Changes in 4.0.6:

* Security (public side):
    o safer use of txp_login cookie + nonce (note: users are logged out after upgrading!)
    o fixed XSS vulnerability (thanks DSecRG) and input validation in setup script.
    o fixed XSS vulnerability and parameter value overflow in comments preview (thanks DSecRG)
* Security (admin side):
    o add missing escape in SQL query (admin side)
    o fixed local file include vulnerability (publisher only) in textpattern/index.php (thanks DSecRG and Victor)
    o escape request method as shown on logs tab (thanks Victor)
* New languages: Croatian, Korean, Português (Brasil), Serbian (Latin + Cyrillic), Turkish and Vietnamese
* New tags:
    o <txp:if_search_results> </txp:if_search_results>
    o <txp:search_term />
* Changed tags:
    o <txp:thumbnail /> allows non-JS links to the full-size image
    o <txp:article_custom /> allows comma-separated lists for category, section and author attributes (thanks Manfre)
    o <txp:linklist /> allows comma-separated list for category attribute
    o <txp:file_download_list /> allows comma-separated list for category attribute
    o <txp:recent_articles /> allows comma-separated lists for category and section attribute
    o <txp:related_articles /> allows comma-separated list for section attribute
    o <txp:search_result_excerpt /> allows a custom “break” attribute defaulting to an ellipsis
* Several tags have been deprecated and will be replaced automatically during the upgrade: <txp:sitename />, <txp:request_uri />, <txp:s />, <txp:c />, <txp:q />, <txp:id />, <txp:pg /> (more info)
* Added ‘password reset’ functionality (with confirmation email) on the login screen
* Update to jQuery 1.2.2 as a default JavaScript library
* Fix textile list incompatibility with PHP 5.2.4 (and higher)
* Fix http-auth when using lighttpd or (mostly) apache+fcgi
* Fix HTTPS protocol check for ISAPI with IIS
* Fix use of article tags on a sticky article page
* Speed improvements (less SQL queries needed)
* Pages, categories and styles can no longer be accidentally deleted if they are used on other tabs.
* Corrections in the tag builder
* Refrain from showing sticky articles from non-frontpage sections in search results
* Enable separate search section for messy URL mode
* Plugin developers should note that using add_privs() for admin-side plugins is now required (used to be optional for publisher-only plugins) and the included HISTORY.txt contains other useful information.
* Many, many minor improvements, see SVN logs