#title Version 2.5 #teaser **Security fix for untrusted remote repository (2021-06-05)**. File inclusion in Muse documents, extended API, configurable web chat, theme switcher, custom pages under =/p/=, language-specific fonts #cat releases ** Overview The 2.5 series brings in file inclusion in Muse documents, which is detailed in [[/library/file-inclusion][its own page]]. There are no upgrade or backcompatibility issues. ** Changes *** 2.551 2022-05-14 - New "body only" option for custom formats and bookbuilder *** 2.550 2022-05-07 - Correct text/categories redirection status code (make them permanent) - Add URI preview on text creation ([[https://github.com/melmothx/amusewiki/issues/392][GH#392]]) - Add URI rename function ([[https://github.com/melmothx/amusewiki/issues/392][GH#392]]) *** 2.545 2022-04-22 - Fix puzzling crashes on attachment list, federation page and pending revisions. - Implement login by email instead of username (transparent) - Add option to enforce manual URI *** 2.544 2022-03-29 - Update tr and ja i18n. - Bump parser and compiler for == support *** 2.543 2022-03-26 - Improve check on #title upon submitting - Fix startup crash on older distributions ([[https://github.com/melmothx/amusewiki/issues/389][GH#389]]) *** 2.542 2022-03-19 - Remove crawlable OPDS page. This is huge performance and bandwith waste. - Optimize the static indexes production. This will let datatable do the actual table rendering while the app will just provide the JSON data with some predigested HTML. The gain is huge. - Remove the asciified indexing in Xapian. Doing this unconditionally is a mistake. To be restored for selected languages only, in case. *** 2.541 2022-03-12 - Update ja i18n - Optimization for large sites *** 2.540 2022-03-05 - Add federation feature [EXPERIMENTAL] *** 2.535 2022-02-26 - Add paragraph indentation option to custom formats and bookbuilder - Enable ceb and tl languages *** 2.534 2022-02-12 - Bump prerequisites: require amusewiki-texlive - Migrate from polyglossia to babel via Text::Amuse/Text::Amuse::Compile, greatly extending the supported languages. - Add option to use Unicode category names. This should be used when the ASCII category names are not accurate (notably Japanese) - Implement language setting for [[/library/custom-fonts][fonts]] *** 2.533 2021-12-24 - Add proper links to =/console/git-fine-diff= - Add Chinese i18n (without =Text::Amuse= support) *** 2.532 2021-12-19 - Add a new route =/console/git-fine-diff= do compare given commits on a file. *** 2.531 2021-11-21 - Always provide an https:// site. This aligns the behavior to the expected one. Now "Use SSL for authenticated users" means exactly that, i.e. redirect login and authenticated users to https, while so far disabling that would have prevented https altogether. ([[https://github.com/melmothx/amusewiki/issues/385][GH#385]]) *** 2.530 2021-11-20 - Add linespacing PDF option (via Text::Amuse::Compile bump) - Exclude pseudo TLD from Let's Encrypt renewals [[https://github.com/melmothx/amusewiki/issues/385][GH#385]] - Add Esperanto i18n *** 2.522 2021-10-22 - New theme, =amusebaskerville= *** 2.521 2021-10-10 - Fix =/api/latest= missing critical key - Fix =/p/xxx= sitemap and robots *** 2.520 2021-10-10 - Add experimental routes =p/xxx= mapping to =repo/site_files/public/xxx= to build arbitrary custom pages. - add =/api/latest= exposing the title info as JSON *** 2.519 (2021-08-04) - Deny access to git pull logs to anonymous users. This fixes a potential information disclosure (git logs) when using the pulling with a system user. **[SECURITY]** *** 2.518 (2021-08-03) - Fix theme-switcher persistence for non-logged in (reported by =anelki= on the =#amusewiki= channel) *** 2.517 (2021-08-02) - Fix crash on debian package when temporary process is gone ([[https://github.com/melmothx/amusewiki/issues/373][GH#373]]) - Increase paper size values - Prevent db insertion crash on #uid too long ([[https://github.com/melmothx/amusewiki/issues/376][GH#376]]) - New restricted option preventing redirection on aliases to canonical ([[https://github.com/melmothx/amusewiki/issues/377][GH#377]]) - New restricted option to inject nginx configuration snippets into site stanza ([[https://github.com/melmothx/amusewiki/issues/378][GH#378]]) - Theme switcher (dark/light toggler) ([[https://github.com/melmothx/amusewiki/issues/379][GH#379]]) *** 2.516 (2021-06-19) - Display the fail details on compilation failure ([[https://github.com/melmothx/amusewiki/issues/371][GH#371]]) - Support arbitrary margin in the bookbuilder ([[https://github.com/melmothx/amusewiki/issues/372][GH#372]]) - Update texlive install script for TeXlive! 2021 *** 2.515 (2021-06-05) - **[SECURITY]** When pulling a remote git, remove symlinks pointing outside the tree. This is a security patch against potential symlink-based attacks coming from remote repository, tricking the application to access files outside the site root. To be exploited, the flaw, fixed in this release, requires a malicious or naive site administrator pulling from a malicious repository. - Serve symlinks if they point inside the tree. - New option to toggle the display of latest entries on special pages *** 2.514 (2021-05-23) - Fix bug with links which URI doesn't understand (reported by =anelki= on the =#amusewiki= channel) *** 2.513 (2021-05-21) - Do not rely on Freenode for the webchat. Instead, make the iframe url editable. Nothing by default. The iframe with the webchat didn't seem to work anyway. At some point it stopped working. If you set a webchat url, the link to the page with the embedded iframe will always appear in the dropdown menu. On the other hand, the default with the =#amusewiki= channel has been removed. Site admins need to find and set one. - Update i18n strings - AMW-Meta: Implement OPDS *** 2.512 (2021-04-25) - Update i18n: el - Refresh the shared repo's hook when the site is reconfigured *** 2.511 (2021-04-11) - Add Greek I18N - Do not trigger Xapian suggestions if not enabled ([[https://github.com/melmothx/amusewiki/issues/366][GH#366]]) *** 2.510 (2021-04-05) - Add support for images in the API - Add option to keep the layout always fluid - Update I18N: RU (thanks to @link2xt) - Carry on ETag and X-Robots-Tag when serving static files from nginx *** 2.509 (2021-02-27) - Return 410 when the text is deleted without a redirection. - Add /remote/edit/library/xxx and /remote/edit/special/xxx to API *** 2.508 (2021-02-14) - Support =sc= and =sf= inline tags via new =Text::Amuse= *** 2.507 (2021-01-14) - Store and display isbn, publisher, series info, copyright info if provided by the muse document. These fields are documented and display in the generated formats, but were not in the web app. *** 2.506 (2021-01-06) - Save instructions to compile a format into the site repo under =bin= - Add function to check mailing - Add new imposition schema =duplex2up= (=2up= variant) - Make =Authen::SASL= a requirement (for SMTP) *** 2.505 (2020-12-15) - Fix an old bug with the amusewiki restart command not killing the children. - Improve logging for the =/git= route - Improve sorting for revisions page - Add pagination to OPDS category routes (and added custom categories) - Cache =/opds/crawlable= which was too slow - Updated I18N: PL *** 2.504 (2020-11-05) - Updated i18n: BG *** 2.503 (2020-11-05) - Fix support for BG. *** 2.502 (2020-11-05) - Updated i18n (added BG) *** 2.501 (2020-10-29) - Fix access permissions to whitelisted IPs to =/git= and =/mirror= *** 2.500 (2020-10-28) - Support file inclusion [[https://github.com/melmothx/amusewiki/issues/53][GH#53]])