File etherpad-lite.changes of Package etherpad-lite

Overview Repositories Revisions Requests Users Attributes Meta

File etherpad-lite.changes of Package etherpad-lite (Revision c4a64c8532108a8ccf71f3be4b1057f9)

Currently displaying revision c4a64c8532108a8ccf71f3be4b1057f9 , Show latest

-------------------------------------------------------------------
Mon Dec 28 19:06:05 UTC 2020 - Lars Vogdt <lars@linux-schulserver.de>

- update to 1.8.7
  Compatibility-breaking changes
  * IMPORTANT: It is no longer possible to protect a group pad with a
    password. All API calls to setPassword or isPasswordProtected will fail.
    Existing group pads that were previously password protected will no longer be
    password protected. If you need fine-grained access control, you can restrict
    API session creation in your frontend service, or you can use plugins.
  * All workarounds for Microsoft Internet Explorer have been removed. IE might
    still work, but it is untested.
  * Plugin hook functions are now subject to new sanity checks. Buggy hook
    functions will cause an error message to be logged
  * Authorization failures now return 403 by default instead of 401
  * The authorize hook is now only called after successful authentication. Use
    the new preAuthorize hook if you need to bypass authentication
  * The authFailure hook is deprecated; use the new authnFailure and
    authzFailure hooks instead
  * The indexCustomInlineScripts hook was removed
  * The client context property for the handleMessage and
    handleMessageSecurity hooks has been renamed to socket (the old name is
    still usable but deprecated)
  * The aceAttribClasses hook functions are now called synchronously
  * The format of ENTER, CREATE, and LEAVE log messages has changed
  * Strings passed to $.gritter.add() are now expected to be plain text, not
    HTML. Use jQuery or DOM objects if you need formatting
  Notable new features
  * Users can now import without creating and editing the pad first
  * Added a new readOnly user setting that makes it possible to create users in
    settings.json that can read pads but not create or modify them
  * Added a new canCreate user setting that makes it possible to create users in
    settings.json that can modify pads but not create them
  * The authorize hook now accepts readOnly to grant read-only access to a pad
  * The authorize hook now accepts modify to grant modify-only (creation
    prohibited) access to a pad
  * All authentication successes and failures are now logged
  * Added a new cookie.sameSite setting that makes it possible to enable
    authentication when Etherpad is embedded in an iframe from another site
  * New exportHTMLAdditionalContent hook to include additional HTML content
  * New exportEtherpadAdditionalContent hook to include additional database
    content in .etherpad exports
  * New expressCloseServer hook to close Express when required
  * The padUpdate hook context now includes revs and changeset
    checkPlugins.js has various improvements to help plugin developers
  * The HTTP request object (and therefore the express-session state) is now
    accessible from within most eejsBlock_* hooks
  * Users without a password or hash property in settings.json are no longer
    ignored, so they can now be used by authentication plugins
  * New permission denied modal and block permissionDenied
    Plugins are now updated to the latest version instead of minor or patches
  Notable fixes
  * Fixed rate limit accounting when Etherpad is behind a reverse proxy
  * Fixed typos that prevented access to pads via an HTTP API session
  * Fixed authorization failures for pad URLs containing a percent-encoded
    character
  * Fixed exporting of read-only pads
  * Passwords are no longer written to connection state database entries or logged
    in debug logs
  * When using the keyboard to navigate through the toolbar buttons the button
    with the focus is now highlighted
  * Fixed support for Node.js 10 by passing the --experimental-worker flag
  * Fixed export of HTML attributes within a line
  * Fixed occasional "Cannot read property 'offsetTop' of undefined" error in
    timeslider when "follow pad contents" is checked
    socket.io errors are now displayed instead of silently ignored
  * Pasting while the caret is in a link now works (except for middle-click paste
    on X11 systems)
  * Removal of Microsoft Internet Explorer specific code
  * Import better handles line breaks and white space
  * Fix issue with createDiffHTML incorrect call of getInternalRevisionAText
  * Allow additional characters in URLs
  * MySQL engine fix and various other UeberDB updates (See UeberDB changelog).
  * Admin UI improvements on search results (to remove duplicate items)
  * Removal of unused cruft from clientVars (ip and userAgent)
  Minor changes
  * Temporary disconnections no longer force a full page refresh
  * Toolbar layout for narrow screens is improved
  * Fixed SameSite cookie attribute for the language, token, and pref
    cookies
  * Fixed superfluous database accesses when deleting a pad
  * Expanded test coverage.
  * package-lock.json is now lint checked on commit
  * Various lint fixes/modernization of code
- refreshed node_modules tarball
- refreshed patches:
  + etherpad-lite_abiword_missing_AbiCommand.patch
  + etherpad-lite_avoid_getGitCommit_call.patch
  + etherpad-lite_default_config.patch
  + etherpad-lite_move_autogenerated_key_files_to_var.patch

-------------------------------------------------------------------
Thu Oct 15 15:26:20 UTC 2020 - Lars Vogdt <lars@linux-schulserver.de>

- update to 1.8.6
  IMPORTANT: This fixes a severe problem with postgresql in 1.8.5
  SECURITY: Fix authentication bypass vulnerability
  API: Update version to 1.2.15
  FEATURE: Add copyPadWithoutHistory API (#4295)
  FEATURE: Package more asset files to save http requests (#4286)
  MINOR: Improve UI when reconnecting
  TESTS: Improve tests
- refreshed/renamed all patches
- refreshed node_modules tarball

-------------------------------------------------------------------
Wed Sep 16 18:35:28 UTC 2020 - Lars Vogdt <lars@linux-schulserver.de>

- update to 1.8.5
  IMPORTANT DROP OF SUPPORT: Drop support for IE. Browsers now need async/await.
  IMPORTANT SECURITY: Rate limit Commits when env=production
  SECURITY: Non completed uploads no longer crash Etherpad
  SECURITY: Log authentication requests
  FEATURE: Support ES6 (migrate from Uglify-JS to Terser)
  FEATURE: Improve support for non-cookie enabled browsers
  FEATURE: New hooks for index.html
  FEATURE: New script to delete sessions.
  FEATURE: New setting to allow import withing an author session on a pad
  FEATURE: Checks Etherpad version on startup and notifies if update 
  is available. Also available in /admin interface.
  FEATURE: Timeslider updates pad location to most recent edit
  MINOR: Outdent UL/LI items on removal of list item
  MINOR: Various UL/LI import/export bugs
  MINOR: PDF export fix
  MINOR: Front end tests no longer run (and subsequently error) on pull requests
  MINOR: Fix issue with
  closing a list before it opens
  MINOR: Fix bug where large pads would fire a console error in timeslider
  MINOR: Fix ?showChat URL param issue
  MINOR: Issue where timeslider URI fails to be correct if padID is numeric
  MINOR: Include prompt for clear authorship when entire document is selected
  MINOR: Include full document aText every 100 revisions to make 
  pad restoration on database curruption achievable
  MINOR: Several Colibris CSS fixes
  MINOR: Use mime library for mime types instead of hard-coded.
  MINOR: Don't show "new pad button" if instance is read only
  MINOR: Use latest NodeJS when doing Windows build
  MINOR: Change disconnect logic to reconnect instead of silently failing
  MINOR: Update SocketIO, async, jQuery and Mocha which were stuck due to stale code.
  MINOR: Rewrite the majority of the bin scripts to use more modern syntax
  MINOR: Improved CSS anomation through prefers-reduced-motion
  PERFORMANCE: Use workers (where possible) to minify CSS/JS on
  first page request. This improves initial startup times.
  PERFORMANCE: Cache EJS files improving page load speed when maxAge > 0.
  PERFORMANCE: Fix performance for large pads
  TESTS: Additional test coverage for OL/LI/Import/Export
  TESTS: Include Simulated Load Testing in CI.
  TESTS: Include content collector tests to test contentcollector.js
  logic external to pad dependents.
  TESTS: Include fuzzing import test.
  TESTS: Ensure CI is no longer using any cache
  TESTS: Fix various tests...
  TESTS: Various additional Travis testing including libreoffice import/export
- refreshed all patches

-------------------------------------------------------------------
Fri May 29 09:45:51 UTC 2020 - Lars Vogdt <lars@linux-schulserver.de>

- added etherpad-lite-1.8.4-abiword_missing_AbiCommand.patch:
  + looks like the latest abiword 3.0.2 on Leap 15.1 does not work 
    together with etherpad-lite: "Plugin AbiCommand not found or loaded"
    => this patch simply falls back to the '--to' commandline 
       option of abiword to get the export done

-------------------------------------------------------------------
Wed May 27 09:39:09 UTC 2020 - Lars Vogdt <lars@linux-schulserver.de>

- update to 1.8.4
  This is a maintenance release after 1.8.3.
  Users relying on MySQL are particularly encouraged to upgrade.
  FIX: fix a performance regression on MySQL introduced in 1.8.3
  FIX: when running behind a reverse proxy and exposed in an inner directory, 
  fonts and toolbar icons should now be visible. 
  This is a regression introduced in 1.8.3
  FIX: cleanups in the UI after the CSS rehaul of 1.8.3
  MINOR: protect against bugged/stale UI elements after updates. An explicit
  cache busting via random query string is performed at each start. 
  This needs to be replaced with hashed names in static assets.
  MINOR: improved some tests
  MINOR: fixed long-standing bugs in the maintenance tools in /bin 
  (migrateDirtyDBtoRealDB, rebuildPad, convert, importSqlFile)
  from 1.8.3:
  FEATURE: colibris is now the default skin for new installs
  FEATURE: improved colibris visuals, and migrated to Flexbox layout
  FEATURE: skin variants: colibris skin colors can be easily customized. 
  Visit http://127.0.0.1:9001/p/test#skinvariantsbuilder
  REQUIREMENTS: minimum required Node version is 10.13.0 LTS.
  MINOR: stability fixes for the async migration in 1.8.0 
  (fixed many UnhandledPromiseRejectionWarning and the few remaining crashes)
  MINOR: improved stability of import/export functionality
  MINOR: fixed many small UI quirks (timeslider, import/export, chat)
  MINOR: Docker images are now built & run in production mode by default
  MINOR: reduced the size of the Docker images
  MINOR: better documented cookies and configuration parameters of the Docker image
  MINOR: better database support (especially MySQL)
  MINOR: additional test coverage
  MINOR: restored compatibility with ep_hash_auth
  MINOR: migrate from swagger-node-express to openapi-backend
  MINOR: honor the Accept-Language HTTP headers sent by browsers, eventually serving language variants
  PERFORMANCE: correctly send HTTP/304 for minified files
  SECURITY: bumped many dependencies. At the time of the release, this 
  version has 0 reported vulnerabilities by npm audit
  SECURITY: never send referrer when opening a link
  SECURITY: rate limit imports and exports
  SECURITY: do not allow pad import if a user never contributed to that pad
  SECURITY: expose configuration parameter for limiting max import size
  BREAKING CHANGE: undoing the "clear authorship colors" command is no
  longer supported (see #2802)
  BREAKING CHANGE: the visuals and CSS structure of the page was updated.
  Plugins may need a CSS rehaul
- refreshed modules tarball
- added etherpad-lite-1.8.4_avoid_getGitCommit_call.patch to avoid 
  "ENOENT: no such file or directory, lstat '/srv/www/etherpad-lite/.git'" 
  messages at server start
- rebased A    etherpad-lite-*_default_config.patch and
  etherpad-lite-*_move_autogenerated_key_files_to_var.patch

-------------------------------------------------------------------
Fri Jan  3 14:00:00 UTC 2020 - Lars Vogdt <lars@linux-schulserver.de>

- update to 1.8.0
  SECURITY: change referrer policy so that Etherpad addresses aren't 
            leaked when links are clicked (discussion: #3636)
  SECURITY: set the "secure" flag for the session cookies when served
            over SSL. From now on it will not be possible to serve the
            same instance both in cleartext and over SSL
  FEATURE: code was migrated to async/await, getting rid of a lot 
           of callbacks (see #3540)
  FEATURE: support configuration via environment variables
  FEATURE: include an official Dockerfile in the main repository
  FEATURE: support including plugins in custom Docker builds
  FEATURE: conditional creation of users: when its password is null,
           a user is not created. This helps, for example, in advanced
           configuration of Docker images.
  REQUIREMENTS: minimum required Node version is 8.9.0 LTS. Release 
                1.8.3 will require at least Node 10.13.0 LTS
  MINOR: in the HTTP API, allow URL parameters and POST bodies to co-exist
  MINOR: fix Unicode bug in HTML export
  MINOR: bugfixes to colibris chat window
  MINOR: code simplification (avoided double negations, introduced
         early exits, ...)
  MINOR: reduced the size of the Windows package
  MINOR: upgraded the nodejs runtime to 10.16.3 in the Windows package
  SECURITY: avoided XSS in IE11
  SECURITY: the version is exposed in http header only when configured
  SECURITY: updated vendored jQuery version
  SECURITY: bumped dependencies
- refreshed modules tarball
- added README.openSUSE
- rebased A    etherpad-lite-*_default_config.patch and 
  etherpad-lite-*_move_autogenerated_key_files_to_var.patch

-------------------------------------------------------------------
Mon Dec  2 21:15:22 UTC 2019 - lars@linux-schulserver.de

- update to 1.7.5
  NEW: Catch SIGTERM for graceful shutdown
  NEW: Show actual applied text formatting for caret position
  NEW: Add settings to improve scrolling of viewport on line changes
  NEW: Added pad shortcut disabling feature
  NEW: Create option to automatically reconnect after a few seconds
  FEATURE: introduced support for multiple skins. 
           See http://etherpad.org/doc/v1.7.5/#index_skins
  FEATURE: added a new, optional skin. It can be activated choosing 
           skinName: "colibris" in settings.json
  FEATURE: allow file import using LibreOffice
  SECURITY: updated many dependencies. No known high or moderate 
            risk dependencies remain.
  SECURITY: generate better random pad names
  SECURITY: updated MySQL, Elasticsearch and PostgreSQL drivers
  SECURITY: started updating deprecated code and packages
  SECURITY: Escape data when listing available plugins
  SECURITY: Update ejs
  SECURITY: xss vulnerability when reading window.location.href
  SECURITY: sanitize jsonp
  FIX: don't nuke all installed plugins if npm install fails
  FIX: improved LibreOffice export
  FIX: allow debug mode on node versions >= 6.3
  FIX: getLineHTMLForExport() no longer produces multiple copies of a line. 
       WARNING: this could potentially break some plugins
  FIX: authorship of bullet points no longer changes when a second 
       author edits them
  FIX: improved Firefox compatibility (non printable keys)
  FIX: getPadPlainText() was not working
  FIX: line numbers are aligned with text again (broken in 1.6.4)
  FIX: text entered between connection loss and reconnection was not saved
  FIX: diagnostic call failed when etherpad was exposed in a subdirectory
  FIX: Fix typo in apicalls.js which prevented importing isValidJSONPName
  FIX: fixed plugin dependency issue
  FIX: Update iframe_editor.css
  FIX: unbreak Safari iOS line wrapping
  FIX: minification of code
  Update: socket.io to 1.7.3
  Update: l10n lib
  Update: request to 2.83.0
  Update: Node for windows to 8.9.0
- build as noarch
- fix some env calls 
- adjusted patches:
  + etherpad-lite-1.7.5_default_config.patch
  + etherpad-lite-1.7.5_move_autogenerated_key_files_to_var.patch

-------------------------------------------------------------------
Thu Aug  3 09:37:58 UTC 2017 - mrueckert@suse.de

- update to 1.6.1
- install pg-native and force usage

-------------------------------------------------------------------
Fri Aug  5 10:16:31 UTC 2016 - mrueckert@suse.de

- update to 1.6.0:
  - SECURITY: Fix a possible xss attack in iframe link
  - NEW: Add a aceSelectionChanged hook to allow plugins to react
    when the cursor location changes.
  - NEW: Accepting Arrays on 'exportHtmlAdditionalTags' to handle
    attributes stored as ['key', 'value']
  - NEW: Allow admin to run on a sub-directory
  - NEW: Support version 5 of node.js
  - NEW: Update windows build to node version 4.4.3
  - NEW: Create setting to control if a new line will be indented
    or not
  - NEW: Add an appendText API
  - NEW: Allow LibreOffice to be used when exporting a pad
  - NEW: Create hook exportHtmlAdditionalTagsWithData
  - NEW: Improve DB migration performance
  - NEW: allow settings to be applied from the filesystem
  - NEW: remove applySettings hook and allow credentials.json to be
    part of core
  - NEW: Use exec to switch to node process
  - NEW: Validate incoming color codes
  - Fix: Avoid space removal when pasting text from word processor.
  - Fix: Removing style that makes editor scroll to the top on iOS
    without any action from the user
  - Fix: Fix API call appendChatMessage to send new message to all
    connected clients
  - Fix: Timeslider "Return to pad" button
  - Fix: Generating pad HTML with tags like instead of TAG:VALUE
  - Fix: Get git commit hash even if the repo only points to a bare
    repo.
  - Fix: Fix decode error if pad name contains special characters
    and is sanitized
  - Fix: Fix handleClientMessage_USER_* payloads not containing
    user info
  - Fix: Set language cookie on initial load
  - Fix: Timeslider Not Translated
  - Other: set charset for mysql connection in settings.json
  - Other: Dropped support for io.js
  - Other: Add support to store credentials in credentials.json
  - Other: Support node version 4 or higher
  - Other: Update uberDB to version 0.3.0
- packaging changes:
  - instead of calling run.sh just call node with the main file
    (this is basically what run.sh does with a lot of extra noise
     like calling installDeps.sh which always tries to update files)
  - in the init script: use pgrep to write the pidfile
  - set umask so we dont get world readable key and DB files
  - service file:
    - make etherpad restart in case of crashes
    - schedule it after postgresql
  - added etherpad-lite-1.6.0_default_config.patch
    - move the DB in the default config to /var/lib/etherpad-lite
  - etherpad-lite-1.6.0_move_autogenerated_key_files_to_var.patch
    both key files are generated into and read from
    /var/lib/etherpad-lite
  - run the parts from installDeps.sh which we need in %build
  - generate src/.ep_initialized in %build otherwise it wont start
    as non root
  - no longer symlink the config into /srv/www/etherpad-lite
    we pass --settings to etherpad instead.
  - merge with the spec file in the OBS
  - no longer build as noarch as there are actually some binary
    files in it. but it seems our check doesnt find *.node files.
  - drop unzip BR
  - dont fdupes. we might symlink unrelated files.

-------------------------------------------------------------------
Wed Feb  3 19:05:38 UTC 2016 - Lars.Vogdt@suse.com

- update to 1.5.7:
  + NEW: Add support for intermediate CA certificates for ssl
  + NEW: Provide a script to clean up before running etherpad
  + NEW: Use ctrl+shift+1 to do a ordered list
  + NEW: Show versions of plugins on startup
  + NEW: Add author on padCreate and padUpdate hook
  + Fix: switchToPad method
  + Fix: Dead keys
  + Fix: Preserve new lines in copy-pasted text
  + Fix: Compatibility mode on IE
  + Fix: Content Collector to get the class of the DOM-node
  + Fix: Timeslider export links
  + Fix: Double prompt on file upload
  + Fix: setText() replaces the entire pad text
  + Fix: Accessibility features on embedded pads
  + Fix: Tidy HTML before abiword conversion
  + Fix: Remove edit buttons in read-only view
  + Fix: Disable user input in read-only view
  + Fix: Pads end with a single newline, rather than two newlines
  + Fix: Toolbar and chat for mobile devices
- Give up the idea to have the needed modules as separate packages
  for now. Include them in the tarball directly instead.
- provide service and init file for different distributions

-------------------------------------------------------------------
Tue Apr 21 12:40:34 UTC 2015 - lrupp@suse.com

- update to 1.5.6:
  + SECURITY: Also don't allow read files on directory traversal on minify paths
  + SECURITY: Also don't allow read files on directory traversal on frontend tests path
  + SECURITY: Don't allow read files on directory traversal
  + SECURITY Fix: Information leak for etherpad exports (CVE-2015-2298)
  + Fix: Add check for special characters in createPad API function
  + Fix: Middle click on a link in firefox don't paste text anymore
  + Fix: Made setPadRaw async to import larger etherpad files
  + Fix: rtl
  + Fix: Problem in older IEs
  + FIX: Firefox keeps attributes (bold etc) on cut/copy -> paste
  + Fix: showControls=false now works
  + Fix: Cut and Paste works...
  + Fix: Rare scroll issue
  + Fix: Handling of custom pad path
  + Fix: Better error handling of imports and exports of type "etherpad"
  + Fix: Walking caret in chrome
  + Fix: Better handling for changeset problems
  + NEW: Accessibility support for Screen readers, includes new fonts and keyboard shortcuts
  + NEW: API endpoint for Append Chat Message and Chat Backend Tests
  + NEW: Error messages displayed on load are included in Default Pad Text (can be supressed)
  + NEW: Content Collector can handle key values
  + NEW: getAttributesOnPosition Method
  + NEW: padOptions can be set in settings.json now
  + NEW: Support for node version 0.12.x
  + NEW: API endpoint saveRevision, getSavedRevisionCount and listSavedRevisions
  + NEW: setting to allow load testing
  + Other: Update to express 4.x
  + Other: Dropped support for node 0.8
  + Other: Update ejs to version 2.x
  + Other: Moved sessionKey from settings.json to a new auto-generated SESSIONKEY.txt file

-------------------------------------------------------------------
Sun Feb  8 12:59:30 UTC 2015 - lrupp@suse.de

- update to 1.5.1:
  + various bugfixes and enhancements, please refer to 
    /usr/share/doc/packages/etherpad-lite/CHANGELOG.md for details
- home directory for etherpad user switched to %{_var}/lib/%{name}
- do not create symlink: breaks %config(noreplace)
- added etherpad-lite-rpmlintrc to get rid of thousands of warnings
- add documentation
- move logfile to it's own subdirectory
- add logrotate snipplet
- removed etherpad-remove-installDeps.patch : fixed upstream

-------------------------------------------------------------------
Thu Nov 13 09:32:57 UTC 2014 - lrupp@suse.com

- define settings.json as config file for now (should be move to 
  /etc/etherpad-lite later on

-------------------------------------------------------------------
Thu Jan  9 13:38:15 UTC 2014 - nrochard@gmail.com

- Initial release 1.3.0

Places

File etherpad-lite.changes of Package etherpad-lite (Revision c4a64c8532108a8ccf71f3be4b1057f9)

Places