since GL2 is (at a minimum) 6 months away, we think that PHP5 will be gathering momentum at that point and we'll start to see a large installed base.
GL2 has been discussed here on and off for over two years now with very little progress made and projected times sliding and sliding. Originally, it was going to work with PHP4 then changed to PHP5. I don't mean to sound ungrateful but I think you developers ought to seriously discuss whether to put 1.3.x in a caretaker status and put some real effort behind GL2's development or just can GL2 all together and stay with the 1.3.x architecture otherwise you'll be saying yet again in six months it's at least another six months away.
So my question back is what is the best way to secure the config files?
I suggest using a constant (eg INSIDE_GL) defined in the main config file and a check made at the top of all the other files. Example:
if (!defined('INSIDE_GL')) {
die();
}
I added something similar in all my files. Instead of immediately dying though, I have it display a custom 404 error page in order to "hide" them. I'd like to see plugins use standard error pages provided by the core so there's a feeling of consistency.
GL2 will only support HTML_Template_Flexy. Plugins will be expected to be implemented using this template system.
This is a very bad idea. IMO GL2 should be made flexible enough where other scripts (Gallery, PHPBB, or whatever) can be integrated as plugins many of which do not use this template system.
From the docs, it's not clear whether code from all the plugins are loaded at once. This is a feature I do not like on the current software. Instead of checking one time whether a plugin is activated and only loading the code needed for a page, it checks multiple times and then adds code from all the plugins even if it's not used. I hope this is not the same plan for GL2.
It appears you are making plugin writers create different SQL files to handle different databases. IMO this should be handled by a core class which takes the data provided by the plugin writer and puts it in the proper SQL format for whichever database.
Lastly, may I suggest you look at Mambo to get some ideas on how to make uploading a plugin much simpler for users rather than manually moving files around. Mambo allows a user to upload the plugin as one compressed file and the script handles the decompression.