed url to jQuery to use google cdn and not googlecode


# v1.0.0rc1  17 Sept 2009

- Initial version