Repository navigation
Tags
Tags
HedgeDoc 1.12.1 - 2026-11-04 Security fixes - [GHSA-2c27-4x43-jrm6](GHSA-2c27-4x43-jrm6) reports a possible impersonation attack when two auth providers provide the same profile id - [GHSA-g5g7-gfr5-f89m](GHSA-g5g7-gfr5-f89m) reports a possible crash of the realtime code via an invalid selection. - [GHSA-7p6g-mhrh-286p](GHSA-7p6g-mhrh-286p) reports the ability to include unescaped iframes in slides view. - [GHSA-cqg6-86p6-77jm](GHSA-cqg6-86p6-77jm) reports a possible timing attack which allows to check whether an email address is registered at the instance. - [GHSA-q9v8-vwgh-x2mc](GHSA-q9v8-vwgh-x2mc) reports missing permissions enforcement for invalid permissions. See [GHSA-93w7-49m2-cqwg](GHSA-93w7-49m2-cqwg). - [GHSA-jxrf-wfc5-w77h](GHSA-jxrf-wfc5-w77h) reports a HTML injection possibility using specially crafted user display names - [GHSA-3fwm-h59w-j268](GHSA-3fwm-h59w-j268) reports a denial-of-service attack where authenticated users can crash a HedgeDoc instance using a specific note alias - Several other HTML injection possibilities were fixed Enhancements - Added `CMD_OAUTH2_USER_PROFILE_PHOTO_ATTR` to let OAuth2/OIDC providers supply a profile photo URL, instead of always falling back to a generated avatar - Updated mermaid to 11.17 which includes many new diagram types Bugfixes - Fixed opening links in new tabs did not work for published and slideshow views. This was forgotten with the last fix in 1.12.0. - Tell the user about an impending data loss immediately after the reconnect. - Fixed hashtag links opening in new tabs when external link warning is disabled - Fixed links with the same origin not opening in new tabs when external link warning is enabled - Fixed crash when importing history entries that already exist - Fixed text not rendering when placed following a `<br>` HTML tag - In "free URL" mode, there is no "409 conflict" anymore when trying to create a note with an alias that parses also as a valid note ID - Fixed a missing uniqueness constraint in the database for email addresses of local accounts - Fixed invalid HTML for task lists with checkboxes, clicking the label should now trigger the checkbox as well - Fixed line numbers in wrapped code blocks being attached to the wrong lines - Fixed an issue with syntax highlighting in the editor when using `$$` math blocks - Fixed a rendering issue, resulting in wrong checkboxes being toggled sometimes Node compatability - Node 26 support was tested and is now supported officially. Contributors - [Anant Kumar](https://github.com/AnantKumarTyagi) - [Chris Ellrich](https://github.com/chrellrich) - [Stephan](https://github.com/sadfu) - [Vaibhav Srivastav](https://github.com/vaibhav8a)
fix(permissions): ignore unknown permission values The permission checks did not check for unknown permission values submitted to the server. This allowed bypassing permission checks under certain circumstances. However, this is not as critical as it might sound at first, since checks guard that only the owner can modify note permissions and the owner already has always full permission to their note. Signed-off-by: Erik Michelson <github@erik.michelson.eu>
PreviousNext