New features

• Password verification in administrator password feature

• New Joomla! upgrade package and Admin Tools update package download functions

• Color coding of Joomla! update status in the Control Panel page of the component

• Change database collation feature

• Save and Apply custom permissions

• Clean temp scheduling

• Link migration (auto-rewrite old domain URIs to new domain)

• URL Redirection can now handle URLs with query string parameters

• Web Application Firewall feature: Email me on administrator area login

• Change your database prefix with two clicks

• Change the default Super Administrator ID (no more 62/42)

Changes

• Updated several languages

• Improved file injection protection in .htaccess Maker

Bug fixes

• Back-end protection was missing an [R] flag in the administrator to administrator/index.php rule

• JRegistry corrupts the saved .htaccess maker data if they contain newline characters. Added base64 encoding to work around the problem.

• Downloading the Joomla! update package file was impossible on hosts whose libcurl wasn't set up to follow redirections

• Extracting the Joomla! update package file was impossible on hosts with open_basedir restrictions

• Unable to install on Joomla! 1.6 beta 13 due to API changes

• Permissions lower than 0600 would not get applied; 0755 would be applied instead

• Warning thrown when nested array elements are present in the request when SQLiShield is activated. Also fixes the same issue when submitting forms created using RSForm.

• Installation failed on older (4.1 or lower) MySQL servers due to the use of the SERIAL keyword in the install.sql file.

• The Security Exceptions Log wouldn't log the query part of the offending requests

• Filter reset wouldn't work on WebKit browsers

• Misdetection of Joomla! 1.6 in various places within the code

• Broken Control Panel layout due to unclosed DIVs

• Fatal error could be thrown if another plugin has caused system's JResponse class to load before the "System - Admin Tools" plugin fires

• Reflective XSS in some back-end pages (thank you Jeff Channell)

• CSRF possibility in certain back-end pages (thank you Jeff Channell)

• IP whitelist/blacklist queries in the plugin had a hardcoded jos_ prefix