All Versions
31
Latest Version
Avg Release Cycle
25 days
Latest Release
416 days ago

Changelog History
Page 3

  • v0.26.4 Changes

    August 06, 2019

    Security Release

    โšก๏ธ Update instructions

    ๐Ÿš€ The release enhances the security of BookStack in a few different areas:

    • โšก๏ธ Updated user profile behaviour so that users cannot change their email address unless they have permission to manage users. This is to prevent a user acting as an imposter, changing their email to one they don't own. Thanks to @Irrational-NX for raising.
    • ๐Ÿ‘Œ Improved the script escaping logic that was enhanced in the previous release, by also checking for iframes using javascript or data urls. Thanks again to @billford for raising this issue. (#1531)
    • โšก๏ธ Updated the provided, and added an additional, .htaccess file to prevent apache indexes from listing image directories. Thanks to @davidtessier for raising.
  • v0.26.3 Changes

    July 10, 2019

    Security Release

    ๐Ÿš€ This release improves the escape logic for scripts that have been placed in page content. Thanks to @billford for raising this issue. (#1531)

  • v0.26.2 Changes

    May 27, 2019

    ๐Ÿš€ This release contains the following fixes and changes:

    • โšก๏ธ Updated Russian translations. Thanks to @kostefun. (#1446, #1445, #1444, #1443)
    • โšก๏ธ Updated Dutch translations. Thanks to @NootoNooto. (#1437)
    • โšก๏ธ Updated page navigation to exclude empty heading items. (#1429)
    • โšก๏ธ Updated custom-homepage views to display more consistently. (#1423)
    • โšก๏ธ Updated image uploads to resize at double the previous resolution. (#1108)
    • ๐Ÿ›  Fixed issue where chapter description would not show on book export. (#1465)
    • ๐Ÿ›  Fixed page navigation to work on when used on mobile screen sizes. (#1454)
    • ๐Ÿ›  Fixed issue casing a redirect to the 404 page upon login. (#1452)
    • ๐Ÿ›  Fixed missing search bar on mobile search page. (#1450)
    • ๐Ÿ›  Fixed issue where a page could be deleted when previously set as the homepage option. (#1447)
    • ๐Ÿ›  Fixed issue causing horizontal scrollbar to show on some mobile views. (#1441)
    • ๐Ÿ›  Fixed text shown on 'Info' mobile tab being overly faded-out. (#1441)
    • ๐Ÿ›  Fixed issue where some UI elements would shown over the page editor when in mobile full-screen mode. (#1424)
    • ๐Ÿ›  Fixed issue where pasting table content would insert as an image instead of a table or text. (#987)
    • ๐Ÿ›  Fixed issue where book description would not show if it contained multi-byte characters. (#816)
  • v0.26.1 Changes

    May 07, 2019

    ๐Ÿš€ This release contains the following fixes and changes:

    • โšก๏ธ Updated Swedish translations. Thanks to @Hambern. (#1433)
    • โšก๏ธ Updated Spanish translations. Thanks to @moucho. (#1420)
    • โšก๏ธ Updated Ukrainian translations. Thanks to @Mant1kor. (#1419)
    • โšก๏ธ Updated tabbing order on login forms to be consistent and as expected. (#1418)
    • ๐Ÿ›  Fixed issue where "Toggle Details" Button does not properly save state when using the Guest user. (#1431)
    • ๐Ÿ›  Fixed issue where editor image paste, and markdown drawing insert, would fail with an error. (#1428)
    • ๐Ÿ›  Fixed styling of card headers on the 404 page. (#1427)
    • ๐Ÿ›  Fixed issues where Book names could leak via the shelves listing when set as the homepage option. (#1425)

    ๐Ÿš€ Special thanks to @Bolthier for providing many good, detailed, bug reports since yesterday's release.

  • v0.26.0 Changes

    May 06, 2019

    ๐Ÿ”— Links

    โฌ†๏ธ Upgrade Notes

    ๐Ÿ‘ Internet Explorer Support - IE11 Support has now been dropped. We may support any critical issues for view-only scenarios otherwise please use a modern browser.

    ๐ŸŒ Translations - Since many interfaces and lines of text have been updated, It may take a little while for some translations to catch-up. Expect to see more English text than usual if you're using a non-English language option.

    Images - Due to changes how images are handled, as detailed below, some types of images may become inaccessible. Old logo images will be deleted when changed. Unused Book/Shelf cover images & User profile images will be become inaccessible after the update so you may want to delete them before upgrade.

    ๐Ÿ”’ Security - On previous versions of BookStack it was possible for users to insert JavaScript via the Markdown editor using on* html attributes. These will now be removed on page render unless you have set ALLOW_CONTENT_SCRIPTS=true. If untrusted users has access to your BookStack you may want to scan for <<space_char>>on in the HTML column of the pages table to identify any malicious intent.

    Full List of Changes

    • โšก๏ธ Updated the application design for better mobile functionality and improved general UX. (#1153)
    • โšก๏ธ Updated how profile, system & cover images are set & added extra permission checks on image actions. (#1410, #1307, #1128)
    • โž• Added the possibility to create a book directly within a shelf. Thanks to @cw1998. (#1366, #1260)
    • โž• Added sign-up link to login form and fixed differing name validation on sign-up. Thanks to @cw1998. (#1395, #1239)
    • โž• Added code block syntax highlight for OCaml, Haskell, Rust. Thanks to @XVilka. (#1344)
    • โšก๏ธ Updated page content script escaping logic to strip inline JS event attributes. Thanks to @Xiphoseer for reporting.
    • โšก๏ธ Updated revision restore to require confirmation and changed the method from GET so it's less likely to be accidentally triggered. (#1321)
    • โšก๏ธ Updated shortcut used for markdown drawing manager to be cross-platform. (#1228)
    • โšก๏ธ Updated Swedish translations. Thanks to @Hambern. (#1417)
    • ๐Ÿ›  Fixed issue where duplicate ID's could sometimes break pages. (#1393)
    • ๐Ÿ›  Fixed issue where user role assignments were not remembered, for roles with a dot in the name, on validation failure. Thanks to @cw1998. (#1392, #1325)
    • ๐Ÿ›  Fixed issue where the port would be ignored if a full LDAP server URI was used. (#1386, #1278)
    • โฌ‡๏ธ Dropped IE11 support. (#1164)
  • v0.25.5 Changes

    March 24, 2019

    Security Release

    ๐Ÿš€ This release works on the changes from v0.25.4 and v0.25.3 to include additional security measures on file uploads.

    ๐Ÿš€ For this release, Uploaded image files which have a name that includes more than a single extension are prevented from being uploaded since these could be used to upload executable files on some web-servers. In addition, Attachment uploads are now saved with randomly generated file names to make such upload operations safer to file name exploits.

    โž• Additional Changes

    ๐Ÿš€ This release also contains the following translation updates:

    • โž• Added Czech translations. Thanks to @cima. (#1347)
    • โšก๏ธ Updated russian translations . Thanks to @agvol. (#1348)
    • โšก๏ธ Updated 'Spanish Argentina' translation. Thanks to @leomartinez. (#1327)
  • v0.25.4 Changes

    March 21, 2019

    Security Release

    ๐Ÿš€ This release patches a security vulnerability that allowed PHP files, using a non-.php extension, to be uploaded via image upload endpoints. The PHP files could then be called externally to perform malicious activity.

    ๐Ÿš€ This is a continuation upon the security updates enforced in v0.25.3. Please see that release for further information on this kind of vulnerability.

    โšก๏ธ This update applies a whitelist to file extensions for uploaded images to ensure php-like files, such as .phtml or .php3, cannot exploit web servers that execute such files.

  • v0.25.3 Changes

    March 21, 2019

    Security Release

    ๐Ÿš€ This release patches a security vulnerability that allowed PHP files to be uploaded via image upload endpoints. The PHP files could then be called externally to perform malicious activity.

    This is particularly an issue in environments where untrusted users have the necessary permissions to upload images.

    โšก๏ธ Please consider that malicious exploitation of this vulnerability may have allowed access to other files on your server that the PHP process has access to, Including your BookStack .env file, so consider updating any passwords or keys if you think this had a possibility of being exploited on your instance.

    โšก๏ธ It is advised you update your BookStack instance as soon as possible.

  • v0.25.2 Changes

    March 10, 2019

    ๐Ÿš€ This release contains the following fixes and changes:

    • โž• Added PowerShell code highlighting to code blocks. Thanks to @christophert. (#1263, #1040)
    • โž• Added LUA code highlighting to code blocks. (#1223)
    • โž• Added LDAP option to set a custom "Display Name" property. Thanks to @dfanara. (#1317, #1306)
    • โž• Added possibility to set a password for Redis connections. (#1283)
    • โšก๏ธ Updated front-end file upload size limit to be configurable. (#1293)
    • โšก๏ธ Updated Dutch translations for the password hint. Thanks to @maantje. (#1314)
    • โšก๏ธ Updated image paste/drop uploads to properly set page relations so image permissions are active. (#1287)
    • โšก๏ธ Updated German translations to include translations for shelves. Thanks to @Xiphoseer. (#1272)
    • โšก๏ธ Updated permissions checked for "Page Copy" function to be more accurate to what permissions are actually required. Thanks to @mark-james. (#1202, #1199)
    • โšก๏ธ Updated permissions checked for the "Shelves" header item to be visible. Now takes into account custom shelve-level permissions. (#1201)
    • ๐Ÿ›  Fixed bug where using alignment properties could break tables. (#1284)
    • ๐Ÿ›  Fixed issue where default system language would not be reflected when viewing another user's profile. (#1316)
    • ๐Ÿ›  Fixed issue where image-manager tooltips could be cut-off. Thanks to @Abijeet. (#1238, #1186)
  • v0.25.1 Changes

    January 20, 2019

    ๐Ÿš€ This release contains the following fixes and changes:

    • โšก๏ธ Updated revision listing so dates can show localised if the relevant locale is installed on the host system. (#1214)
    • โž• Added support for s3 compatible storage services such as Minio. (#1195, #1192)
    • โšก๏ธ Updated Google authentication to not use Google+ API. (#1190)
    • ๐Ÿ›  Fixed "Rubber banding" effect when scrolling in certain conditions when comments were disabled. (#1218)
    • ๐Ÿ›  Fixed isssue causing only show a single page to show when using Firefox's print option. (#1211)