CHANGELOG.md

   1 # Change Log
   2 All notable changes to this project will be documented in this file.
   3
   4 The format is based on [Keep a Changelog](http://keepachangelog.com/)
   5 and this project adheres to [Semantic Versioning](http://semver.org/).
   6
   7 ## [v0.9.3](https://github.com/shaarli/Shaarli/releases/tag/v0.9.3) - 2018-01-04
   8
   9 **XSS vulnerability fixed. Please update.**
  10
  11 ### Security
  12 - Fix an XSS (cross-site-scripting) vulnerability in `index.php`
  13
  14
  15 ## [v0.9.2](https://github.com/shaarli/Shaarli/releases/tag/v0.9.2) - 2017-10-07
  16
  17 **Major security issue fixed. Please update.**
  18
  19 ### Added
  20 - Tag search now supports wildcards `*`
  21 - New setting `privacy.force_login` which can be used with `privacy.hide_public_links` to redirect anonymous users to the login page.
  22 - New setting `general.default_note_title` used to override default `Note:` title prefix for notes.
  23 - Add a version hash for asset loading to prevent browser's cache issue
  24
  25 ### Changed
  26 - The "Remember me" checkbox is unchecked by default
  27 - The default value of the "Remember me" checkbox can be configured under `data/config.json.php`
  28
  29 ### Removed
  30 - Remove obsolete PHP magic quote support
  31
  32 ### Fixed
  33 - Generates a permalink URL if the URL is set to blank
  34 - Replace links to the old GitHub wiki with ReadTheDocs URIs
  35 - Use single quotes in the note bookmarklet
  36 - Daily page if there is no link
  37 - Bulk link deletion with a single link
  38 - HTTPS detection behind a reverse proxy
  39 - Travis tests environment and localization
  40 - Improve template paths robustness (trailing slash)
  41 - Robustness: safer gzinflate/zlib usage
  42 - Description links parsing with parenthesis (without Markdown)
  43 - Templates:
  44     - Sort the tag cloud alphabetically
  45     - Firefox social title
  46     - Improved visited link color
  47     - Fix jumpy textarea with long content in post edit
  48
  49 ### Security
  50
  51 - Vulnerability introduced in v0.9.1 fixed.
  52
  53 ## [v0.9.1](https://github.com/shaarli/Shaarli/releases/tag/v0.9.1) - 2017-08-23
  54
  55 The documentation has been migrated to ReadTheDocs:
  56 - https://shaarli.readthedocs.io/
  57 - edits are submitted as pull requests
  58
  59 ### Added
  60 - Allow bulk link deletion
  61 - Display subtags in the tag cloud
  62 - Add an endpoint to refresh the token
  63 - Add a token on every page
  64 - Add a tag list view for management
  65 - Add Note bookmarklet
  66 - Add creation date when editing a link
  67
  68 ### Changed
  69 - Documentation:
  70     - Generate static HTML documentation with [mkdocs](http://www.mkdocs.org/)
  71     - Host documentation on [ReadTheDocs](http://www.mkdocs.org/)
  72     - Update documentation structure
  73     - Update Makefile targets to:
  74         - Build the docs locally
  75         - Include the generated docs in the release archives
  76 - Theme:
  77     - Use the new theme as the default
  78     - Rename the tag cloud template to `tag.cloud.html`
  79     - Display visited links in grey
  80     - Use only one search form in `linklist.html`
  81     - Hide the "search links with these tags" option when an empty `searchtags` is passed to `tag.list.html`
  82 - Improve HTTP header handling when hosting Shaarli with Docker behind a reverse proxy
  83 - Searching for tags with an empty value returns untagged links only
  84 - Set Travis environment to `precise` until the new `trusty` environment is ready
  85
  86 ### Removed
  87 - Remove dead Pubsubhubbub code
  88 - Disable the GitHub wiki (see changed/documentation)
  89 - Remove Docker `dev` image and resources
  90 - Theme:
  91     - Remove the bottom "Sort by" menu in `tag.list.html`
  92
  93 ### Fixed
  94 - Fix file existence check for `user.css`
  95 - Limit selection to 2k characters when using the bookmarklet
  96 - Fix JS error `uncaught type error`
  97 - Fix Firefox Social button
  98 - Use pinned PHP dependencies when generating release archives
  99 - Make sure that the tag exists before altering/removing it
 100
 101 ### Security
 102 - Add a whitelist for protocols for URLs
 103
 104
 105 ## [v0.9.0](https://github.com/shaarli/Shaarli/releases/tag/v0.9.0) - 2017-05-07
 106
 107 This release introduces the REST API, and requires updating HTTP server
 108 configuration to enable URL rewriting, see:
 109 - https://shaarli.github.io/api-documentation/
 110 - https://shaarli.readthedocs.io/en/master/Server-configuration/
 111
 112 **WARNING**: Shaarli now requires PHP 5.5+.
 113
 114 ### Added
 115 - REST API v1
 116     - [Slim](https://www.slimframework.com/) framework
 117     - [JSON Web Token](https://jwt.io/introduction/) (JWT) authentication
 118     - versioned API endpoints:
 119         - `/api/v1/info`: get general information on the Shaarli instance
 120         - `/api/v1/links`: get a list of shaared links
 121         - `/api/v1/history`: get a list of latest actions
 122 Theming:
 123     - Introduce a new theme
 124     - Allow selecting themes/templates from the configuration page
 125     - New/Edit link form can be submitted using CTRL+Enter in the textarea
 126     - Shaarli version is displayed in the footer when logged in
 127 - Add plugin placeholders to Atom/RSS feed templates
 128 - Add OpenSearch to feed templates
 129 - Add `campaign_` to the URL cleanup pattern list
 130 - Add an AUTHORS file and Makefile target to list authors from Git commit data
 131 - Link imports are now logged in `data/` folder, and can be debug using `dev.debug=true` setting.
 132 - `composer.lock` is now included in git file to allow proper `composer install`
 133 - History mechanism which logs link addition/modification/deletion
 134
 135 ### Changed
 136 - Docker: enable nginx URL rewriting for the REST API
 137 - Theming:
 138     - Move `user.css` to the `data` folder
 139     - Move default template files to a subfolder (`default`)
 140     - Rename the legacy theme to `vintage`
 141     - Private only filter is now displayed as a search parameter
 142     - Autocomplete: pre-select the first element
 143     - Display daily date in the page title (browser title)
 144     - Timezone lists are now passed as an array instead of raw HTML
 145 - Move PubSubHub to a dedicated plugin
 146 - Coding style:
 147     - explicit method visibility
 148     - safe boolean comparisons
 149     - remove unused variables
 150 - The updater now keeps custom theme preferences
 151 - Simplify the COPYING information
 152 - Improved client locale detection
 153 - Improved date time display depending on the locale
 154 - Partial namespace support for Shaarli classes
 155 - Shaarli version is now only present in `shaarli_version.php`
 156 - Human readable maximum file size upload
 157
 158
 159 ### Removed
 160 - PHP < 5.5 compatibility
 161 - ReadItYourself plugin
 162
 163 ### Fixed
 164 - Ignore generated release tarballs
 165 - Hide default port when behind a reverse proxy
 166 - Fix a typo in the Markdown plugin description
 167 - Fix the presence of empty tags for private tags and in search results
 168 - Fix a fatal error during the install
 169 - Fix permalink image alignment in daily page
 170 - Fix the delete button in `editlink`
 171 - Fix redirection after link deletion
 172 - Do not access LinkDB links by ID before the Updater applies migrations
 173 - Remove extra spaces in the bookmarklet's name
 174 - Piwik plugin: Piwik URL protocol can now be set (http or https)
 175 - All inline JS has been moved to dedicated JS files
 176 - Keep tags after login redirection
 177
 178 ### Security
 179 - Markdown plugin: escape HTML entities by default
 180
 181 ## [v0.8.4](https://github.com/shaarli/Shaarli/releases/tag/v0.8.4) - 2017-03-04
 182 ### Security
 183 - Markdown plugin: escape HTML entities by default
 184
 185
 186 ## [v0.8.3](https://github.com/shaarli/Shaarli/releases/tag/v0.8.3) - 2017-01-20
 187
 188 ### Fixed
 189
 190 - PHP 7.1 compatibility: add ConfigManager parameter to anti-bruteforce function call in login template.
 191
 192 ## [v0.8.2](https://github.com/shaarli/Shaarli/releases/tag/v0.8.2) - 2016-12-15
 193
 194 ### Fixed
 195
 196 - Editing a link created before the new ID system would change its permalink.
 197
 198 ## [v0.8.4](https://github.com/shaarli/Shaarli/releases/tag/v0.8.4) - 2017-03-04
 199 ### Security
 200 - Markdown plugin: escape HTML entities by default
 201
 202 ## [v0.8.3](https://github.com/shaarli/Shaarli/releases/tag/v0.8.3) - 2017-01-20
 203 ### Fixed
 204 - PHP 7.1 compatibility: add ConfigManager parameter to anti-bruteforce function call in login template.
 205
 206 ## [v0.8.2](https://github.com/shaarli/Shaarli/releases/tag/v0.8.2) - 2016-12-15
 207 ### Fixed
 208
 209 - Editing a link created before the new ID system would change its permalink.
 210
 211 ## [v0.8.1](https://github.com/shaarli/Shaarli/releases/tag/v0.8.1) - 2016-12-12
 212
 213 > Note: this version will create an automatic backup of your database if anything goes wrong.
 214
 215 ### Added
 216 - Add CHANGELOG.md to track the whole project's history
 217 - Enable Composer cache for Travis builds
 218 - Save the last edition date for shaares and use it in Atom/RSS feeds
 219 - Plugins:
 220     - Add an [Isso](https://posativ.org/isso/) plugin to enable user comments on permalinks
 221     - Allow defining init functions, e.g. for performing checks and error processing
 222     - Add a Piwik plugin for analytics.
 223     - Markdown: add warning notice regarding HTML rendering
 224 - Meta tag to *not* send the referrer to external resources.
 225
 226 ### Changed
 227 - Link ID complete refactoring:
 228     - Links now have a numeric ID instead of dates
 229     - Short URLs are now created once and can't change over time (previous URL are kept)
 230 - Templates:
 231     - Changed placeholder behaviour for: `buttons_toolbar`, `fields_toolbar` and `action_plugin`
 232     - Cleanup `{loop}` declarations in templates
 233     - Tools: hide Firefox Social button when not in HTTPS
 234     - Firefox Social: show Shaarli's title when shaaring using Firefox Social
 235 - Release archives now have the same structure as GitHub-generated archives:
 236     - archives contain a `Shaarli` directory, itself containing sources + dependencies
 237     - the tarball is now gzipped
 238 - Plugins:
 239     - Markdown: Parsedown library is now imported through Composer
 240 - Minor code cleanup: PHPDoc, spelling, unused variables, etc.
 241 - Docker: explicitly set the maximum file upload size to 10 MiB
 242
 243 ### Fixed
 244 - Fix the server `<self>` value in Atom/RSS feeds
 245 - Plugins:
 246     - Tools: only display parameter description when it exists
 247     - archive.org: do not propose archival of private notes
 248     - Markdown:
 249         - render links properly in code blocks
 250         - bug regarding the `nomarkdown` tag
 251     - W3C compliance
 252 - Use absolute URL for hashtags in RSS and ATOM feeds
 253 - Docker: specify the location of the favicon
 254 - ATOM feed: remove new line between content tag and data
 255
 256 ### Security
 257 - Allow whitelisting trusted IPs, else continue banning clients upon login failure
 258
 259
 260 ## [v0.8.0](https://github.com/shaarli/Shaarli/releases/tag/v0.8.0) - 2016-10-12
 261 Shaarli now uses [Composer](https://getcomposer.org/) to handle its dependencies.
 262 Please use our release archives, or follow the
 263 [installation documentation](https://github.com/shaarli/Shaarli/wiki/Download-and-Installation).
 264
 265 ### Added
 266 - Composer is required to resolve Shaarli's PHP dependencies
 267 - Shaarli now supports `#hashtags`
 268 - Firefox social share now uses selected text as a description
 269 - Plugin parameters can have a description in each plugin's `.meta` file
 270
 271 ### Changed
 272 - Configuration is now stored as a JSON file
 273 - Previous configuration format will be automatically updated (PHP -> JSON)
 274 - Shaarli now defaults to cURL to fetch shaare titles
 275 - URL cleanup: remove `PHPSESSID` parameter
 276 -  `nomarkdown` tag is no longer private, and now affects visitors
 277 - Cleanup template indentation
 278 - Rewrite bookmark import using a generic Netscape parser
 279
 280 ### Removed
 281 - Shaarli no longer references Delicious in its description
 282
 283 ### Deprecated
 284 - Shaarli configuration is not held as PHP globals anymore
 285
 286 ### Fixed
 287 - Ignore case for tags in autocompletion and cloud tag
 288 - Avoid generating empty tags
 289 - Fix a Dockerfile syntax error
 290
 291 ### Security
 292 - Fixed a bug preventing to change password
 293 - XSRF token now generated each time a page is rendered
 294
 295
 296 ## [v0.7.1](https://github.com/shaarli/Shaarli/releases/tag/v0.7.1) - 2017-03-08
 297 ### Security
 298 - Markdown plugin: escape HTML entities by default
 299
 300 ## [v0.7.0](https://github.com/shaarli/Shaarli/releases/tag/v0.7.0) - 2016-05-14
 301 ### Added
 302 - Adds an option to encode redirector URL parameter
 303 - Atom/RSS feeds now support Markdown formatting, and plugins in general
 304 - Markdown: use the tag `.nomarkdown` to avoid markdown processing
 305 - Prefill the login field when the authentication has failed
 306 - Show a private links counter
 307
 308 ### Changed
 309 - Allow to use the bookmarklet in Firefox reader view (URL clean up)
 310 - Improve tagcloud font size
 311 - Improve title retrieving
 312 - Markdown: inline code background color
 313 - Refactor Netscape bookmark export
 314 - Refactor Atom/RSS feed generation
 315
 316 ### Removed
 317 - Remove delicious from Shaarli description
 318
 319 ### Fixed
 320 - Fix bad login redirections causing a 404 in a few cases
 321 - Fix tagcloud font-size with French locale
 322 - Don't display empty tags in tag search
 323 - Fix Awesomeplete conflicts with jQuery
 324 - Fix UTC timezone selection
 325 - Fix a bug preventing to import notes in browsers from bookmarks export
 326 - Don't redirect to ?post if ?addlink is reached while logged out
 327
 328
 329 ## [v0.6.5](https://github.com/shaarli/Shaarli/releases/tag/v0.6.5) - 2016-03-02
 330 ### Fixed
 331 - Fixes a regression generating an unnecessary warning (language in HTTP request)
 332 - Fixes a bug where going through multiple reverse proxy could generate malformed URL
 333 - Markdown: Fixes a bug where empty description blocks were displayed
 334
 335
 336 ## [v0.6.4](https://github.com/shaarli/Shaarli/releases/tag/v0.6.4) - 2016-02-28
 337 ### Added
 338 - Add an updater class to automate user data upgrades
 339 - Plugin admin page: adds a label for checkboxes and improve name display
 340 - Plugin Wallabag: API version can be specified in plugin admin page
 341
 342 ### Changed
 343 - Better tag cloud sorting, including special chars (`a > E > é > z`)
 344 - Autolocale now sets all locale categories, not just time
 345 - Use PHP's DateTime object instead of custom functions
 346 - Plugin hooks: process includes before header/footer
 347 - Markdown plugin: better styles for `<code>` and `<pre>` tags
 348 - Improve searching:
 349     - search terms are now considered separated and won't only return exact results anymore
 350     - exact search can be done with quotes `"this exact sentence"`
 351     - search supports excluded terms starting a dash `-exclude`
 352     - implement crossed search: terms + tags
 353     - all of them combined across all shaare fields
 354 - New tag behaviour:
 355     - tags starting with a dash will be renamed without it
 356     - tags starting with a dot `.` will be hidden unless the user is logged in
 357
 358 ### Fixed
 359 - Fix Markdown plugin escape issues (code/quote blocks, etc.)
 360 - Link description aren't trimmed anymore to allow markdown format at the beginning of a shaare
 361 - Fixes plugin admin redirection page on error
 362
 363 ### Security
 364 - Fix a bug where non initialized variables were causing a warning
 365 - Fix a bug where saving a link after edit could cause a 404 error
 366
 367
 368 ## [v0.6.3](https://github.com/shaarli/Shaarli/releases/tag/v0.6.3) - 2016-01-31
 369 ### Added
 370 - Plugins administration page
 371 - Markdown plugin added for shaares description
 372 - Docker: Dockerfile is now in the main git repository and improved
 373 - Add a `.gitattributes` to ease repository management
 374 - Travis: include file permission checks
 375
 376 ### Changed
 377 - Auto retrieve of title know works with websites (HTTPS, follow redirections, etc.)
 378 - 404 page is now handled in a template
 379 - Date in log files updated to work with fail2ban
 380 - Wallabag: support of Wallabag v2 and minor fixes
 381 - Link search refactoring
 382 - Logging function refactoring
 383
 384 ### Fixed
 385 - Fix a bug where renaming a tag was causing a 404
 386 - Fix a bug allowing to search blank terms
 387 - Fix a bug preventing to remove a tag with special chars when searching
 388
 389
 390 ## [v0.6.2](https://github.com/shaarli/Shaarli/releases/tag/v0.6.2) - 2015-12-23
 391 ### Changed
 392 - Plugins: new footer hook
 393 - Plugins: improve QR code
 394 - Cleanup templates
 395
 396 ### Fixed
 397 - Plugins: use the actual link URL to generate QR codes
 398 - Templates: missing/erroneous page titles
 399 - Templates: missing variables resulting in PHP errors
 400
 401 ### Security
 402 - Fix invalid file permissions (remove executable bit)
 403
 404
 405 ## [v0.6.1](https://github.com/shaarli/Shaarli/releases/tag/v0.6.1) - 2015-12-01
 406 ### Added
 407 - Add OpenSearch support
 408 - Add a Doxygen makefile target
 409 - Tools: add fine-grained file/directory permission checks (installation)
 410
 411 ### Changed
 412 - Tools: check the 'stable' branch for new versions (updates)
 413 - Cleanup: introduce an `ApplicationUtils` class
 414
 415 ### Removed
 416  - Cleanup: remove `json_encode()` function (built-in since PHP 5.2)
 417
 418 ### Fixed
 419  - Auto-complete more than one tag
 420  - Bookmarklet: support titles containing quotes
 421  - URL encode links when setting a redirector
 422
 423
 424 ## [v0.6.0](https://github.com/shaarli/Shaarli/releases/tag/v0.6.0) - 2015-11-18
 425 ### Added
 426 - Introduce a plugin system
 427 - Add a demo_plugin
 428 - Add plugins:
 429     - addlink_toolbar
 430     - archiveorg
 431     - playvideos
 432     - qrcode
 433     - readityourself
 434     - wallabag
 435
 436 ### Changed
 437 - Coding style
 438
 439 ### Fixed
 440 - Adding a new link now returns the correct anchor in the URL
 441 - Set default file permissions
 442
 443
 444 ## [v0.5.4](https://github.com/shaarli/Shaarli/releases/tag/v0.5.4) - 2015-09-15
 445 ### Added
 446 - HTTPS: support being served behing an SSL-enabled proxy
 447
 448 ### Changed
 449 - HTTP/Server utilities: refactor & add test coverage
 450 - Project & documentation:
 451     - improve/rewrite `README.md`
 452     - update contributor list
 453     - update `index.php` header
 454
 455 ### Fixed
 456 - PHP session IDs: handle hash algorithms and bits per char representations
 457
 458
 459 ## [v0.5.3](https://github.com/shaarli/Shaarli/releases/tag/v0.5.3) - 2015-09-02
 460 ### Fixed
 461 - Fix a bug that could prevent user to login
 462
 463
 464 ## [0.5.3](https://github.com/shaarli/Shaarli/releases/tag/0.5.3) - 2015-09-02
 465 This release has been YANKED as it points to a tag that does not follow our naming convention. Please use `v0.5.3` instead
 466
 467 ### Fixed
 468 - Allow uppercase letters in PHP sessionid format
 469
 470
 471 ## [v0.5.2](https://github.com/shaarli/Shaarli/releases/tag/v0.5.2) - 2015-08-31
 472 ### Added
 473 - Add PHP 7 to Travis platforms
 474
 475 ### Changed
 476 - Also extract HTTPS page metadata (title)
 477
 478 ### Fixed
 479 - Fix regression preventing to load LinkDB info when adding an existing link
 480
 481 ### Security
 482 - Fix Full Path Disclosure upon cookie forgery
 483
 484
 485 ## [v0.5.1](https://github.com/shaarli/Shaarli/releases/tag/v0.5.1) - 2015-08-17
 486 ### Added
 487 - Add a link to the shaarli/shaarli DockerHub repository
 488
 489 ### Changed
 490 - Update local documentation
 491 - Improve timezone detection at installation
 492 - Improve feed cache handling
 493 - Improve URL cleanup for new links
 494
 495 ### Fixed
 496 - Fix 404 after editing a link while being logged out
 497
 498
 499 ## [v0.5.0](https://github.com/shaarli/Shaarli/releases/tag/v0.5.0) - 2015-07-31
 500 ### Added
 501 - Add Firefox Social API
 502 - Start code refactoring:
 503     - add unit test coverage
 504     - add Travis integration
 505
 506 ### Changed
 507 - Search/Filter by tag fieds can now be accessed quickly with the `Tab` key
 508 - Update documentation
 509 - Remove duplicate tags in links
 510 - Remove annoying URL patterns
 511 - Start code refactoring:
 512     - move all settings to `data/config.php`
 513     - refactor Config, LinkDB, TimeZone, Utils
 514
 515 ### Fixed
 516 - Fix locale handling
 517 - Fix note URLs
 518 - Fix page redirections
 519 - Fix daily RSS browsing
 520 - Fix title display
 521 - Restore compatibility with PHP 5.3
 522
 523 ### Security
 524 - Fix links not being hidden when `HIDE_PUBLIC_LINKS` is set
 525
 526
 527 ## [v0.0.45beta](https://github.com/shaarli/Shaarli/releases/tag/v0.0.45beta) - 2015-03-16
 528 ### Fixed
 529 - Fix improperly displayed Unicode character
 530 - Fix incorrect font size for "Add link" input field
 531
 532
 533 ## [v0.0.44beta](https://github.com/shaarli/Shaarli/releases/tag/v0.0.44beta) - 2015-03-15
 534 ### Added
 535 - Add a Makefile to run static code checkers
 536 - Add local documentation (help link in page footer)
 537 - Use awesomplete library for autocompletion
 538 - Use bLazy.js library for images lazy loading
 539 - New 'Add Note' bookmarklet to immediatly open a note (text post) compose window
 540
 541 ### Changed
 542 - Theme improvements and cleanup (menu, search fields, icons, linklist...)
 543 - Allow 'javascript:' links sharing (bookmarklets)
 544 - Make update check optional
 545 - Redirect to homepage after adding a link via "Add Link" dialog
 546 - Remove more annoying URL parameters for shared links
 547 - Code cleanup
 548
 549 ### Removed
 550 - Remove jQuery
 551
 552 ### Security
 553 - Don't disclose version to visitors (shaarli-version.txt)
 554
 555
 556 ## [v0.0.43beta](https://github.com/shaarli/Shaarli/releases/tag/v0.0.43beta) - 2015-02-20
 557 ### Added
 558 - Title button link URL is now configurable
 559 - RainTPL's TMP and TPL directories path are now configurable
 560 - Displayed URLs for each link are now clickable links
 561 - Show links timestamps in Daily view
 562
 563 ### Changed
 564 - Automatically prepend "Note:" to title of self-posts (posts not pointing to an URL)
 565 - Make ATOM toolbar button optional (`SHOW_ATOM` configuration variable)
 566 - Optional archive.org links for each Shaarli link (`ARCHIVE_ORG` option)
 567 - Thumbnails: force HTTPS when possible
 568 - Improve tag cloud font scaling
 569 - Allow pointing RSS items to the permalink instead of the direct URL (`ENABLE_RSS_PERMALINKS` option)
 570 - Update JS libraries and add version numbers in filenames
 571 - Updates to README and footer
 572
 573 ### Fixed
 574 - Fix problems when running Shaarli behind a reverse proxy (invalid RSS feed URL)
 575 - Update check now checks against the community fork version
 576 - Include `cache/`, `data/`, `pagecache/` and `tmp/` directories in the repository
 577 - Fix duplicate tag search returning no results
 578 - Fix unnecessary 404 error on "Add link" when the user is logged out
 579 - Fixes to copyright/licensing information and unlicensed media
 580 - Fixes for tag cloud invalid links
 581 - Coding style fixes/cleanup
 582 - Fix redirection after deleteing a link leading to a 404 error
 583 - Shaarli's HTML is now W3C-compliant
 584 - Search now works with Unicode characters
 585
 586 ### Security
 587 - Do not leak server's PHP version and Shaarli's full path on errors
 588 - Prevent Shaarli from sending a lot of duplicate cookies
 589
 590
 591 ## [v0.0.42beta](https://github.com/shaarli/Shaarli/releases/tag/v0.0.42beta) - 2014-07-27
 592 ### Added
 593 - Add QRCode Javascript library
 594 - Allow importing bookmarks with the same timestamp (hack)
 595 - Allow putting a description in the bookmarklet URL
 596 - Add `json_encode()` implementation for PHP<5.2
 597 - Highlight search results
 598
 599 ### Changed
 600 - Improve 'Stay signed in' behaviour
 601 - Improve `smallHash()`
 602 - Refactor QRCode generation
 603 - Update Javascript lazyloading
 604 - Update CSS
 605
 606 ### Removed
 607 - Remove jQuery from almost all pages
 608
 609 ### Fixed
 610 - Fix overlapping tags
 611 - Fix field foxus in the bookmarklet
 612 - Fix error message when `data/` is not writable
 613 - Fix HTML generation
 614
 615 ### Security
 616 - Fix XSS flaw
 617
 618
 619 ## [v0.0.41beta](https://github.com/shaarli/Shaarli/releases/tag/v0.0.41beta) - 2013-03-08
 620 ### Added
 621 - Add HTTPS to the allowed protocols
 622 - Add support for magnet links in link descriptions
 623 - Allow creating new links as private by default
 624 - Allow disabling jQuery
 625 - Check write permissions
 626 - Check session support before installation
 627
 628 ### Changed
 629 - Improve token security
 630 - RSS feed: allow inverting links/permalinks
 631
 632 ### Fixed
 633 - Fix display issues during installation
 634 - Fix popup redirection after login failure
 635 - Fix RSS formatting for Thunderbird
 636 - Fix thumbnail creation
 637 - Fix cache purge
 638
 639 ### Security
 640 - Fix login issue with WebKit browsers
 641
 642
 643 ## [v0.0.40beta](https://github.com/shaarli/Shaarli/releases/tag/v0.0.40beta) - 2013-02-26
 644 Initial release on GitHub.
 645
 646
 647 ## [v0.0.40beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2012-08-24
 648 ### Added
 649 - Flickr thumbnail now also support albums, galleries and users
 650 - Add a configuration option to disable session cookie protection
 651   Check this if your get disconnected often or your IP address changes often
 652
 653 ### Removed
 654 - Removed the xml comment in cached RSS/ATOM feed
 655   (although W3C-compliant, this may cause problems in some feed readers)
 656
 657 ### Fixed
 658 - A bug in the RSS cache would present old items as new in some cases
 659 - A small bug (non-initialized variable) in page cache cleaning
 660 - Proper "Nothing found" message when search returns no results
 661 - No more 404 error when searching with empty input
 662 - Flickr thumbnails are back (Flickr has made some changes to their domains)
 663
 664 ## [v0.0.39beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2012-08-10
 665 ### Added
 666 - A cache for RSS feed, ATOM feed and Daily RSS feed, because these URLs
 667   are massively hammered. Cache is automatically purged whenever the database
 668   is changed. This will reduce server load. I may add cache to other pages later.
 669
 670 ### Changed
 671 - No more global `$LINKSDB` (Yuk)
 672 - Background color was removed when hovering a link
 673
 674 ### Fixed
 675 - Small bug corrected in config screen on timezones
 676 - Calling a non-existing permalink now returns a crude 404 error instead of 200 (OK)
 677   This is done on purpose
 678 - The `shaarli` session cookie now has a proper path
 679   Thus you can now install several Shaarlis on the same server in different paths,
 680   and each will have its session
 681 - Now when you delete a link, you go back the same page/search parameters you were on
 682 - Restore previously removed `error_get_last()`, to ensure PHP 5.1 compatibility
 683   (Yes, now it works on free.fr hosting)
 684 - Added `dialog=1` in bookmarklet code for some browsers
 685
 686
 687 ## [v0.0.38beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2012-02-06
 688 ### Added
 689 - Automatic creation of the `tmp` directory with proper rights (for RainTPL)
 690 - When you click the key to see only private links, it turns yellow
 691
 692 ### Changed
 693 - The "Daily" page now automatically skips empty days.
 694
 695 ### Fixed
 696 - Corrected the tag encoding (there was a bug when selecting a second tag which contains accented characters)
 697
 698
 699 ## [v0.0.37beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2012-02-01
 700 ### Added
 701 - Basic CSS for mobiles, which makes Shaarli //much// more usable on mobile devices
 702 - Picture wall no more instantly kills your browser. Now it uses
 703   [lazy image loading](http://www.appelsiini.net/projects/lazyload);
 704   the pictures are loaded only as you scroll the page.
 705   This will reduce browser memory usage (especially on mobile devices),
 706   as well as server load.
 707   If you have javascript disabled, the page will still work as before
 708   (all images loaded at once)
 709 - RSS feed for the "Daily" page. 1 RSS entry per day, with all links of that day.
 710   RSS feed provides the last 7 days (only non-empty days are returned).
 711 - In link list, added an icon to see only private links. Click to toggle (only private / all)
 712
 713
 714 ## [v0.0.36beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2012-01-25
 715 ### Added
 716 - Shaarli licence in COPYING
 717
 718 ### Changed
 719 - Display adjustments in "Daily" page
 720
 721 ### Fixed
 722 - Improper text color in install form
 723 - Error in QRCode url (missing '?')
 724
 725
 726 ## [v0.0.35beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2012-01-25
 727 ### Fixed
 728 - Corrected a bug introduced in 0.0.34 which would improperly preprend data to URLs
 729
 730
 731 ## [v0.0.34beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2012-01-25
 732 ### Added
 733 - There is now a QR-Code of each permalink to easily open a link on your smartphone
 734 - Protocols `file:` and `apt:` are now also converted to clickable links (patch by Francis Chavanon)
 735 - Thumbnail support for http://xkcd.com/ (patch by Emilien Klein)
 736 - Thumbnail support for http://pix.toile-libre.org/
 737 - Well I had _some_ mercy for users with antique browsers (IE) which do not have
 738   support for gradients: I added a few `background-color`
 739 - First version of the "Shaarli Daily", a page showing all links of a specific day.
 740   By default, you see the links of the previous day.
 741   There is still work to do on this page (error checking, better navigation (calendar?),
 742   RSS feed, CSS for mobile and printing...)
 743
 744 ### Changed
 745 - Upgraded bundled versions of jQuery (1.7.1) and jQuery UI (1.8.17)
 746 - Upgraded bundled version of RainTPL (2.7)
 747 - Changed HTTPS detection code
 748
 749 ### Fixed
 750 - In link edition, you can now click the word "Private" to check the box
 751 - Clicking a tag would not work properly if the tag contained special characters (like +)
 752 - Added proper jQuery licence (shame on me)
 753
 754
 755 ## [v0.0.33beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2012-01-17
 756 ### Added
 757 - Shaarli packaged to ease Linux distributions integration
 758   As a simple user, you do not need to cope with these versions
 759   Future releases of Shaarli will also be customized and published in these directories
 760   Differences with the standard Shaarli version:
 761     - deb:
 762         - .tar.gz instead of .zip
 763         - COPYING licence file added
 764         - jQuery/jQuery-UI libraries removed to cope with Debian rules
 765           This version links to the libs hosted at http://code.jquery.com
 766     - rpm:
 767         - sources located in a subdirectory with the same name as the zip file
 768         - COPYING licence file added
 769     - WARNING: When downloading the .tar.gz, always use wget (and not your browser),
 770       otherwise the .tar.gz will be corrupted
 771
 772 ### Fixed
 773 - ATOM feed validates again
 774
 775 ### Security
 776 - XSS vulnerability patched (thanks to Stanislas D.!)
 777
 778
 779 ## [v0.0.32beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2011-12-16
 780 ### Added
 781 - Better check on URL parameters (patch by gege2061)
 782 - Add `max-height` and `overflow:auto` attributes so that content can be scrolled if too large
 783
 784 ### Changed
 785 - HTML generation moved to RainTPL templates (in the `tpl/` directory)
 786 - Better detection of HTTPS (patch by gege2061)
 787 - In RSS/ATOM feeds, the GUID is now the permalink instead of the final URL (patch by gege2061)
 788 - Jerrywham CSS patch included
 789 - Multiple spaces are now respected in description.
 790   Thus you can use Shaarli as a personal pastebin (for posting source code, for example).
 791
 792 ### Removed
 793 - Page time generation was removed
 794
 795 ### Fixed
 796 - Tab order changed in login screen
 797 - Permalinks now work even if additional parameters have been added
 798   (e.g. `/?E8Yj2Q&utm_source=blablabla...`)
 799 - user.css is included only if the file is present
 800   (This prevents a useless CSS include which makes a harmless but useless 404 error.)
 801
 802
 803 ## [v0.0.31beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2011-11-29
 804 ### Added
 805 - Support for TED Talks (ted.com/talks) thumbnails (patch by Emilien K.)
 806 - partial [patch](http://www.idleman.fr/blog/?p=508) by Idleman: Better design consistency, icon on private links. In-page popup was not included because it causes problem on some websites
 807 - Support for bookmark files without ADD_DATE attributes
 808 - Logo is clickable
 809 - `user.css` can be added to overload Shaarli base CSS.(patch by Jerrywham).
 810   Just put `user.css` in the same directory as shaarli.css.
 811   Example: `<code css>#pageheader { background: blue; }</code>`
 812   Please note that Shaarli CSS are not stable and may completely change on each version
 813
 814 ### Changed
 815 - Edit and Delete buttons in link list were replaced with icons. (patch by Jerrywham)
 816
 817 ### Fixed
 818 - Better error handling in thumbnail generation (patch by Emilien K.)
 819 - The top menu is no longer displayed in bookmarklet popup
 820 - Bookmark which have the exact same date/time are now correctly imported.
 821   Most remaining import problems should be solved now
 822 - Comment in Shaarli export moved to beginning of file to prevent clash with last link description
 823
 824
 825 ## [v0.0.30beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2011-11-18
 826 ### Added
 827 - Add a small `delete` button in link list (after the `edit` button)
 828
 829 ### Fixed
 830 - Moved the call to PubSubHub
 831
 832
 833 ## [v0.0.29beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2011-11-18
 834 ### Fixed
 835 - Corrected a bug introduced in v0.0.28beta
 836   (there was an error if you use the bookmarklet and you're not logged in)
 837
 838
 839 ## [v0.0.28beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2011-11-17
 840 ### Added
 841 - Thumbnail support for youtu.be URLs (YouTube short url service)
 842 - PubSubHub protocol support (from http://aldarone.fr/les-flux-rss-shaarli-et-pubsubhubbub/).
 843   Warning: This was not tested. You need to set your hub url in
 844   `$GLOBALS['config']['PUBSUBHUB_URL']` and put the official client (`publisher.php`)
 845   in the same directory as Shaarli's `index.php`
 846 - RSS and ATOM feeds now also contain tags (in `category` tags, as per their
 847   respective specifications)
 848
 849 ### Changed
 850 - New Shaarli theme and logo by Idle (http://www.idleman.fr/blog/?p=469)
 851 - In picture wall, pictures point to Shaarli permalink instead of final URL.
 852   This way, users can read the description.
 853 - In RSS/ATOM feeds, guid and link URL of permalinks are now proper absolute URLs
 854 - In RSS/ATOM feeds, URLs are now clickable
 855 - Rename `http_parse_headers()` to `http_parse_headers_shaarli()` to prevent
 856   name collision with some PHP extensions
 857
 858 ### Fixed
 859 - Thumbnails removed for imgur.com/a/ URLs (Thumbnails are not available for albums on imgur)
 860 - Shaarli now correctly only tries to get thumbnails for vimeo video URLs
 861 - Fix a bug in imgur.com URLs handling that would cause some thumbnails not to appear
 862 - The search engine would not return a result if the word to search was the first in description
 863 - Extracted title is now correct if the page has two `title` html tags
 864
 865
 866 ## [v0.0.27beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2011-10-18
 867 ### Added
 868 - Add a picture wall, which can be filtered too: it will use the same filters
 869   (tags,text search) as current page when clicked.
 870
 871
 872 ## [v0.0.26beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2011-10-17
 873 ### Changed
 874 - Made permalink more visible (smallHash)
 875
 876 ### Fixed
 877 - Removed extras space in description when URLs are converted to clickable links
 878 - Thumbnail for subreddit imgur urls (/r/...) were corrected (thanks to Accent Grave)
 879
 880
 881 ## [v0.0.25beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2011-10-13
 882 ### Added
 883 - Better CSS for printing (thanks to jerrywham suggestion)
 884 - Allow using a redirector or anonymizing proxy for links
 885   (such as `http://anonym.to/?` to mask you `HTTP_REFERER`).
 886   Just go to `Tools > Configure > Redirector`
 887   (thanks to Accent Grave for the suggestion).
 888 - The `ENABLE_LOCALCACHE` option can be set to `false` for those who have
 889   a limited quota on their host.
 890   This will disable the local thumbnail cache.
 891   Services which require the use of the cache will have no thumbnails
 892   (vimeo, flickr, direct link to image).
 893   Other services will still have a thumbnail (youtube,imgur.com,dailymotion,imageshack.us)
 894
 895 ### Changed
 896 - Now thumbnails generated by Shaarli are croped to a height of 120 pixels
 897 - YouTube thumbnails now use `default.jpg` instead of `2.jpg` (This is usually more pertinent)
 898 - Configuration options (such as `HIDE_TIMESTAMPS`, `ENABLE_THUMBNAILS`, etc.)
 899   can now be put in a an external file so that you do not have to tweak them again
 900   when you upgrade Shaarli.
 901   Just add the file `data/options.php`.
 902 - If a single link is displayed, the page title contains the title of the link
 903 - Shaarli page title is clickable (and has the same link as "Home")
 904 - A few CSS tweaks (thanks to maethor for suggestion)
 905
 906 ### Fixed
 907 - Shaarli now supports newlines in titles (thanks to dixy)
 908 - The link to the RSS feed in page header was not correct
 909
 910
 911 ## [v0.0.24beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
 912 ### Added
 913 - Allow posting an entry without a link. (You can use Shaarli as a kind of "personal twitter")
 914 - Each Shaarli entry now has a short link (just click on the date of a link).
 915   Now you can send a link that points to a single entry in your Shaarli
 916 - In descriptions, URLs are now clickable
 917 - Thumbnails will be generated for all link pointing to .jpg/png/gif
 918   (as long as the images are less than 4 Mb and take less than 30 seconds to download)
 919
 920 ### Fixed
 921 - Now thumbnails also work for imgur gallery links (/gallery/...)
 922   (Thanks to Accent Grave for the correction)
 923 - Removed useless debugging information in log
 924 - The filter in RSS/ATOM feed now works again properly (it was broken in 0.0.17beta)
 925
 926
 927 ## [v0.0.23beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
 928 ### Added
 929 - Added thumbnail support for imageshack.us
 930
 931 ### Changed
 932 - Now you can clic the sentence "Stay signed in" to tick the checkbox (patch by Emilien)
 933 - In tag editing, comma (,) are now automatically converted to spaces
 934 - In tag editing, autocomplete no longuer suggests a tag you have already entered in the same line
 935
 936
 937 ## [v0.0.22beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
 938 ### Added
 939 - Support for thumbnails for flickr.com
 940 - Allow staying signed in:
 941   Your session will be kept open even if you close the browser.
 942   This is available through a checkbox in the login screen.
 943
 944 ### Changed
 945 - Some hosts (flickr, vimeo) are slow as hell for the thumbnails,
 946   or require an extra HTTP request.
 947   For these hosts the thumbnail generation has been deported outside the generation
 948   of the page to keep Shaarli snappy.
 949   For these slow services, the thumbnails are also cached.
 950
 951 ### Fixed
 952 - Title was not properly passed if you had to login when using the bookmarklet (patch by shenshei)
 953
 954
 955 ## [v0.0.21beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
 956 ### Added
 957 - Thumbnails for some services
 958   Currently supports: YouTube.com, dailymotion.com, vimeo.com (slow!) and imgur.com.
 959   Thumbnails are enabled by default, but you can turn them off
 960   (set `define('ENABLE_THUMBNAILS',true);` to `false`).
 961
 962 ### Changed
 963 - Removed the focus on the searchbox (this is cumbersome when you want to browse pages
 964   and scroll with the keyboard)
 965
 966
 967 ## [v0.0.20beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
 968 ### Fixed
 969 - RSS feed is now served as `application/rss+xml` instead of `application/xhtml+xml`
 970   (which was causing problem in //RSS Lounge//)
 971 - ATOM feed is now served as `application/atom+xml` instead of `application/xhtml+xml`
 972
 973
 974 ## [v0.0.19beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
 975 ### Added
 976 - ATOM feed
 977
 978 ### Fixed
 979 - Patch by Emilien to remove the update notification after the update
 980
 981
 982 ## [v0.0.18beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
 983 ### Added
 984 - You can now configure the title of your page
 985 - New screen to configure title and timezone
 986
 987 ### Changed
 988 - Nicer timezone selection patch by killruana
 989
 990 ### Fixed
 991 - New lines now appear correctly in the RSS feed descriptions.
 992
 993
 994 ## [v0.0.17beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
 995 ### Added
 996 - Change password screen added (based on a patch by killruana)
 997 - Autocomplete in the tag search form
 998 - You can rename or delete a tag in all links
 999   (very handy if you misspelled a tag or want to merge tags)
1000 - When you click the RSS feed, the feed will be filtered with the same filters
1001   as the page you were viewing
1002
1003 ### Changed
1004 - CSS adjustments by jerrywham
1005 - Minor corrections
1006
1007
1008 ## [v0.0.16beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
1009 ### Added
1010 - Upgrade notification:
1011   If a new version of Shaarli is available, you will be notified by a discreet
1012   message in top-right corner.
1013   This message will only be visible if you are logged in, and the check will be
1014   performed at most once a day.
1015 - Preliminary tag cloud (ugly for the moment, I need to find something better)
1016
1017 ### Changed
1018 - Replaced `preg_match()` with `version_compare()` to check PHP version
1019 - Includes a patch by Emilien K. to mask dates if user is not logged in.
1020   The option can be activated by changing `define('HIDE_TIMESTAMPS',false);` to `true`
1021
1022
1023 ## [v0.0.15beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
1024 ### Added
1025 - New in import: Option to overwrite existing links when importing
1026 - On free.fr, automatic creation of the `/sessions` directory
1027
1028 ### Changed
1029 - CSS Stylesheet is now an external file (shaarli.css).
1030   This reduces page size and eases customization.
1031
1032 ### Removed
1033 - Removed some parameters in URL added by some feed proxies (`#xtor=RSS-...`)
1034
1035 ### Fixed
1036 - Bug corrected: Prevented loop on login screen upon successful login after a failed login
1037 - Bug corrected in import: HTML entities were not properly decoded.
1038   If you imported your Delicious/Diigo bookmarks, your should import them again
1039   and use the 'overwrite' option of the import feature.
1040
1041
1042 ## [v0.0.14beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
1043 ### Added
1044 - You no longer need to disable `magic_quotes` on your host.
1045   Shaarli will cope with this option beeing activated.
1046
1047
1048 ## [v0.0.13beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
1049 ### Added
1050 - Import: New option to import html bookmark file as private links
1051 - Import: Importing a bookmark file will not overwrite existing links anymore
1052 - Export: New options to export only public or private links
1053
1054 ### Changed
1055 - In tag autocomplete, tags are presented in use order
1056   (most used tags first, instead of alphabetical order)
1057 - RSS Feed can now be filtered by tags or fulltext search. Just add to the feed url:
1058   - `&searchtags=minecraft+video` for tag filtering
1059   - `&searchterm=portal` for fulltext search to the feed url
1060
1061
1062 ## [v0.0.12beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
1063 ### Added
1064 - Add a check that the config file was properly created
1065   (in case Shaarli does not have the write rights in its folder)
1066 - Open Shaarli: there is an option to open your Shaarli to anyone.
1067   Anybody will be able to add/edit/delete links without having to login.
1068   In code, change `define('OPEN_SHAARLI',false);` to `true`.
1069   Note: No anti-spam for the moment. You are warned!
1070 - Autocomplete for tags
1071
1072
1073 ## [v0.0.11beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
1074 ### Added
1075 - Add a check and a warning for some hosts which still have `magic_quotes` activated
1076
1077
1078 ## [v0.0.10beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
1079 ### Added
1080 - Get rid of `&quot;` in titles
1081
1082
1083 ## [v0.0.9beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
1084 ### Added
1085 - Now works on hosts `free.fr` and `1and1`
1086 - Now works with PHP 5.1
1087 - PHP version is now checked and an error message is displayed if version is not correct
1088
1089 ### Fixed
1090 - No more error messages if the browser does not send `HTTP_REFERER`
1091 - No more error messages if the host has disabled http protocol in PHP config (eg. 1and1)
1092
1093
1094 ## [v0.0.8beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
1095 ### Changed
1096 - In RSS feed, GUID content replaced with the URL of the link, because some
1097   stupid RSS reader (like Google Reader) use `<guid>` as a link instead of using `<link>`
1098
1099
1100 ## [v0.0.7beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) - 2011-09-16
1101 First public release by Sebsauvage, see original article:
1102 [Adieu Delicious, Diigo et StumbleUpon. Salut Shaarli !](http://sebsauvage.net/rhaa/index.php?2011/09/16/09/29/58-adieu-delicious-diigo-et-stumbleupon-salut-shaarli-) (FR)