Repository navigation
[WITHDRAWN] HedgeDoc 1.12.1
·
7276 commits
to develop
since this release
1.12.1
ErikMichelson
Erik Michelson
This tag was signed with the committer’s verified signature.
e5f937d
This commit was signed with the committer’s verified signature.
Caution
Due to some bugs with usage on PostgreSQL, we had to pull back this release.
Security fixes
- GHSA-2c27-4x43-jrm6 reports a possible impersonation attack when two auth providers provide the same profile id
- GHSA-g5g7-gfr5-f89m reports a possible crash of the realtime code via an invalid selection.
- GHSA-7p6g-mhrh-286p reports the ability to include unescaped iframes in slides view.
- GHSA-cqg6-86p6-77jm reports a possible timing attack which allows to check whether an email address is registered at the instance.
- GHSA-q9v8-vwgh-x2mc reports missing permissions enforcement for invalid permissions. See GHSA-93w7-49m2-cqwg.
- GHSA-jxrf-wfc5-w77h reports a HTML injection possibility using specially crafted user display names
- GHSA-3fwm-h59w-j268 reports a denial-of-service attack where authenticated users can crash a HedgeDoc instance using a specific note alias
- Several other HTML injection possibilities were fixed
Enhancements
- Added
CMD_OAUTH2_USER_PROFILE_PHOTO_ATTRto let OAuth2/OIDC providers supply a profile photo URL, instead of always falling back to a generated avatar - Updated mermaid to 11.17 which includes many new diagram types
Bugfixes
- Fixed opening links in new tabs did not work for published and slideshow views. This was forgotten with the last fix in 1.12.0.
- Tell the user about an impending data loss immediately after the reconnect.
- Fixed hashtag links opening in new tabs when external link warning is disabled
- Fixed links with the same origin not opening in new tabs when external link warning is enabled
- Fixed crash when importing history entries that already exist
- Fixed text not rendering when placed following a
<br>HTML tag - In "free URL" mode, there is no "409 conflict" anymore when trying to create a note with an alias that parses also as a valid note ID
- Fixed a missing uniqueness constraint in the database for email addresses of local accounts
- Fixed invalid HTML for task lists with checkboxes, clicking the label should now trigger the checkbox as well
- Fixed line numbers in wrapped code blocks being attached to the wrong lines
- Fixed an issue with syntax highlighting in the editor when using
$$math blocks - Fixed a rendering issue, resulting in wrong checkboxes being toggled sometimes
Node compatability
- Node 26 support was tested and is now supported officially.