#title Version 2.5 #teaser **Security fix for untrusted remote repository (2021-06-05)**. File inclusion in Muse documents, extended API, configurable web chat, theme switcher, custom pages under =/p/= #cat releases ** Overview The 2.5 series brings in file inclusion in Muse documents, which is detailed in [[/library/file-inclusion][its own page]]. There are no upgrade or backcompatibility issues. ** Changes *** 2.533 2021-12-24 - Add proper links to =/console/git-fine-diff= - Add Chinese i18n (without =Text::Amuse= support) *** 2.532 2021-12-19 - Add a new route =/console/git-fine-diff= do compare given commits on a file. *** 2.531 2021-11-21 - Always provide an https:// site. This aligns the behavior to the expected one. Now "Use SSL for authenticated users" means exactly that, i.e. redirect login and authenticated users to https, while so far disabling that would have prevented https altogether. ([[https://github.com/melmothx/amusewiki/issues/385][GH#385]]) *** 2.530 2021-11-20 - Add linespacing PDF option (via Text::Amuse::Compile bump) - Exclude pseudo TLD from Let's Encrypt renewals [[https://github.com/melmothx/amusewiki/issues/385][GH#385]] - Add Esperanto i18n *** 2.522 2021-10-22 - New theme, =amusebaskerville= *** 2.521 2021-10-10 - Fix =/api/latest= missing critical key - Fix =/p/xxx= sitemap and robots *** 2.520 2021-10-10 - Add experimental routes =p/xxx= mapping to =repo/site_files/public/xxx= to build arbitrary custom pages. - add =/api/latest= exposing the title info as JSON *** 2.519 (2021-08-04) - Deny access to git pull logs to anonymous users. This fixes a potential information disclosure (git logs) when using the pulling with a system user. **[SECURITY]** *** 2.518 (2021-08-03) - Fix theme-switcher persistence for non-logged in (reported by =anelki= on the =#amusewiki= channel) *** 2.517 (2021-08-02) - Fix crash on debian package when temporary process is gone ([[https://github.com/melmothx/amusewiki/issues/373][GH#373]]) - Increase paper size values - Prevent db insertion crash on #uid too long ([[https://github.com/melmothx/amusewiki/issues/376][GH#376]]) - New restricted option preventing redirection on aliases to canonical ([[https://github.com/melmothx/amusewiki/issues/377][GH#377]]) - New restricted option to inject nginx configuration snippets into site stanza ([[https://github.com/melmothx/amusewiki/issues/378][GH#378]]) - Theme switcher (dark/light toggler) ([[https://github.com/melmothx/amusewiki/issues/379][GH#379]]) *** 2.516 (2021-06-19) - Display the fail details on compilation failure ([[https://github.com/melmothx/amusewiki/issues/371][GH#371]]) - Support arbitrary margin in the bookbuilder ([[https://github.com/melmothx/amusewiki/issues/372][GH#372]]) - Update texlive install script for TeXlive! 2021 *** 2.515 (2021-06-05) - **[SECURITY]** When pulling a remote git, remove symlinks pointing outside the tree. This is a security patch against potential symlink-based attacks coming from remote repository, tricking the application to access files outside the site root. To be exploited, the flaw, fixed in this release, requires a malicious or naive site administrator pulling from a malicious repository. - Serve symlinks if they point inside the tree. - New option to toggle the display of latest entries on special pages *** 2.514 (2021-05-23) - Fix bug with links which URI doesn't understand (reported by =anelki= on the =#amusewiki= channel) *** 2.513 (2021-05-21) - Do not rely on Freenode for the webchat. Instead, make the iframe url editable. Nothing by default. The iframe with the webchat didn't seem to work anyway. At some point it stopped working. If you set a webchat url, the link to the page with the embedded iframe will always appear in the dropdown menu. On the other hand, the default with the =#amusewiki= channel has been removed. Site admins need to find and set one. - Update i18n strings - AMW-Meta: Implement OPDS *** 2.512 (2021-04-25) - Update i18n: el - Refresh the shared repo's hook when the site is reconfigured *** 2.511 (2021-04-11) - Add Greek I18N - Do not trigger Xapian suggestions if not enabled ([[https://github.com/melmothx/amusewiki/issues/366][GH#366]]) *** 2.510 (2021-04-05) - Add support for images in the API - Add option to keep the layout always fluid - Update I18N: RU (thanks to @link2xt) - Carry on ETag and X-Robots-Tag when serving static files from nginx *** 2.509 (2021-02-27) - Return 410 when the text is deleted without a redirection. - Add /remote/edit/library/xxx and /remote/edit/special/xxx to API *** 2.508 (2021-02-14) - Support =sc= and =sf= inline tags via new =Text::Amuse= *** 2.507 (2021-01-14) - Store and display isbn, publisher, series info, copyright info if provided by the muse document. These fields are documented and display in the generated formats, but were not in the web app. *** 2.506 (2021-01-06) - Save instructions to compile a format into the site repo under =bin= - Add function to check mailing - Add new imposition schema =duplex2up= (=2up= variant) - Make =Authen::SASL= a requirement (for SMTP) *** 2.505 (2020-12-15) - Fix an old bug with the amusewiki restart command not killing the children. - Improve logging for the =/git= route - Improve sorting for revisions page - Add pagination to OPDS category routes (and added custom categories) - Cache =/opds/crawlable= which was too slow - Updated I18N: PL *** 2.504 (2020-11-05) - Updated i18n: BG *** 2.503 (2020-11-05) - Fix support for BG. *** 2.502 (2020-11-05) - Updated i18n (added BG) *** 2.501 (2020-10-29) - Fix access permissions to whitelisted IPs to =/git= and =/mirror= *** 2.500 (2020-10-28) - Support file inclusion [[https://github.com/melmothx/amusewiki/issues/53][GH#53]])