Changelog History
Page 3
-
v0.26.4 Changes
August 06, 2019Security Release
🚀 The release enhances the security of BookStack in a few different areas:
- ⚡️ Updated user profile behaviour so that users cannot change their email address unless they have permission to manage users. This is to prevent a user acting as an imposter, changing their email to one they don't own. Thanks to @Irrational-NX for raising.
- 👌 Improved the script escaping logic that was enhanced in the previous release, by also checking for iframes using javascript or data urls. Thanks again to @billford for raising this issue. (#1531)
- ⚡️ Updated the provided, and added an additional,
.htaccessfile to prevent apache indexes from listing image directories. Thanks to @davidtessier for raising.
-
v0.26.3 Changes
July 10, 2019 -
v0.26.2 Changes
May 27, 2019🚀 This release contains the following fixes and changes:
- ⚡️ Updated Russian translations. Thanks to @kostefun. (#1446, #1445, #1444, #1443)
- ⚡️ Updated Dutch translations. Thanks to @NootoNooto. (#1437)
- ⚡️ Updated page navigation to exclude empty heading items. (#1429)
- ⚡️ Updated custom-homepage views to display more consistently. (#1423)
- ⚡️ Updated image uploads to resize at double the previous resolution. (#1108)
- 🛠 Fixed issue where chapter description would not show on book export. (#1465)
- 🛠 Fixed page navigation to work on when used on mobile screen sizes. (#1454)
- 🛠 Fixed issue casing a redirect to the 404 page upon login. (#1452)
- 🛠 Fixed missing search bar on mobile search page. (#1450)
- 🛠 Fixed issue where a page could be deleted when previously set as the homepage option. (#1447)
- 🛠 Fixed issue causing horizontal scrollbar to show on some mobile views. (#1441)
- 🛠 Fixed text shown on 'Info' mobile tab being overly faded-out. (#1441)
- 🛠 Fixed issue where some UI elements would shown over the page editor when in mobile full-screen mode. (#1424)
- 🛠 Fixed issue where pasting table content would insert as an image instead of a table or text. (#987)
- 🛠 Fixed issue where book description would not show if it contained multi-byte characters. (#816)
-
v0.26.1 Changes
May 07, 2019🚀 This release contains the following fixes and changes:
- ⚡️ Updated Swedish translations. Thanks to @Hambern. (#1433)
- ⚡️ Updated Spanish translations. Thanks to @moucho. (#1420)
- ⚡️ Updated Ukrainian translations. Thanks to @Mant1kor. (#1419)
- ⚡️ Updated tabbing order on login forms to be consistent and as expected. (#1418)
- 🛠 Fixed issue where "Toggle Details" Button does not properly save state when using the Guest user. (#1431)
- 🛠 Fixed issue where editor image paste, and markdown drawing insert, would fail with an error. (#1428)
- 🛠 Fixed styling of card headers on the 404 page. (#1427)
- 🛠 Fixed issues where Book names could leak via the shelves listing when set as the homepage option. (#1425)
🚀 Special thanks to @Bolthier for providing many good, detailed, bug reports since yesterday's release.
-
v0.26.0 Changes
May 06, 2019🔗 Links
⬆️ Upgrade Notes
👍 Internet Explorer Support - IE11 Support has now been dropped. We may support any critical issues for view-only scenarios otherwise please use a modern browser.
🌐 Translations - Since many interfaces and lines of text have been updated, It may take a little while for some translations to catch-up. Expect to see more English text than usual if you're using a non-English language option.
Images - Due to changes how images are handled, as detailed below, some types of images may become inaccessible. Old logo images will be deleted when changed. Unused Book/Shelf cover images & User profile images will be become inaccessible after the update so you may want to delete them before upgrade.
🔒 Security - On previous versions of BookStack it was possible for users to insert JavaScript via the Markdown editor using
on*html attributes. These will now be removed on page render unless you have setALLOW_CONTENT_SCRIPTS=true. If untrusted users has access to your BookStack you may want to scan for<<space_char>>onin the HTML column of the pages table to identify any malicious intent.Full List of Changes
- ⚡️ Updated the application design for better mobile functionality and improved general UX. (#1153)
- ⚡️ Updated how profile, system & cover images are set & added extra permission checks on image actions. (#1410, #1307, #1128)
- ➕ Added the possibility to create a book directly within a shelf. Thanks to @cw1998. (#1366, #1260)
- ➕ Added sign-up link to login form and fixed differing name validation on sign-up. Thanks to @cw1998. (#1395, #1239)
- ➕ Added code block syntax highlight for OCaml, Haskell, Rust. Thanks to @XVilka. (#1344)
- ⚡️ Updated page content script escaping logic to strip inline JS event attributes. Thanks to @Xiphoseer for reporting.
- ⚡️ Updated revision restore to require confirmation and changed the method from GET so it's less likely to be accidentally triggered. (#1321)
- ⚡️ Updated shortcut used for markdown drawing manager to be cross-platform. (#1228)
- ⚡️ Updated Swedish translations. Thanks to @Hambern. (#1417)
- 🛠 Fixed issue where duplicate ID's could sometimes break pages. (#1393)
- 🛠 Fixed issue where user role assignments were not remembered, for roles with a dot in the name, on validation failure. Thanks to @cw1998. (#1392, #1325)
- 🛠 Fixed issue where the port would be ignored if a full LDAP server URI was used. (#1386, #1278)
- ⬇️ Dropped IE11 support. (#1164)
-
v0.25.5 Changes
March 24, 2019Security Release
🚀 This release works on the changes from v0.25.4 and v0.25.3 to include additional security measures on file uploads.
🚀 For this release, Uploaded image files which have a name that includes more than a single extension are prevented from being uploaded since these could be used to upload executable files on some web-servers. In addition, Attachment uploads are now saved with randomly generated file names to make such upload operations safer to file name exploits.
➕ Additional Changes
🚀 This release also contains the following translation updates:
-
v0.25.4 Changes
March 21, 2019Security Release
🚀 This release patches a security vulnerability that allowed PHP files, using a non-
.phpextension, to be uploaded via image upload endpoints. The PHP files could then be called externally to perform malicious activity.🚀 This is a continuation upon the security updates enforced in v0.25.3. Please see that release for further information on this kind of vulnerability.
⚡️ This update applies a whitelist to file extensions for uploaded images to ensure php-like files, such as
.phtmlor.php3, cannot exploit web servers that execute such files. -
v0.25.3 Changes
March 21, 2019Security Release
🚀 This release patches a security vulnerability that allowed PHP files to be uploaded via image upload endpoints. The PHP files could then be called externally to perform malicious activity.
This is particularly an issue in environments where untrusted users have the necessary permissions to upload images.
⚡️ Please consider that malicious exploitation of this vulnerability may have allowed access to other files on your server that the PHP process has access to, Including your BookStack
.envfile, so consider updating any passwords or keys if you think this had a possibility of being exploited on your instance.⚡️ It is advised you update your BookStack instance as soon as possible.
-
v0.25.2 Changes
March 10, 2019🚀 This release contains the following fixes and changes:
- ➕ Added PowerShell code highlighting to code blocks. Thanks to @christophert. (#1263, #1040)
- ➕ Added LUA code highlighting to code blocks. (#1223)
- ➕ Added LDAP option to set a custom "Display Name" property. Thanks to @dfanara. (#1317, #1306)
- ➕ Added possibility to set a password for Redis connections. (#1283)
- ⚡️ Updated front-end file upload size limit to be configurable. (#1293)
- ⚡️ Updated Dutch translations for the password hint. Thanks to @maantje. (#1314)
- ⚡️ Updated image paste/drop uploads to properly set page relations so image permissions are active. (#1287)
- ⚡️ Updated German translations to include translations for shelves. Thanks to @Xiphoseer. (#1272)
- ⚡️ Updated permissions checked for "Page Copy" function to be more accurate to what permissions are actually required. Thanks to @mark-james. (#1202, #1199)
- ⚡️ Updated permissions checked for the "Shelves" header item to be visible. Now takes into account custom shelve-level permissions. (#1201)
- 🛠 Fixed bug where using alignment properties could break tables. (#1284)
- 🛠 Fixed issue where default system language would not be reflected when viewing another user's profile. (#1316)
- 🛠 Fixed issue where image-manager tooltips could be cut-off. Thanks to @Abijeet. (#1238, #1186)
-
v0.25.1 Changes
January 20, 2019🚀 This release contains the following fixes and changes:
- ⚡️ Updated revision listing so dates can show localised if the relevant locale is installed on the host system. (#1214)
- ➕ Added support for s3 compatible storage services such as Minio. (#1195, #1192)
- ⚡️ Updated Google authentication to not use Google+ API. (#1190)
- 🛠 Fixed "Rubber banding" effect when scrolling in certain conditions when comments were disabled. (#1218)
- 🛠 Fixed isssue causing only show a single page to show when using Firefox's print option. (#1211)