Changes in 13.0.1
-----------------
- Run updates for version 13.0 in Update.fnc.php

Changes in 13.0
---------------
- Add `&modfunc=save` to form in Courses.php, Assignments.php & MarkingPeriods.php
- Security: SQL prevent INSERT or UPDATE on any table in Courses.php
- Add "Block" mention after Period title, only for admins in Courses.php
- Add Course Period Form inputs action hook in Courses.php & Actions.php
- Remove deprecated `_updateSchedulesCPMP()` function in Courses.php
- Security fix #391 IDOR/BOLA: cross-school calendar event access via event_id in Calendar.php, thanks to @P1oNerd
- SQL performance: use explicit JOIN (4x faster) in Portal.php
- Add "Include Inactive Students" checkbox when no students were found in Search.inc.php
- Use DBInsert() & DBUpdate() functions in Assignments.php
- Security fix #393 SQL prevent INSERT or UPDATE on any table in Assignments.php, thanks to @c3mc3f
- Security fix #394 Upload directories are web-executable in assets/FileUploads/.htaccess, thanks to @c3mc3f
- Add Date (today) & Balance (Student Billing) to Substitutions in Letters.php
- Remove deprecated jqPlotChart() function in Charts.fnc.php
- Deprecate Dashboard(), DashboardOutput() & DashboardAdd() functions in Dashboard.fnc.php
- Deprecate DashboardModule(), DashboardModuleTitle() & DashboardModuleData() functions in DashboardModule.fnc.php
- Add RosarioSIS\Functions\Dashboard & RosarioSIS\Functions\DashboardModule objects in Dashboard.php & DashboardModule.php
- Use RosarioSIS\Functions\Dashboard & RosarioSIS\Functions\DashboardModule objects in Portal.php & Dashboard.inc.php
- Deprecate HackingLog() function in HackingLog.fnc.php
- Add RosarioSIS\Functions\Hacking class in Hacking.php
- Use RosarioSIS\Functions\Hacking class, program wide
- Remove deprecated `_printPageHead()` function in PasswordReset.php
- Deprecate Linkify() function in Linkify.fnc.php
- Add PortalPollsMakeOptions() function to replace Linkify() in PortalPollNotes.fnc.php
- Deprecate SendEmail() function in SendEmail.fnc.php
- Add RosarioSIS\Functions\Email class in Email.php
- Deprecate 'ProgramFunctions/SendEmail.fnc.php|before_send' & 'ProgramFunctions/SendEmail.fnc.php|send_error' action hooks in Email.php & Actions.php
- Fix PHP 5.6 syntax error unexpected 'do' (T_DO) in DashboardModule.php
- Add README.md files in classes/
- Use RosarioSIS\Functions\Email class, program wide
- Remove deprecated `_rosarioLoginURL()` function in SendNotification.fnc.php
- Add `&modfunc=save` to Fields form in Fields.fnc.php, SchoolFields.php, AddressFields.php, PeopleFields.php, StudentFields.php & UserFields.php
- Remove Debug.fnc.php file include: Kint() & d() functions in Warehouse.php
- Temp dir is now dynamic (was hardcoded to /tmp/) + fix error ttl property not declared in curl.php
- Fix SQL roll "Block" Periods correctly in Rollover.php
- Add Before delete Course Period hook in Courses.php & Actions.php
- Remove deprecated `_myURLEncode()` function in PreparePHP_SELF.fnc.php
- SQL use CONCAT() so string is escaped if needed in GetStuList.fnc.php, Search.fnc.php & Requests.php
- Remove deprecated ColorInputMiniColors() function and related JS in Inputs.php & assets/js/jquery-minicolors/
- Add Staff Payroll Balance widget in StaffBalances.php
- Remove deprecated `$_ROSARIO['ReferralInput']` global var in Referral.fnc.php
- Use DBInsert() function in Student.php
- Add `_creditPaymentsFoodServiceAccount()` function in Student_Billing/functions.inc.php
- Add "Credit Food Service Account on Lunch Payment" config option in Configuration.js, Configuration.php, MassAssignPayments.php & StudentPayments.php
- Add "Lunch Payment" checkbox in MassAssignPayments.php
- Add and translate help for "Credit Food Service Account on Lunch Payment" config option in Help_en.php & help.po
- Update French & Spanish translations in rosariosis.po & rosariosis.pot
- Change error message from "No students were found." to "No courses found" in PrintSchedules.php
- Can use modname: false, do not send "HACKING ATTEMPT" email in Modules.php
- Return 403 Forbidden only if not logged in in Hacking.php
- Fix PHP typeError: array_key_exists() argument #2 must be of type array, null given in ListOutput.fnc.php
- POST max size limit reached: send email, do not redirect, display error in Warehouse.php
- Only add "You're not allowed to use this program!" error if $error is empty in Hacking.php
- Remove local `_reloadMenu()` function in Modules.inc.php
- Add RosarioSIS\Functions\AddonInfo class in AddonInfo.php
- Check add-on requirements in Modules.inc.php & Plugins.inc.php
- Add AddonMakeUpdateAvailable() function in Addon.fnc.php
- Check for add-on updates in Modules.inc.php & Plugins.inc.php
- Add link to rosariosis.org/modules & rosariosis.org/plugins in Modules.inc.php & Plugins.inc.php
- Security fix check sibling belongs to the authenticated parent in Registration.php & Registration.fnc.php, thanks to Kai Aizen
- Do not save violations triggered by "Check your Network" AJAX error in SaveReport.php
- HTML add "Calendars" fieldset in Configuration.php
- Fix GitHub issue 305 alignment when a course has only a letter grade OR only a percent grade in Transcripts.fnc.php, thanks to @threehappypenguins
- JS update Chart.js to version 4.5.1 in assets/js/Chart.js/
- JS add Previous Next Student plugin to core in assets/js/jquery-previous-next-student/, warehouse.js & Gruntfile.js
- Remove List of words ignored during search operations in ListOutput.fnc.php
- JS deprecate LO_search() function in warehouse.js, csp/functions.js & ListOutput.fnc.php
- JS add Instant List Search Sorting plugin to core in assets/js/jquery-instant-list-search-sorting/, warehouse.js & Gruntfile.js
- Security fix #399 Second-Order SQL Injection in Gradebook Assignment Sorting (Stored) in Assignments-new.php, thanks to @360alphalab
- Use DBInsert() function in MassCreateAssignments.php
- HTML number input type for RosarioSIS ID field in General_Info.inc.php & stylesheet.css
- Security fix #396 add $RosarioURL config variable in FirstLogin.fnc.php, diagnostic.php, PreparePHP_SELF.fnc.php & INSTALL.md
- SQL Change short_name column type to varchar(4). Now allows College grade levels in GradeLevels.php, rosariosis.sql & rosariosis_mysql.sql
- SQL Change short_name & block columns type to varchar(11) (was varchar(10)). Now allows "14:30-16:30" periods in Periods.php, rosariosis.sql & rosariosis_mysql.sql
- Update to version 13.0 in Update.fnc.php
- Enforce CSP (Content Security Policy) in Warehouse.php & plugins/Content_Security_Policy/
- Security fix #398 Cross-School Tenant Isolation Bypass in Side.php, thanks to @rizviirfan7
- Fix cumulative GPA calculation: N/A grade (empty GPA value) does not affect GPA in Transcripts.fnc.php
- Remove XML-RPC support. Use the REST API instead in plugins/Moodle/
- SQL fix Calendar ORDER BY in ImportUsers.fnc.php
- Use DBInsert() & DBUpdate() functions (Moodle plugin) in ImportUsers.fnc.php, Student.php, User.php, CreateParents.php, Calendar.php, Courses.php, Assignments.php, Rollover.php & functions.php
- Update Russian and Ukrainian translations in rosariosis.po & help.po, thanks to Aleksey
- Remove Portal Notes integration code (Moodle plugin) in PortalNotes.php & functions.php
- Fix Secondary Teacher dropdown options when Moodle course in Courses.php
- Use RewriteRule instead of FilesMatch to avoid AllowOverride AuthConfig in assets/FileUploads/.htaccess
- Fix swap "Fee" and "Student Payment" column labels in DailyTransactions.php
- Update Portuguese (Brazil) translation in rosariosis.po & help.po
- Skip CSP violation triggered by script sample: "(function () {", column 709 in SaveReport.php
- Fix regression since 2.8 set current MarkingPeriod (Quarter) for parents in Side.php & GetMP.php

Changes in 12.9.4
-----------------
- Fix regression since 12.9 remove CSRF token from files containing &modfunc= in Exceptions.php & Profiles.php

Changes in 12.9.3
-----------------
- Security fix #397 Unauthenticated stored XSS: remove HTML tags in SaveReport.php, thanks to @Bradsen
- Only return 403 Forbidden code if not AJAX request in Warehouse.php
- Logout if no Staff or Student session ID when modfunc=first-login in Warehouse.php

Changes in 12.9.2
-----------------
- Fix SQL syntax error "AND STUDENT_ID IN()" when nothing to save in InputFinalGrades.php & EnterEligibility.php
- SQL fix "Enroll student for next school year" when student is inactive in Enrollment.fnc.php
- Fix saving new user when current Staff ID set (in other browser tab) & user has no permission to edit User Profile in User.php
- CSP Do not save violations triggered by VisualSPHost in SaveReport.php
- No user in session yet, send 403 Forbidden (99% chances its a bot) in Warehouse.php
- Fix SQL error retro-compatibility with old Grade Level inputs in GetStuList.fnc.php
- Corrections to the Spanish help texts translation in help.mo
- Security fix #390 Reflected XSS - unescaped reflection into `<form action>` in MenuReports.php, thanks to @MDnyn

Changes in 12.9.1
-----------------
- Fix double escaping Course Period Short Name in Courses.php & Courses.fnc.php
- Fix SQL error unknown column 'ssm.STUDENT_ID' in 'on clause', use explicit JOIN in Export.php
- Security fix #377 IDOR: Unauthorized Cross-Roster Data Assignment in TakeAttendance.php, MakeReferral.php, EnterEligibility.php & InputFinalGrades.php
- Security fix #378 BOLA: Students and parents can read other students' transcripts and schedules via `st_arr[]` bypass in Transcripts.fnc.php & PrintSchedules.php, thanks to @weilai-8
- Security fix #379 BOLA: Any authenticated user can read assignment details outside their enrolled courses via `assignment_id` parameter in Calendar.php, thanks to @weilai-8
- SQL use actual null value in DBUpdate() $columns param in AttendanceCodes.php, Menus.php, Accounts.php, ReportCardCommentCodes.php & Address.inc.php
- CSP Do not save violations triggered by AdBlock360 in SaveReport.php
- Add Italian help translation in locale/it_IT.utf8/, thanks to Stefania Binda