NodeBB - Package Updates
-
[2.31.0]
- Update NodeBB to 4.14.0
- Full Changelog
- add first-run modal for new installations (
19e25f2) - add localhost and URL mismatch warnings to dashboard notices (
644034d) - add reject all on registration queue (
39f1115) - extend prune cutoff for followed remote categories (
57e65d0) - make public key fetch rate limit configurable (
471b827) - block re-queuing of rejected crossposts (
b9473b9) - dont allow loading group list via api/v3 (
3760c1e) - check topics:read privilege when loading post diffs (
8467945) - closes #14432, dont show mobile nav on chat page (
1633b47) - use dummy lockout key for non-existent users to prevent username enumeration (
e65c23a)
-
[2.31.1]
- Update NodeBB to 4.14.1
- Full Changelog
- add missing translations for admin restart/rebuild messages (
ae76f5b) - hide unenterable rooms from the chat list (#14483) (
2540ec8) - don't show bookmark alert when there is nothing to return to (#14476) (
eb14adc) - #14473, don't subtract milliseconds to generate dates (
9e34bab) - closes #14458, go back to using .translate for bodyShort (
162cb67) - closes #14453 (
597cdb4) - don't return ip of post on post edit (
74360ec) - recognize non-ASCII webfinger handles (#14466) (
5b9b174) - use raw body buffer for digest verification (
6067a49) - mark notifications with matching roomId read when opening a room (#14450) (
3a7497e)
-
[2.31.2]
- Update NodeBB to 4.14.2
- Full Changelog
- tx error message on /login (
c7cab16) - lang key in intents (
73d80fb) - activitypub: use absolute avatar/cover URLs as-is in user actor (#14447) (
7ccc3d2)
-
[2.31.3]
- Update NodeBB to 4.14.3
- Full Changelog
- don't prompt for plugin upgrades when stdin is not a TTY (#14523) (
091a50d) - closes #14524, don't return errors for rate limit error (
1d3d65b) - getEmail to verify email belongs to uid, closes #14512 (
e5cc6c2) - closes #14511 (
dd4fd54) - closes #14510 (
0b0de8a) - regression from benchpress parse => render change (
afbecfd) - closes #14506, only allow valid theme names in previews (
298c6a0) - update privileges.posts.get so it checks topic for (
2c1a747) - closes #14501, wrap toggleInstall and upgrade in try/catch (
a034c26) - closes #14500 (
fc13bb5)
-
[2.31.4]
- Update NodeBB to 4.14.4
- Full Changelog
- trust_proxy upgrade script writes to wrong config.json when started with --config (breaks Docker logins) (#14527) (
29f90de)
-
[2.31.5]
- Update NodeBB to 4.14.5
- Full Changelog
- clear session info when switching users in doLogin (
bc206f6) - replace outdated .includes() check for AP header in webfinger query method, in favour of Helpers.assertAccept (
2079ea0) - guard title regeneration in inbox.update behind posts.isMain (
94feb90) - only allow self/admins/gmods to view/list emails (
a018478) - enforce same checks on topic room enter as controller (
54ff68b) - search by email array bypass (
5029739) - dont return category if user doesnt have find privilege in getSelectedCategory (
5a9d7f7) - rss feed privilege check for topic feeds (
2cc3ae1) - private upload path bypass (
35e7587) - closes #14528, encode uid in group calls (
c857090)
-
-
[2.31.7]
- Update NodeBB to 4.14.7
- Full Changelog
- add a middleware to require reauth on api routes (
69e749a) - use renderCategory for move event (
6972b70) - closes #14550, closes #14549 (
5f6ddbd) - closes #14548, wait for parsing of input elements before selecting (
0d67edd) - hide URL profile upload when uploads are disabled (#14547) (
fafced7) - use isSafeHref on user.url and category.url (
26333b8) - privileges: route ActivityPub URIs to fediverse pseudo-user check (
ab95445) - activitypub: enforce attributedTo origin check in inbox handlers (
f93507a)
-
[2.31.8]
- Update NodeBB to 4.14.8
- Full Changelog
- typo on reauthAt (
f29db71) - don't save req into post queue (
28899f7) - closes #14553, closes #14554 (
37c1853) - sanitize system messages (
f5be7f6) - handle both local and remote users' aboutme identically (
3f18849) - validate group hex colors (
a30dfd1) - add priv check to loading profile pictures (
707bfe0) - reject invalid cid in topic post route (
35c4975) - xss in room rename event in chat modals (
55b1ea5) - api: exclude cookie header from buildReqObject to prevent session token exposure in post queue (
e44d909)
-
[2.31.9]
- Update NodeBB to 4.14.9
- Full Changelog
- changing others emails requires password reauth, closes #14575 (
4ea6f9e) - don't display tokens on /admin/api page (
b7e5d85) - require password for creating master token (
7b7b7d2) - selector in chats & modals (
56c6115) - closes #14591, remove tokens if email removed (
349797a) - closes #14590 (
ce2f54e) - bring back logout message pretranslate (
3f7e6bf) - redirect to account handling only /login (
9d0c76e) - password confirm modals for admin add/remove (
9b72ca3) - closes #14569, prevent socket.emit('admin.xxx') if (
0d07382)
-
The update 2.31.9/4.14.9 has been revoked due to an upstream regression blocking all new user registration.
See: https://community.nodebb.org/topic/19422/bug-registration-fails-with-csrf-forbidden-error-on-post-register-complete-after-updating-to-v4.14.9 -
[2.31.10]
- Update NodeBB to 4.14.10
- Full Changelog
- closes #14580, dont send 'off' to digest.execute (
5ad30d4)
-
[2.32.0]
- Update NodeBB to 4.15.0
- Full Changelog
- feat: allow chat and chat:privileged privileges for fediverse group (#915b6ac)
- feat: update uploads to look nicer (#5cdf3aa)
- feat: pass opts to filter:user.create and action:user.create (#95e7da9)
- feat: add toggle to disable IP address logging (#db662ff)
- fix: don't expose user existence if visitor can't view users (#12447) (#61a7a0a)
- fix: reject SSO auth via callback handler, if state parameter isn't passed in by client (unless checkState is false) (#6ba24ed)
- fix: remove rss_token from exported user profile data (#6776cc4)
- fix: upgrade privilege check in api.users.addEmail to check admin:users instead of just privileges.users.canEdit (#35deb33)
- fix: require admin:admins-mods to modify administrators group membership (#9ddaec7)
- fix: add response size limit to prevent memory exhaustion (#0f2cc70)
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login