Recent changes

Last updated 5 June 2026

A reverse-chronological list of notable changes to gliding.net.nz — new features, bug fixes, security improvements, and performance changes. Smaller changes (typos, minor copy edits, internal refactors) are not listed here; the source of truth for those is the GitHub commit history.

Aircraft register data now refreshes automatically every night

Aircraft details — owner, manufacturer, model, serial number and weight — now refresh automatically every night from the Civil Aviation Authority's register. Previously this only updated when someone clicked an admin button, and that button had quietly stopped working, so some details had gone stale.

Aircraft that have been removed from the CAA register are now flagged as deregistered rather than just silently going out of date. They stay in the system — flight history, tracking and fleet records are unaffected — but the site now knows they're no longer current.

The admin page also shows when the sync last succeeded and how many aircraft were created, updated or flagged, so a problem with the nightly refresh is visible straight away rather than hiding for months.

The Awards Officer can award FAI medals and diplomas

The Awards Officer can now award the official FAI medals and diplomas from the achievements editor:

  • the Lilienthal Medal
  • the Paul Tissandier Diploma
  • the Pelagia Majewska Medal
  • the Pirat Gehriger Diploma

They were missing from the badge list altogether, so there was no way to record them at all. They appear only for the Awards Officer, since only they may grant them.

Artwork for the FAI medals, diplomas and the First Competition Award

A badge's picture is looked up from its name. Four awards had no picture at all, and a fifth was borrowing another award's — all five have now had one drawn to match the rest of the set:

  • the Lilienthal Gliding Medal
  • the Pelagia Majewska Gliding Medal
  • the Paul Tissandier Diploma
  • the Pirat Gehriger Diploma
  • the First Competition Award

This matters most for the four FAI medals and diplomas, which have just become awardable from the website. They had no picture at all, so the first one granted would have appeared blank.

The fifth is the First Competition Award, which had been showing the picture belonging to "First Contest" — a separate, informal award with a similar name. It now shows its own.

Tracking traces display almost instantly again

  • Tracking traces display almost instantly again. Clicking an aircraft on the tracking map had become painfully slow over the last few weeks: on a long flight with a full day of data, the browser could sit frozen for more than 30 seconds before the trace appeared, often long enough that the browser itself offered to stop the page. The map now draws a full day's trace in under a second. The delay was in the map page itself rather than the tracking data or the server, and it got worse the longer the flight — which is why short flights still felt fine. Thanks to the member who reported it with timings; they made it much quicker to pin down.

Share an event with other clubs as you add it

Whether an event appears on the national calendar — and on every other club's events page — is controlled by Share to all other clubs. Until now that option only existed on the event edit page, so an event added from a club's own site was visible to that club alone until someone went back in and shared it. That caught people out: the event had been created correctly, it just wasn't where they expected to see it.

Add Event now offers the same option while you're creating the event, with a link to the new events guide explaining who sees what. Existing events are unchanged, and the checkbox is still on the edit page if you want to share something you added earlier.

Several bug fixes

  • Some aircraft appeared at another aircraft's position on the tracking map. Trackers that don't report a FLARM identifier were all being treated as though they shared one, so they were shown stacked on top of each other at whichever of them reported most recently — on one day in early August, eight aircraft were drawn at a ninth aircraft's position, with its altitude. Each aircraft is now placed and labelled from its own reports. This was most visible in summer, when more of these trackers are in the air.
  • Aircraft without a competition number showed a blank label on the map. The map label fell back to nothing at all instead of the aircraft's registration. It now shows the registration.
  • Direction of travel was reported wrongly. Where an aircraft's tracker doesn't send a heading, the site works one out from where the aircraft has just been — and it had the direction mirrored, showing east as west and west as east. The heading shown when you select a point on a flight is now correct.
  • Positions that identify no aircraft are no longer shown. A tracker reporting neither a registration nor a device identifier used to be drawn as a single unnamed marker, merging several unrelated aircraft into one. There is no way to tell whose position it is, so it is no longer placed on the map.
  • FLARM positions stopped arriving for a minute at a time. The service that feeds FLARM positions into the site shut down whenever a tracker sent a position with no speed, heading or altitude, and took a minute to come back — long enough to leave a hole in an aircraft's trace. When it happened at the start of a new day it could stay down much longer, until a different kind of tracker reported and set the day up for it, so an early morning's FLARM flying could be missing altogether. Once the fix is installed on the server, a report that can't be stored is skipped on its own and the feed keeps running.
  • FLARM positions were recorded east of where they were reported. An extra digit was being added to every longitude as it was saved. For most positions the error was under a metre, but for one that happened to land on a round number it reached about 800 m — and for the rare position on an exact whole degree of longitude the result wasn't a place on the map at all. Positions recorded once the fix is installed on the server are correct; it does not go back and repair traces already stored.
  • The tracking day list repeated dates and left recent days out. The list of days you can pick from on the tracking map shows the 14 most recent, but some days had been recorded more than once — so a date could appear twice or more in the list, and each repeat pushed a real flying day off the bottom. Recently three of the fourteen were duplicates. The duplicates have been cleared out, and a day can now only be recorded once.
  • An aircraft's trace could shuffle between map refreshes. When two of an aircraft's trackers reported in the same second, the order of those points wasn't settled, so parts of a trace could be drawn slightly differently each time the map updated. The order is now fixed.
  • Contest admins can now create events. Anyone with the Contest Admin role has always been able to edit every event on the site, but the Add Event button never appeared for them — so a contest admin who wasn't also a club member or a GNZ admin had no way to set one up. The button is now offered to contest admins as well.
  • Adding the same event twice could leave a copy you couldn't delete. If two attempts to create an event overlapped, both could end up with the same web address — and because only one of them can be opened at that address, the other had no page, and so no Delete Event button. Duplicate addresses can no longer be stored, and each event now gets its own.
  • Repeat events no longer get next year's date in their web address. A second event with the same name and month used to be given an address ending in the following year — a November 2026 event appearing at …-nov-2027. Repeats are now numbered (…-nov-2026-2, -3, and so on), and a third repeat works, which it previously didn't.
  • Two awards were showing the wrong badge picture. "Contest Win" was showing the Nationals Win badge, and the First Competition Award was showing the picture belonging to "First Contest" — a separate, informal award with a similar name. Both now show their own. The two awards had been sharing a name behind the scenes with the other award, which is what caused it.
  • Some tick boxes didn't look ticked. The End Date box on the Add Event form, and Search Members of All Clubs on the roster editor, were drawn as wide rounded rectangles that looked exactly the same whether or not they were ticked — so there was no way to tell what you'd selected. They now show as ordinary tick boxes.
  • Switching day on the tracking map left the previous day's aircraft on screen. If you had an aircraft selected and then picked a different day, its highlighted trace and detail panel stayed on the map showing the previous day's flight — one line drawn between the two days — and the "Loading…" spinner in the top corner could get stuck for the rest of the session. Switching day now clears the selection cleanly, and the spinner turns off as soon as the request finishes or is cancelled.
  • A handful of active members were hidden from the member-lookup API. Apps that look a pilot up by their NZGA number — the GNZ Launch app is one — got a "not found" for eight otherwise-active members whose record had never been given a membership type. Those members are now returned like any other active pilot.
  • The achievements editor no longer offers badges a pilot already holds. When adding an achievement, the badge menu listed every badge — including ones already awarded, where adding it again did nothing. It now shows only the badges the pilot doesn't yet hold.
  • Member names with macrons or other accented letters could be cut short when saved. A name like "Tāmaki" could lose everything from the accented letter onward. Names are now saved in full. If your name was shortened before this fix, please check your profile and re-enter it.

Permission checks tightened on events and FAI awards

  • Creating a new event and editing an existing one are now permission-checked on the server. Previously the site relied on hiding those controls from anyone who shouldn't use them, which meant a signed-in member who went looking could in principle have added or altered an event they had no business touching. The rules themselves are unchanged — GNZ admins and contest admins can manage any event, club members can manage their own club's — they are now enforced properly rather than just hidden.
  • Only the Awards Officer can record, change or remove an official FAI award. The check behind the achievements editor recognised only part of the FAI family, so some of them fell through to the looser rule that governs everyday achievements — the one coaches and club admins hold. Most exposed was the First Competition Award (the monetary bonus awarded alongside the Silver Distance, held by 16 pilots), which a coach or club admin could change or remove — it was recorded under a slightly different category name from the other FAI awards, and that inconsistency is what the checks missed. The category names have been tidied up so there is only one spelling to get right. The FAI medals and diplomas were affected too, but no pilot holds one yet. Adding, changing and removing now apply the same rule across every FAI award. Coaches and club admins keep full control of the everyday achievements they are meant to manage. We have no indication any record was actually altered.
  • A club admin could take another club's achievement record. When changing an existing achievement, the site checked your permission over the member you were moving it to, never the member it currently belonged to — so a record could be moved onto one of your own club's members and then deleted. Both ends are now checked.

The audit log now records member data exports

The Audit Log (under Admin) now records when someone exports the member list to a spreadsheet.

  • Every member export — whether as CSV or Excel — is logged with who exported, when, the format, how many members were included, and which filters were applied (for example a search term or a specific club).
  • Exports show up under a new Member Export category, so you can filter the log to just data exports, and the Details column summarises each one at a glance.
  • As with the rest of the audit log, you can download the entries as CSV.

This gives a clear, after-the-fact record of who has taken copies of member data.

Better member search

Searching the members list is much more forgiving:

  • Type a full name — "Jane Smith" (or "Smith Jane") now finds the right person. Previously the search only looked at one field at a time, so a first-and-last-name search often found nobody.
  • Search by email address as well as name and membership number.
  • Best matches first — an exact name match sorts above someone who merely shares part of an email address, so the person you want is usually at the top.

Fuzzy matching (finding "Shaun" when you type "Sean") is coming in a later update.

The audit log now records role changes, with filtering

The Audit Log (under Admin) now covers changes to a member's roles, not just account removals.

  • Every time a role is granted, changed, or removed, the log records who did it, to whom, and which role was involved (plus any change to that role's club or organisation scope).
  • A new Category filter lets you narrow the log to just role changes, or just account removals. Filters are additive — with nothing ticked you see everything, and ticking more options only ever shows more, so you can combine categories and actions freely.
  • A new Details column shows the specifics of each entry at a glance — the role involved for a role change, or the reason for an account removal.
  • Download as CSV now respects whatever you've filtered to, so you can export just the entries you're looking at.

User growth chart on the admin Users page

  • The admin Users page now shows a small chart of the number of users over time, right above the search box.
  • The line counts only current (non-deleted) users, so removing users is reflected in the trend.
  • Drag across the chart to zoom into a period.

Remove and restore user accounts, with an audit log

National administrators can now remove a person's login from the Users admin screen — useful when someone resigns but still has an account and roles.

  • Remove a user with a required reason. Their login and API access are switched off immediately, and they disappear from the usual listings. Their roles are kept, so the account can be restored later exactly as it was.
  • A "no active affiliation" flag highlights privileged accounts whose GNZ membership is no longer current, to support a regular review of who still has access.
  • A "Show deleted" toggle lists removed accounts with who removed them, when, and why, alongside a one-click Restore.
  • A new Audit Log screen (also under Admin) records these actions — who did what, to whom, and why — and can be downloaded as CSV.
  • Abandoned sign-ups are now tidied up automatically. Accounts that never confirmed their email address and were never linked to a Gliding New Zealand membership are removed 30 days after sign-up. Like every removal it's reversible and recorded in the audit log (shown as done by "system").
  • In the Audit Log, the Who and Subject are now links to a user details page — a read-only summary of an account (roles, membership, created date, last login, and any removal details) that works even for removed accounts, so you can trace any entry back to the person.

Admin removals are always a deliberate, reason-logged action. The only automatic removals are those abandoned, never-confirmed sign-ups — and even those are reversible and audited.

Interface toolkit brought up to date

The site's user-interface toolkit — the library that styles buttons, forms, tables and page layout — has been upgraded to its current version (Bootstrap 5). This completes the front-end modernisation flagged in the August 2025 platform upgrade, which noted the interface libraries were out of date.

Running current, supported software keeps the site secure and maintainable and clears the way for future interface improvements. The upgrade was carried out to preserve the existing look and feel, so you shouldn't notice day-to-day visual changes.

Several bug fixes

  • Two-factor login now recognises trusted devices straight away when you open the site from a link in an email, a bookmark, or a search result. Previously the "remember this device for 30 days" wasn't applied on that first visit, so you'd see an unexpected verification prompt — and clicking Send a new code would then let you straight in, which was confusing.
  • The Flying Days calendar (and the club admin's Edit Flying Days screen) could come up empty even when days were scheduled, because the data behind it failed to load. It now loads correctly.
  • The Events page's Calendar view now shows event badges on the right days again — previously events could be missing from the calendar even though they appeared in the list and summary views.
  • The Events calendar no longer scrolls sideways on phones — the month grid now fits narrow screens instead of overflowing off the edge.
  • Searching the members list no longer shows the wrong results while you type. On a slow connection the list could briefly jump to results for an earlier, half-typed search; it now always settles on what you actually typed, and searches while you type more smoothly.
  • The members export (CSV/Excel) had its last two columns swapped: the observer_number column showed the tow-pilot flag and the rating_tow_pilot column showed the observer number. Each column now holds the right data.

Faster page loads

The live tracking map and the charts are powered by two large third-party libraries. Until now every page on the site downloaded them, even pages that never show a map or a chart.

Those libraries are now loaded only on the pages that actually use them — the map on the tracking pages, the charts on the tracking and ratings-report pages. Every other page — members, events, the flying calendar, admin screens — now downloads roughly two-thirds less code up front, so they open faster, particularly on mobile and slower rural connections.

Club admins can now edit accommodation

Club admins can now edit their club's accommodation. Each room card on the Accommodation page has a new Edit link that opens a form where you can change the name, description, minimum and maximum people per booking, and member/non-member prices.

  • Previously the only way to fix a typo or update a price was to delete the room and create it again — impossible once it had bookings.
  • Room names now only need to be unique within your own club, so two clubs can both have a "Room 1".

New roles and permissions reference page

  • Added a Roles and permissions reference page that lists every role a person can hold on the site — from Club admin and Awards officer to Waypoint admin — and spells out, feature by feature, what each one lets them view, add, edit, and remove.
  • Use it when deciding which role to give someone, so you can grant just the access they need instead of making them a full administrator.

Two-factor login now required for all members

When you sign in on a new or unrecognised device, gliding.net.nz now emails you a six-digit code to enter before you're signed in. Once you've verified, that device is trusted for 30 days. This was already required for administrators; it now applies to every account.

It protects member information - which any signed-in member can view for every other member - even if an account's password is exposed in a data breach somewhere else. See the how-to guide for what to expect.

Several bug fixes

  • Fixed help-documentation images sometimes appearing wider than the screen on mobile devices. This happened when a phone's browser held onto an outdated copy of the site's styling; the site now refreshes its styling automatically whenever it changes, so updates take effect straight away.
  • Fixed a server error that could occur when the BTraced phone app sent a tracking update with an unexpected or empty message. These updates are now handled gracefully instead of failing.

Tighter access controls on member information

  • The member list and the member export (CSV/XLS/XLSX) are now restricted to verified GNZ members and club administrators. Previously any signed-in account could reach them, even one with no club role or unverified membership.

Clearer XCP qualification on the members and ratings pages

We have made the XCP (Cross Country Pilot) qualification clearer across the site, and explained how it relates to the older QGP qualification.

  • The ratings report now shows a single XCP column. Previously it had separate "QGP?" and "XCP?" columns, and the QGP column could look empty for a pilot who is fully XCP-qualified — which was misleading. QGP is no longer issued or recognised by Gliding NZ, so it no longer has its own column here.
  • On the members list, the "Cross Country Pilots" filter is now labelled XCP, and the old "QGP" filter is now QGP (historical) so it is clear that QGP is a legacy record.
  • Each of these now has an information icon linking to a new help page, QGP and XCP qualifications, which explains the difference between the two and how QGP holders moved across to the XCP.
  • The ratings report's column headings now stay visible as you scroll, so it is easier to read down a long list.

Platform upgraded to PHP 8.4 and Laravel 13

The site's server-side platform has been upgraded to PHP 8.4, Laravel 13, and Symfony 8. These are behind-the-scenes changes with no impact on any features — they keep the platform on actively maintained, security-patched releases so that fixes and improvements continue to reach the site promptly.

Two-factor login now required for all admins

Admin and club-admin accounts are now automatically required to verify a one-time code sent to their email address when signing in on a new or unrecognised device. Once verified, the device is trusted for 30 days.

This protects the member database from unauthorised access even if the password of an account that can see member details is compromised.

Club admins can change a member's primary club

If you are an admin of one or more clubs, the member edit page now lets you change a member's primary club directly. Previously this required emailing the GNZ treasurer. The dropdown shows the clubs you administer, plus the member's current primary club so it stays visible if you do not administer it.

Members without admin rights now see a short message explaining that their club's secretary or admin can make the change for them, rather than being directed to the GNZ treasurer.

Help docs added at /docs

We've added a documentation section to gliding.net.nz. It covers how to sign in and register, manage members and ratings, run events, use tracking, send bulk emails, and what to do when you see a confusing error page like Page Expired.

Most pages are placeholders today and will be filled in over time. If a topic you need isn't covered yet, please open an issue on GitHub.

This change also redesigned the changelog. Entries are now stored as individual Markdown files and rendered at /docs/changelog (the old /changelog URL redirects there). The "Recent changes" widget on the home page continues to show the three most recent entries.

NZ clubs list restored on the homepage

The list of New Zealand clubs on the gliding.net.nz homepage had silently disappeared a few weeks ago and was no longer visible to visitors. It is now restored.

New-device login emails turned off

Some members were receiving "logged in from a new device" emails on every login, even though they hadn't changed devices. This was caused by mobile networks and home internet connections handing out a different IP address each session — normal behaviour, not a real security event. These new-device emails have been turned off so they no longer arrive as false alarms. Login history continues to be recorded and is available to administrators.

Reliable delivery for membership-wide email

Sending email to the full membership list could silently deliver to only some recipients due to SMTP timeouts. Emails are now queued and sent individually to each recipient, so all members reliably receive the message.

Flashed status messages pop up automatically

Status messages flashed by the server (for example after deleting an event or updating your account) now pop up automatically. Previously they were hidden behind the bell icon until you clicked it.

Return to the events list after deleting an event

After deleting an event you are now taken back to the events list instead of being left on a page for an event that no longer exists.

Confirmation before deleting an event

Clicking Delete Event now asks for confirmation before removing the event. If you dismiss the prompt, the event is kept.

Event delete permission check restored

A permission check that prevents unauthorised users from deleting events was accidentally disabled. It has been restored — only users with edit rights on an event (its creator, club members, or contest administrators) can now delete it.

Dates of birth display in DD/MM/YYYY

Dates of birth on member profile pages were showing as a raw timestamp (e.g. 1965-02-15T00:00:00Z) instead of a readable date. They now display in the expected DD/MM/YYYY format (e.g. 15/02/1965).

Tracking pages are faster

Live tracking now reuses local terrain data during each request instead of reloading it for every aircraft point. This reduces repeated work behind the scenes and helps both the tracking map and timesheet views stay more responsive when lots of aircraft are active.

We also removed an experimental tracking query path that was slowing down some tracking requests in production, especially on busy day tables.

Tracking pages stay available during terrain data resets

A bug that could make the live tracking and timesheet pages fail while terrain height data was being reused behind the scenes has been fixed. Tracking pages should now stay available even when a local terrain data file needs to be reset.

Changelog page added

We've added this changelog so you can see what has changed on gliding.net.nz. Major features, bug fixes, security improvements, and performance changes will be documented here going forward.

Multi-Factor Authentication (MFA) introduced

gliding.net.nz now testing Multi-Factor Authentication with a small group of people before being rolled out to everyone. When enabled, after entering your email address and password, you will be sent a six digit code to your email address. You must enter this code to complete login. This only happens once, per device, every 30 days.

Why MFA? gliding.net.nz holds sensitive information including member contact details, medical currency, and ratings records. MFA protects against credential stuffing attacks using your stolen email address and password (which might already be public from a data breach).

Additionally, the office of the Privacy Commissioner has publicly stated:

"Two-factor authentication is a bare minimum we would expect for small businesses or organisations that hold or share personal information digitally. If you are a small business that has a cyber-related privacy breach and don’t have at least two factor-authentication in place expect to be found in breach of the Privacy Act."

As an additional security measure, all members are now notified when someone logs into their account from a new device.

Tracking map: unregistered trackers automatically hidden

The GNZ tracking site recently experienced an issue where a FLARM (likely running in competition mode) constantly changed its ID and appeared as hundreds of unregistered trackers (like *AB, *CD, *EF) on the map. This drowned out real aircraft and created a safety risk by obscuring real traffic.

To address this, the tracking site now automatically hides all unregistered trackers when too many of them are present. If this happens, you can unhide them by clicking the cog icon in the top left.

Stronger password requirements

We now align with NIST recommendations - requiring passwords that are at least 15 characters long, and not requiring special characters. Passwords are checked against the Have I Been Pwned database to ensure that they have not appeared in a data breach. It is your responsibility to protect everyone's data by using a unique and strong password - ideally generated by and stored in a password manager, or written down somewhere secure.

Existing passwords are not immediately affected, but you will be prompted to update your password if it doesn't meet the new requirements when you next reset it. You must change your password if it is easy to guess or has been reused elsewhere.

Ratings and medical currency report improvements

Administrators can now export a spreadsheet of BFR and medical currency records, including awarded and expiry dates. The ratings report now includes ICRs and all medical certificate types, and the export now lists members in a consistent order.

Platform upgraded to supported software versions

gliding.net.nz now runs on fully supported versions of its core platform components: PHP 8.3 and Laravel 12, on a supported Ubuntu LTS server. Running supported software means we receive ongoing security patches, reducing the risk of vulnerabilities.

The front-end UI libraries (Vue.js and Bootstrap) are currently out of date and are planned to be upgraded in a future update.