From fc2beb8c6aa4d423b55ba95809941f2eba6fea2a Mon Sep 17 00:00:00 2001 From: nodiscc Date: Mon, 23 Oct 2017 01:06:11 +0200 Subject: Changelog: link to CVE-2017-15215, give attribution --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'CHANGELOG.md') diff --git a/CHANGELOG.md b/CHANGELOG.md index 120c5d22..33feac20 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -40,7 +40,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/). ### Security -- Vulnerability introduced in v0.9.1 fixed. +- Fixed reflected XSS vulnerability introduced in v0.9.1, discovered by @chb9 ([CVE-2017-15215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15215)). ## [v0.9.1](https://github.com/shaarli/Shaarli/releases/tag/v0.9.1) - 2017-08-23 -- cgit v1.2.3 From f452d3c4dff32003e7be10b3704bd4b1e23d7ad4 Mon Sep 17 00:00:00 2001 From: VirtualTam Date: Thu, 4 Jan 2018 18:49:05 +0100 Subject: Update CHANGELOG, README badges and installation instructions Signed-off-by: VirtualTam --- CHANGELOG.md | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) (limited to 'CHANGELOG.md') diff --git a/CHANGELOG.md b/CHANGELOG.md index 33feac20..b823ba70 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). +## [v0.9.3](https://github.com/shaarli/Shaarli/releases/tag/v0.9.3) - 2018-01-04 +**XSS vulnerability fixed. Please update.** + +## Security +- Fix an XSS (cross-site-scripting) vulnerability in `index.php` + + ## [v0.9.2](https://github.com/shaarli/Shaarli/releases/tag/v0.9.2) - 2017-10-07 **Major security issue fixed. Please update.** @@ -42,6 +49,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/). - Fixed reflected XSS vulnerability introduced in v0.9.1, discovered by @chb9 ([CVE-2017-15215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15215)). + ## [v0.9.1](https://github.com/shaarli/Shaarli/releases/tag/v0.9.1) - 2017-08-23 The documentation has been migrated to ReadTheDocs: @@ -115,7 +123,7 @@ Theming: - Introduce a new theme - Allow selecting themes/templates from the configuration page - New/Edit link form can be submitted using CTRL+Enter in the textarea - - Shaarli version is displayed in the footer when logged in + - Shaarli version is displayed in the footer when logged in - Add plugin placeholders to Atom/RSS feed templates - Add OpenSearch to feed templates - Add `campaign_` to the URL cleanup pattern list @@ -145,7 +153,7 @@ Theming: - Improved date time display depending on the locale - Partial namespace support for Shaarli classes - Shaarli version is now only present in `shaarli_version.php` -- Human readable maximum file size upload +- Human readable maximum file size upload ### Removed @@ -171,6 +179,12 @@ Theming: - Markdown plugin: escape HTML entities by default +## [v0.8.5](https://github.com/shaarli/Shaarli/releases/tag/v0.8.5) - 2018-01-04 +**XSS vulnerability fixed. Please update.** + +## Security +- Fix an XSS (cross-site-scripting) vulnerability in `index.php` + ## [v0.8.4](https://github.com/shaarli/Shaarli/releases/tag/v0.8.4) - 2017-03-04 ### Security - Markdown plugin: escape HTML entities by default @@ -186,7 +200,7 @@ Theming: ## [v0.8.1](https://github.com/shaarli/Shaarli/releases/tag/v0.8.1) - 2016-12-12 -> Note: this version will create an automatic backup of your database if anything goes wrong. +> Note: this version will create an automatic backup of your database if anything goes wrong. ### Added - Add CHANGELOG.md to track the whole project's history @@ -203,7 +217,7 @@ Theming: - Link ID complete refactoring: - Links now have a numeric ID instead of dates - Short URLs are now created once and can't change over time (previous URL are kept) -- Templates: +- Templates: - Changed placeholder behaviour for: `buttons_toolbar`, `fields_toolbar` and `action_plugin` - Cleanup `{loop}` declarations in templates - Tools: hide Firefox Social button when not in HTTPS @@ -221,7 +235,7 @@ Theming: - Plugins: - Tools: only display parameter description when it exists - archive.org: do not propose archival of private notes - - Markdown: + - Markdown: - render links properly in code blocks - bug regarding the `nomarkdown` tag - W3C compliance @@ -360,7 +374,7 @@ Please use our release archives, or follow the ### Fixed - Fix a bug where renaming a tag was causing a 404 - Fix a bug allowing to search blank terms -- Fix a bug preventing to remove a tag with special chars when searching +- Fix a bug preventing to remove a tag with special chars when searching ## [v0.6.2](https://github.com/shaarli/Shaarli/releases/tag/v0.6.2) - 2015-12-23 @@ -666,7 +680,7 @@ Initial release on GitHub. - When you click the key to see only private links, it turns yellow ### Changed -- The "Daily" page now automatically skips empty days. +- The "Daily" page now automatically skips empty days. ### Fixed - Corrected the tag encoding (there was a bug when selecting a second tag which contains accented characters) @@ -964,7 +978,7 @@ Initial release on GitHub. - Nicer timezone selection patch by killruana ### Fixed -- New lines now appear correctly in the RSS feed descriptions. +- New lines now appear correctly in the RSS feed descriptions. ## [v0.0.17beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) @@ -1018,7 +1032,7 @@ Initial release on GitHub. ## [v0.0.14beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) ### Added - You no longer need to disable `magic_quotes` on your host. - Shaarli will cope with this option beeing activated. + Shaarli will cope with this option beeing activated. ## [v0.0.13beta](http://sebsauvage.net/wiki/doku.php?id=php:shaarli:history) -- cgit v1.2.3 From 8d9d4cc1ee1a30fac8fad3c3032ffff6c1eb80e2 Mon Sep 17 00:00:00 2001 From: VirtualTam Date: Sat, 6 Jan 2018 15:31:25 +0100 Subject: Reference CVE-2018-5249 in CHANGELOG Relates to https://github.com/shaarli/Shaarli/pull/1046 Signed-off-by: VirtualTam --- CHANGELOG.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'CHANGELOG.md') diff --git a/CHANGELOG.md b/CHANGELOG.md index b823ba70..6947427b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/). **XSS vulnerability fixed. Please update.** ## Security -- Fix an XSS (cross-site-scripting) vulnerability in `index.php` +- Fix an XSS (cross-site-scripting) vulnerability in `index.php` - + [CVE-2018-5249](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5249) ## [v0.9.2](https://github.com/shaarli/Shaarli/releases/tag/v0.9.2) - 2017-10-07 @@ -183,7 +184,8 @@ Theming: **XSS vulnerability fixed. Please update.** ## Security -- Fix an XSS (cross-site-scripting) vulnerability in `index.php` +- Fix an XSS (cross-site-scripting) vulnerability in `index.php` - + [CVE-2018-5249](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5249) ## [v0.8.4](https://github.com/shaarli/Shaarli/releases/tag/v0.8.4) - 2017-03-04 ### Security -- cgit v1.2.3 From 9b6df5c91c61eab73bebc37a9d42757b97224e4e Mon Sep 17 00:00:00 2001 From: VirtualTam Date: Wed, 10 Jan 2018 20:42:05 +0100 Subject: Update CHANGELOG for the next v0.9.x Signed-off-by: VirtualTam --- CHANGELOG.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) (limited to 'CHANGELOG.md') diff --git a/CHANGELOG.md b/CHANGELOG.md index 6947427b..47a902f0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,33 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). +## [v0.9.4](https://github.com/shaarli/Shaarli/releases/tag/v0.9.4) - UNPUBLISHED +### Added +- Enable translations: Shaarli is now also available in French. Other language translations are welcome! +- Add EditorConfig configuration +- Add favicons for mobile devices +- Add Alpine Linux arm32v7 Dockerfiles (master, latest) + +### Changed +- Do not write bookmark edition history during file imports (performance) +- Migrate Docker images (master, latest) to Alpine Linux +- Improve unitary tests and code coverage +- Improve thumbnail display +- Improve theme ergonomics +- Improve messages if there is no plugin or parameter available in the admin page +- Increase buffer size for cURL download +- Force HTTPS if the original port is 443 behind a reverse proxy (workaround) + +### Removed +- Remove redirector setting from Configure page + +### Fixed +- Fix broken links in the documentation +- Enable access to `data/user.css` (Apache 2.2 & 2.4) +- Don't URL encode description links if parameter `redirector.encode_url` is set to false +- Fix an issue preventing the Save button to appear for plugin parameters + + ## [v0.9.3](https://github.com/shaarli/Shaarli/releases/tag/v0.9.3) - 2018-01-04 **XSS vulnerability fixed. Please update.** -- cgit v1.2.3 From f211618f201a8af3f7a52c3995747dcfc34b8f3f Mon Sep 17 00:00:00 2001 From: ArthurHoaro Date: Tue, 30 Jan 2018 18:49:22 +0100 Subject: Update CHANGELOG --- CHANGELOG.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'CHANGELOG.md') diff --git a/CHANGELOG.md b/CHANGELOG.md index 47a902f0..aef32fcf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,9 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). -## [v0.9.4](https://github.com/shaarli/Shaarli/releases/tag/v0.9.4) - UNPUBLISHED +## [v0.10.0](https://github.com/shaarli/Shaarli/releases/tag/v0.10.0) - UNPUBLISHED + +## [v0.9.4](https://github.com/shaarli/Shaarli/releases/tag/v0.9.4) - 2018-01-30 ### Added - Enable translations: Shaarli is now also available in French. Other language translations are welcome! - Add EditorConfig configuration @@ -20,6 +22,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/). - Improve messages if there is no plugin or parameter available in the admin page - Increase buffer size for cURL download - Force HTTPS if the original port is 443 behind a reverse proxy (workaround) +- Improve page title retrieval performances ### Removed - Remove redirector setting from Configure page -- cgit v1.2.3