New features
Password verification in administrator password feature
New Joomla! upgrade package and Admin Tools update package download functions
Color coding of Joomla! update status in the Control Panel page of the component
Change database collation feature
Save and Apply custom permissions
Clean temp scheduling
Link migration (auto-rewrite old domain URIs to new domain)
URL Redirection can now handle URLs with query string parameters
Web Application Firewall feature: Email me on administrator area login
Change your database prefix with two clicks
Change the default Super Administrator ID (no more 62/42)
Changes
Updated several languages
Improved file injection protection in .htaccess Maker
Bug fixes
Back-end protection was missing an [R] flag in the administrator to administrator/index.php rule
JRegistry corrupts the saved .htaccess maker data if they contain newline characters. Added base64 encoding to work around the problem.
Downloading the Joomla! update package file was impossible on hosts whose libcurl wasn't set up to follow redirections
Extracting the Joomla! update package file was impossible on hosts with open_basedir restrictions
Unable to install on Joomla! 1.6 beta 13 due to API changes
Permissions lower than 0600 would not get applied; 0755 would be applied instead
Warning thrown when nested array elements are present in the request when SQLiShield is activated. Also fixes the same issue when submitting forms created using RSForm.
Installation failed on older (4.1 or lower) MySQL servers due to the use of the SERIAL keyword in the install.sql file.
The Security Exceptions Log wouldn't log the query part of the offending requests
Filter reset wouldn't work on WebKit browsers
Misdetection of Joomla! 1.6 in various places within the code
Broken Control Panel layout due to unclosed DIVs
Fatal error could be thrown if another plugin has caused system's JResponse class to load before the "System - Admin Tools" plugin fires
Reflective XSS in some back-end pages (thank you Jeff Channell)
CSRF possibility in certain back-end pages (thank you Jeff Channell)
IP whitelist/blacklist queries in the plugin had a hardcoded jos_ prefix