X-Git-Url: https://git.immae.eu/?p=github%2Fshaarli%2FShaarli.git;a=blobdiff_plain;f=CHANGELOG.md;h=aa1f0d8aa30cf74d9f2bbbf87b4603ac8068e87c;hp=f0813b97eafa3714c42369b391143333c3d2266c;hb=1004742f09b55ff781c13745781b9a7e90986faa;hpb=c4c655d9bfe68a914898d76bb9c479eea1b04f72 diff --git a/CHANGELOG.md b/CHANGELOG.md index f0813b97..aa1f0d8a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,13 +4,238 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). +## [v0.10.2](https://github.com/shaarli/Shaarli/releases/tag/v0.10.2) - 2018-08-11 -## [v0.9.0](https://github.com/shaarli/Shaarli/releases/tag/v0.9.0) - UNPUBLISHED +### Fixed + +- Docker build + +## [v0.10.1](https://github.com/shaarli/Shaarli/releases/tag/v0.10.1) - 2018-08-11 + +### Changed + +- Accessibility: + - Remove alt text on the logo + - Remove redundant title in tools page + +### Fixed + +- Fixed an error on the daily page and daily RSS +- Fixed an issue causing 'You are not authorized to add a link' error while logged out +- Fixed thumbnail path when Shaarli's path uses symbolic links +- Add a `mod_version` check in Shaarli's root `.htaccess` file for Apache 2.2 syntax +- Include assets in the release Makefile target + +### Removed + +- Firefox Social API shaare has been removed + +## [v0.10.0](https://github.com/shaarli/Shaarli/releases/tag/v0.10.0) - 2018-07-28 +**PHP 5.5 compatibility has been dropped.** Shaarli now requires at least PHP 5.6. + +### Added +- Add a filter to display public links only +- Add PHP 7.2 support +- Add German translation +- Resolve front-end dependencies from NPM +- Build front-end bundles with Yarn and Webpack +- Lint Javascript code with ESLint +- Lint SASS code with SASSLint +- Support redirection in cURL download callback +- Introduce multi-stage builds for Docker images +- Use Travis matrix and stages to run Javascript tests in a dedicated environment +- Add tag endpoint in the REST API +- Build the documentation in Travis builds +- Provide a Docker Compose example + +### Changed +- Use web-thumbnailer to retrieve thumbnails (see #687) +- Use a specific page title in all pages +- Daily: run hooks before creating the columns +- Load theme translations files automatically +- Make max download size and timeout configurable +- Make Nginx logs accessible as stdout/stderr for Docker images +- Update buttons used to toggle link visibility filters +- Rewrite Javascript code for ES6 compliance +- Refactor IP ban management +- Refactor user login management +- Refactor server-side session management +- Update Doxygen configuration +- Update Parsedown +- Improve documentation +- Docker: build the images from the local sources +- Docker: bump alpine version to 3.7 +- Docker: expose a volume for the thumbnail cache + +### Removed +- Drop support for PHP 5.5 +- Remove vendored front-end libraries +- Remove environment specific .gitignore entries + +### Fixed +- Ignore the case while checking DOCTYPE during the file import +- Fix removal of on=... attributes from html generated from Markdown +- httpd: always forward the 'Authorization' header +- Ensure user-specific CSS file is loaded +- Fix feed permalink rendering when Markdown escaping is enabled +- Fix order of tags with the same number of occurrences +- Fixed the referrer meta tag in default template +- Disable MkDocs' strict mode for ReadTheDocs builds to pass +- fix and simplify Dockerfile for armhf + +### Security +- Update `.htaccess` to prevent accessing Git metadata when using a Git-based installation + + +## [v0.9.7](https://github.com/shaarli/Shaarli/releases/tag/v0.9.7) - 2018-06-20 +### Changed +- Build the Docker images from the local Git sources + + +## [v0.9.6](https://github.com/shaarli/Shaarli/releases/tag/v0.9.6) - 2018-03-25 +### Changed +- htaccess: prevent accessing resources not managed by SCM +- htaccess: always forward the 'Authorization' HTTP header + + +## [v0.9.5](https://github.com/shaarli/Shaarli/releases/tag/v0.9.5) - 2018-02-02 +### Fixed +- Fix a warning happening when `php-intl` is not installed on the system +- Fix warnings happening when updating from legacy SebSauvage version + +## [v0.9.4](https://github.com/shaarli/Shaarli/releases/tag/v0.9.4) - 2018-01-30 +### Added +- Enable translations: Shaarli is now also available in French. Other language translations are welcome! +- Add EditorConfig configuration +- Add favicons for mobile devices +- Add Alpine Linux arm32v7 Dockerfiles (master, latest) + +### Changed +- Do not write bookmark edition history during file imports (performance) +- Migrate Docker images (master, latest) to Alpine Linux +- Improve unitary tests and code coverage +- Improve thumbnail display +- Improve theme ergonomics +- Improve messages if there is no plugin or parameter available in the admin page +- Increase buffer size for cURL download +- Force HTTPS if the original port is 443 behind a reverse proxy (workaround) +- Improve page title retrieval performances + +### Removed +- Remove redirector setting from Configure page + +### Fixed +- Fix broken links in the documentation +- Enable access to `data/user.css` (Apache 2.2 & 2.4) +- Don't URL encode description links if parameter `redirector.encode_url` is set to false +- Fix an issue preventing the Save button to appear for plugin parameters + + +## [v0.9.3](https://github.com/shaarli/Shaarli/releases/tag/v0.9.3) - 2018-01-04 +**XSS vulnerability fixed. Please update.** + +## Security +- Fix an XSS (cross-site-scripting) vulnerability in `index.php` - + [CVE-2018-5249](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5249) + + +## [v0.9.2](https://github.com/shaarli/Shaarli/releases/tag/v0.9.2) - 2017-10-07 + +**Major security issue fixed. Please update.** + +### Added +- Tag search now supports wildcards `*` +- New setting `privacy.force_login` which can be used with `privacy.hide_public_links` to redirect anonymous users to the login page. +- New setting `general.default_note_title` used to override default `Note:` title prefix for notes. +- Add a version hash for asset loading to prevent browser's cache issue + +### Changed +- The "Remember me" checkbox is unchecked by default +- The default value of the "Remember me" checkbox can be configured under `data/config.json.php` + +### Removed +- Remove obsolete PHP magic quote support + +### Fixed +- Generates a permalink URL if the URL is set to blank +- Replace links to the old GitHub wiki with ReadTheDocs URIs +- Use single quotes in the note bookmarklet +- Daily page if there is no link +- Bulk link deletion with a single link +- HTTPS detection behind a reverse proxy +- Travis tests environment and localization +- Improve template paths robustness (trailing slash) +- Robustness: safer gzinflate/zlib usage +- Description links parsing with parenthesis (without Markdown) +- Templates: + - Sort the tag cloud alphabetically + - Firefox social title + - Improved visited link color + - Fix jumpy textarea with long content in post edit + +### Security + +- Fixed reflected XSS vulnerability introduced in v0.9.1, discovered by @chb9 ([CVE-2017-15215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15215)). + + +## [v0.9.1](https://github.com/shaarli/Shaarli/releases/tag/v0.9.1) - 2017-08-23 + +The documentation has been migrated to ReadTheDocs: +- https://shaarli.readthedocs.io/ +- edits are submitted as pull requests + +### Added +- Allow bulk link deletion +- Display subtags in the tag cloud +- Add an endpoint to refresh the token +- Add a token on every page +- Add a tag list view for management +- Add Note bookmarklet +- Add creation date when editing a link + +### Changed +- Documentation: + - Generate static HTML documentation with [mkdocs](http://www.mkdocs.org/) + - Host documentation on [ReadTheDocs](http://www.mkdocs.org/) + - Update documentation structure + - Update Makefile targets to: + - Build the docs locally + - Include the generated docs in the release archives +- Theme: + - Use the new theme as the default + - Rename the tag cloud template to `tag.cloud.html` + - Display visited links in grey + - Use only one search form in `linklist.html` + - Hide the "search links with these tags" option when an empty `searchtags` is passed to `tag.list.html` +- Improve HTTP header handling when hosting Shaarli with Docker behind a reverse proxy +- Searching for tags with an empty value returns untagged links only +- Set Travis environment to `precise` until the new `trusty` environment is ready + +### Removed +- Remove dead Pubsubhubbub code +- Disable the GitHub wiki (see changed/documentation) +- Remove Docker `dev` image and resources +- Theme: + - Remove the bottom "Sort by" menu in `tag.list.html` + +### Fixed +- Fix file existence check for `user.css` +- Limit selection to 2k characters when using the bookmarklet +- Fix JS error `uncaught type error` +- Fix Firefox Social button +- Use pinned PHP dependencies when generating release archives +- Make sure that the tag exists before altering/removing it + +### Security +- Add a whitelist for protocols for URLs + + +## [v0.9.0](https://github.com/shaarli/Shaarli/releases/tag/v0.9.0) - 2017-05-07 This release introduces the REST API, and requires updating HTTP server configuration to enable URL rewriting, see: - https://shaarli.github.io/api-documentation/ -- https://github.com/shaarli/Shaarli/wiki/Server-configuration +- https://shaarli.readthedocs.io/en/master/Server-configuration/ **WARNING**: Shaarli now requires PHP 5.5+. @@ -21,16 +246,19 @@ configuration to enable URL rewriting, see: - versioned API endpoints: - `/api/v1/info`: get general information on the Shaarli instance - `/api/v1/links`: get a list of shaared links + - `/api/v1/history`: get a list of latest actions Theming: - Introduce a new theme - Allow selecting themes/templates from the configuration page - New/Edit link form can be submitted using CTRL+Enter in the textarea - - Shaarli version is displayed in the footer when logged in + - Shaarli version is displayed in the footer when logged in - Add plugin placeholders to Atom/RSS feed templates - Add OpenSearch to feed templates - Add `campaign_` to the URL cleanup pattern list - Add an AUTHORS file and Makefile target to list authors from Git commit data - Link imports are now logged in `data/` folder, and can be debug using `dev.debug=true` setting. +- `composer.lock` is now included in git file to allow proper `composer install` +- History mechanism which logs link addition/modification/deletion ### Changed - Docker: enable nginx URL rewriting for the REST API @@ -40,6 +268,8 @@ Theming: - Rename the legacy theme to `vintage` - Private only filter is now displayed as a search parameter - Autocomplete: pre-select the first element + - Display daily date in the page title (browser title) + - Timezone lists are now passed as an array instead of raw HTML - Move PubSubHub to a dedicated plugin - Coding style: - explicit method visibility @@ -50,9 +280,13 @@ Theming: - Improved client locale detection - Improved date time display depending on the locale - Partial namespace support for Shaarli classes +- Shaarli version is now only present in `shaarli_version.php` +- Human readable maximum file size upload + ### Removed - PHP < 5.5 compatibility +- ReadItYourself plugin ### Fixed - Ignore generated release tarballs @@ -67,11 +301,32 @@ Theming: - Remove extra spaces in the bookmarklet's name - Piwik plugin: Piwik URL protocol can now be set (http or https) - All inline JS has been moved to dedicated JS files +- Keep tags after login redirection ### Security - Markdown plugin: escape HTML entities by default +## [v0.8.7](https://github.com/shaarli/Shaarli/releases/tag/v0.8.7) - 2018-06-20 +### Changed +- Build the Docker image from the local Git sources + +### Removed +- Disable PHP 5.3 Travis build (unsupported) + + +## [v0.8.6](https://github.com/shaarli/Shaarli/releases/tag/v0.8.6) - 2018-02-19 +### Changed +- Run version check tests against the 'stable' branch + + +## [v0.8.5](https://github.com/shaarli/Shaarli/releases/tag/v0.8.5) - 2018-01-04 +**XSS vulnerability fixed. Please update.** + +## Security +- Fix an XSS (cross-site-scripting) vulnerability in `index.php` - + [CVE-2018-5249](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5249) + ## [v0.8.4](https://github.com/shaarli/Shaarli/releases/tag/v0.8.4) - 2017-03-04 ### Security - Markdown plugin: escape HTML entities by default @@ -87,7 +342,7 @@ Theming: ## [v0.8.1](https://github.com/shaarli/Shaarli/releases/tag/v0.8.1) - 2016-12-12 -> Note: this version will create an automatic backup of your database if anything goes wrong. +> Note: this version will create an automatic backup of your database if anything goes wrong. ### Added - Add CHANGELOG.md to track the whole project's history @@ -104,7 +359,7 @@ Theming: - Link ID complete refactoring: - Links now have a numeric ID instead of dates - Short URLs are now created once and can't change over time (previous URL are kept) -- Templates: +- Templates: - Changed placeholder behaviour for: `buttons_toolbar`, `fields_toolbar` and `action_plugin` - Cleanup `{loop}` declarations in templates - Tools: hide Firefox Social button when not in HTTPS @@ -122,7 +377,7 @@ Theming: - Plugins: - Tools: only display parameter description when it exists - archive.org: do not propose archival of private notes - - Markdown: + - Markdown: - render links properly in code blocks - bug regarding the `nomarkdown` tag - W3C compliance @@ -261,7 +516,7 @@ Please use our release archives, or follow the ### Fixed - Fix a bug where renaming a tag was causing a 404 - Fix a bug allowing to search blank terms -- Fix a bug preventing to remove a tag with special chars when searching +- Fix a bug preventing to remove a tag with special chars when searching ## [v0.6.2](https://github.com/shaarli/Shaarli/releases/tag/v0.6.2) - 2015-12-23 @@ -567,7 +822,7 @@ Initial release on GitHub. - When you click the key to see only private links, it turns yellow ### Changed -- The "Daily" page now automatically skips empty days. +- The "Daily" page now automatically skips empty days. ### Fixed - Corrected the tag encoding (there was a bug when selecting a second tag which contains accented characters) @@ -865,7 +1120,7 @@ Initial release on GitHub. - Nicer timezone selection patch by killruana ### Fixed -- New lines now appear correctly in the RSS feed descriptions. +- New lines now appear correctly in the RSS feed descriptions. ## [v0.0.17beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) @@ -919,7 +1174,7 @@ Initial release on GitHub. ## [v0.0.14beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) ### Added - You no longer need to disable `magic_quotes` on your host. - Shaarli will cope with this option beeing activated. + Shaarli will cope with this option beeing activated. ## [v0.0.13beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)