#title Version 2.5
#teaser  **Security fix for untrusted remote repository (2021-06-05)**. File inclusion in Muse documents, extended API, configurable web chat.
#cat releases

** Overview

The 2.5 series brings in file inclusion in Muse documents, which is
detailed in [[/library/file-inclusion][its own page]].

There are no upgrade or backcompatibility issues.

** Changes

*** 2.516 (2021-06-19)

 - Display the fail details on compilation failure
   ([[https://github.com/melmothx/amusewiki/issues/371][GH#371]])
 - Support arbitrary margin in the bookbuilder
   ([[https://github.com/melmothx/amusewiki/issues/372][GH#372]])
 - Update texlive install script for TeXlive! 2021

*** 2.515 (2021-06-05)

 - **[SECURITY]** When pulling a remote git, remove symlinks pointing
   outside the tree. This is a security patch against potential
   symlink-based attacks coming from remote repository, tricking the
   application to access files outside the site root.

   To be exploited, the flaw, fixed in this release, requires a
   malicious or naive site administrator pulling from a malicious
   repository.

 - Serve symlinks if they point inside the tree.

 - New option to toggle the display of latest entries on special pages


*** 2.514 (2021-05-23)

 - Fix bug with links which URI doesn't understand (reported by
   =anelki= on the =#amusewiki= channel)


*** 2.513 (2021-05-21)

 - Do not rely on Freenode for the webchat. Instead, make the iframe
   url editable. Nothing by default. The iframe with the webchat
   didn't seem to work anyway. At some point it stopped working. If
   you set a webchat url, the link to the page with the embedded
   iframe will always appear in the dropdown menu. On the other hand,
   the default with the =#amusewiki= channel has been removed. Site
   admins need to find and set one.
 - Update i18n strings
 - AMW-Meta: Implement OPDS

*** 2.512 (2021-04-25)

 - Update i18n: el
 - Refresh the shared repo's hook when the site is reconfigured

*** 2.511 (2021-04-11)

 - Add Greek I18N
 - Do not trigger Xapian suggestions if not enabled ([[https://github.com/melmothx/amusewiki/issues/366][GH#366]])

*** 2.510 (2021-04-05)

 - Add support for images in the API
 - Add option to keep the layout always fluid
 - Update I18N: RU (thanks to @link2xt)
 - Carry on ETag and X-Robots-Tag when serving static files from nginx

*** 2.509 (2021-02-27)

 - Return 410 when the text is deleted without a redirection.
 - Add /remote/edit/library/xxx and /remote/edit/special/xxx
   to API


*** 2.508 (2021-02-14)

 - Support =sc= and =sf= inline tags via new =Text::Amuse=

*** 2.507 (2021-01-14)

 - Store and display isbn, publisher, series info, copyright info if
   provided by the muse document. These fields are documented and
   display in the generated formats, but were not in the web app.

*** 2.506 (2021-01-06)

 - Save instructions to compile a format into the site repo under =bin=
 - Add function to check mailing
 - Add new imposition schema =duplex2up= (=2up= variant)
 - Make =Authen::SASL= a requirement (for SMTP)


*** 2.505 (2020-12-15)

 - Fix an old bug with the amusewiki restart command not killing the
   children.
 - Improve logging for the =/git= route
 - Improve sorting for revisions page
 - Add pagination to OPDS category routes (and added custom categories)
 - Cache =/opds/crawlable= which was too slow
 - Updated I18N: PL

*** 2.504 (2020-11-05)

 - Updated i18n: BG

*** 2.503 (2020-11-05)

 - Fix support for BG.

*** 2.502 (2020-11-05)

 - Updated i18n (added BG)

*** 2.501 (2020-10-29)

 - Fix access permissions to whitelisted IPs to =/git= and =/mirror=


*** 2.500 (2020-10-28)

 - Support file inclusion [[https://github.com/melmothx/amusewiki/issues/53][GH#53]])