5 files changed, 39 insertions, 19 deletions

diff --git a/.github/mailmap b/.github/mailmap
index bbdb7908..7633afcf 100644
--- a/.github/mailmap
+++ b/.github/mailmap
@@ -1,6 +1,8 @@
 ArthurHoaro <arthur@hoa.ro>
 Florian Eula <eula.florian@gmail.com> feula
 Florian Eula <eula.florian@gmail.com> <mr.pikzen@gmail.com>
+Immánuel Fodor <immanuelfactor+github@gmail.com>
+kalvn <kalvnthereal@gmail.com> <kalvn@users.noreply.github.com>
 Nicolas Danelon <hi@nicolasmd.com.ar> nicolasm
 Nicolas Danelon <hi@nicolasmd.com.ar> <nda@3818.com.ar>
 Nicolas Danelon <hi@nicolasmd.com.ar> <nicolasdanelon@gmail.com>
diff --git a/AUTHORS b/AUTHORS
index 105561c1..6c4d9529 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -1,6 +1,6 @@
-   537  ArthurHoaro <arthur@hoa.ro>
-   252  VirtualTam <virtualtam@flibidi.net>
-   148  nodiscc <nodiscc@gmail.com>
+   574  ArthurHoaro <arthur@hoa.ro>
+   277  VirtualTam <virtualtam@flibidi.net>
+   169  nodiscc <nodiscc@gmail.com>
     56  Sébastien Sauvage <sebsauvage@sebsauvage.net>
     15  Florian Eula <eula.florian@gmail.com>
     13  Emilien Klein <emilien@klein.st>
@@ -11,8 +11,9 @@
      5  Lucas Cimon <lucas.cimon@gmail.com>
      4  Alexandre Alapetite <alexandre@alapetite.fr>
      4  David Sferruzza <david.sferruzza@gmail.com>
+     4  kalvn <kalvnthereal@gmail.com>
+     3  Immánuel Fodor <immanuelfactor+github@gmail.com>
      3  Teromene <teromene@teromene.fr>
-     3  kalvn <kalvnthereal@gmail.com>
      2  Chris Kuethe <chris.kuethe@gmail.com>
      2  Knah Tsaeb <Knah-Tsaeb@knah-tsaeb.org>
      2  Mathieu Chabanon <git@matchab.fr>
@@ -27,6 +28,7 @@
      1  BoboTiG <bobotig@gmail.com>
      1  Bronco <bronco@warriordudimanche.net>
      1  D Low <daniellowtw@gmail.com>
+     1  Daniel Jakots <vigdis@chown.me>
      1  Dimtion <zizou.xena@gmail.com>
      1  Fanch <fanch-github@qth.fr>
      1  Felix Bartels <felix@host-consultants.de>
@@ -41,6 +43,8 @@
      1  Lionel Martin <renarddesmers@gmail.com>
      1  Mark Gerarts <mark.gerarts@gmail.com>
      1  Marsup <marsup@gmail.com>
+     1  Neros <contact@neros.fr>
      1  Sbgodin <Sbgodin@users.noreply.github.com>
      1  TsT <tst2005@gmail.com>
      1  dimtion <zizou.xena@gmail.com>
+     1  durcheinandr <jochen@durcheinandr.de>
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 33feac20..b823ba70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [v0.9.3](https://github.com/shaarli/Shaarli/releases/tag/v0.9.3) - 2018-01-04
+**XSS vulnerability fixed. Please update.**
+
+## Security
+- Fix an XSS (cross-site-scripting) vulnerability in `index.php`
+
+
 ## [v0.9.2](https://github.com/shaarli/Shaarli/releases/tag/v0.9.2) - 2017-10-07
 
 **Major security issue fixed. Please update.**
@@ -42,6 +49,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 - Fixed reflected XSS vulnerability introduced in v0.9.1, discovered by @chb9 ([CVE-2017-15215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15215)).
 
+
 ## [v0.9.1](https://github.com/shaarli/Shaarli/releases/tag/v0.9.1) - 2017-08-23
 
 The documentation has been migrated to ReadTheDocs:
@@ -115,7 +123,7 @@ Theming:
     - Introduce a new theme
     - Allow selecting themes/templates from the configuration page
     - New/Edit link form can be submitted using CTRL+Enter in the textarea
-    - Shaarli version is displayed in the footer when logged in 
+    - Shaarli version is displayed in the footer when logged in
 - Add plugin placeholders to Atom/RSS feed templates
 - Add OpenSearch to feed templates
 - Add `campaign_` to the URL cleanup pattern list
@@ -145,7 +153,7 @@ Theming:
 - Improved date time display depending on the locale
 - Partial namespace support for Shaarli classes
 - Shaarli version is now only present in `shaarli_version.php`
-- Human readable maximum file size upload 
+- Human readable maximum file size upload
 
 
 ### Removed
@@ -171,6 +179,12 @@ Theming:
 - Markdown plugin: escape HTML entities by default
 
 
+## [v0.8.5](https://github.com/shaarli/Shaarli/releases/tag/v0.8.5) - 2018-01-04
+**XSS vulnerability fixed. Please update.**
+
+## Security
+- Fix an XSS (cross-site-scripting) vulnerability in `index.php`
+
 ## [v0.8.4](https://github.com/shaarli/Shaarli/releases/tag/v0.8.4) - 2017-03-04
 ### Security
 - Markdown plugin: escape HTML entities by default
@@ -186,7 +200,7 @@ Theming:
 
 ## [v0.8.1](https://github.com/shaarli/Shaarli/releases/tag/v0.8.1) - 2016-12-12
 
-> Note: this version will create an automatic backup of your database if anything goes wrong. 
+> Note: this version will create an automatic backup of your database if anything goes wrong.
 
 ### Added
 - Add CHANGELOG.md to track the whole project's history
@@ -203,7 +217,7 @@ Theming:
 - Link ID complete refactoring:
     - Links now have a numeric ID instead of dates
     - Short URLs are now created once and can't change over time (previous URL are kept)
-- Templates: 
+- Templates:
     - Changed placeholder behaviour for: `buttons_toolbar`, `fields_toolbar` and `action_plugin`
     - Cleanup `{loop}` declarations in templates
     - Tools: hide Firefox Social button when not in HTTPS
@@ -221,7 +235,7 @@ Theming:
 - Plugins:
     - Tools: only display parameter description when it exists
     - archive.org: do not propose archival of private notes
-    - Markdown: 
+    - Markdown:
         - render links properly in code blocks
         - bug regarding the `nomarkdown` tag
     - W3C compliance
@@ -360,7 +374,7 @@ Please use our release archives, or follow the
 ### Fixed
 - Fix a bug where renaming a tag was causing a 404
 - Fix a bug allowing to search blank terms
-- Fix a bug preventing to remove a tag with special chars when searching 
+- Fix a bug preventing to remove a tag with special chars when searching
 
 
 ## [v0.6.2](https://github.com/shaarli/Shaarli/releases/tag/v0.6.2) - 2015-12-23
@@ -666,7 +680,7 @@ Initial release on GitHub.
 - When you click the key to see only private links, it turns yellow
 
 ### Changed
-- The "Daily" page now automatically skips empty days. 
+- The "Daily" page now automatically skips empty days.
 
 ### Fixed
 - Corrected the tag encoding (there was a bug when selecting a second tag which contains accented characters)
@@ -964,7 +978,7 @@ Initial release on GitHub.
 - Nicer timezone selection patch by killruana
 
 ### Fixed
-- New lines now appear correctly in the RSS feed descriptions. 
+- New lines now appear correctly in the RSS feed descriptions.
 
 
 ## [v0.0.17beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
@@ -1018,7 +1032,7 @@ Initial release on GitHub.
 ## [v0.0.14beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
 ### Added
 - You no longer need to disable `magic_quotes` on your host.
-  Shaarli will cope with this option beeing activated. 
+  Shaarli will cope with this option beeing activated.
 
 
 ## [v0.0.13beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history)
diff --git a/README.md b/README.md
index c1050027..e7e8ad4c 100644
--- a/README.md
+++ b/README.md
@@ -6,10 +6,10 @@ _Do you want to share the links you discover?_
 _Shaarli is a minimalist link sharing service that you can install on your own server._
 _It is designed to be personal (single-user), fast and handy._
 
-[![](https://img.shields.io/badge/stable-v0.8.4-blue.svg)](https://github.com/shaarli/Shaarli/releases/tag/v0.8.4)
+[![](https://img.shields.io/badge/stable-v0.8.5-blue.svg)](https://github.com/shaarli/Shaarli/releases/tag/v0.8.5)
 [![](https://img.shields.io/travis/shaarli/Shaarli/stable.svg?label=stable)](https://travis-ci.org/shaarli/Shaarli)
 &bull;
-[![](https://img.shields.io/badge/latest-v0.9.2-blue.svg)](https://github.com/shaarli/Shaarli/releases/tag/v0.9.2)
+[![](https://img.shields.io/badge/latest-v0.9.3-blue.svg)](https://github.com/shaarli/Shaarli/releases/tag/v0.9.3)
 [![](https://img.shields.io/travis/shaarli/Shaarli/latest.svg?label=latest)](https://travis-ci.org/shaarli/Shaarli)
 &bull;
 [![](https://img.shields.io/badge/master-v0.9.x-blue.svg)](https://github.com/shaarli/Shaarli)
diff --git a/doc/md/Download-and-Installation.md b/doc/md/Download-and-Installation.md
index bbbfc26d..0fdbd27d 100644
--- a/doc/md/Download-and-Installation.md
+++ b/doc/md/Download-and-Installation.md
@@ -25,11 +25,11 @@ Using one of the following methods:
 
 In most cases, you should download the latest Shaarli release from the [releases](https://github.com/shaarli/Shaarli/releases) page. **Download our *shaarli-full* archive** to include dependencies.
 
-The current latest released version is `v0.9.1`
+The current latest released version is `v0.9.3`
 
 ```bash
-$ wget https://github.com/shaarli/Shaarli/releases/download/v0.9.1/shaarli-v0.9.1-full.zip
-$ unzip shaarli-v0.9.1-full.zip
+$ wget https://github.com/shaarli/Shaarli/releases/download/v0.9.3/shaarli-v0.9.3-full.zip
+$ unzip shaarli-v0.9.3-full.zip
 $ mv Shaarli /path/to/shaarli/
 ```
 
@@ -96,7 +96,7 @@ Install [Composer](Unit-tests.md#install_composer) to manage Shaarli dependencie
 To get the latest changes from the `master` branch:
 
 ```bash
-# clone the repository  
+# clone the repository
 $ git clone https://github.com/shaarli/Shaarli.git -b master /path/to/shaarli/
 # install/update third-party dependencies
 $ cd /path/to/shaarli