PrivateBin - Package Updates

Package Updates

[1.11.1]

Update PrivateBin to 2.0.1
Full Changelog
ADDED: Auto shorten URLs with config option shortenbydefault (#1627)
ADDED: Added shortenviashlink endpoint with an shlink configuration section
ADDED: Password peek (#1254)
CHANGED: CSP recommendation around bootstrap5 template resolved in Firefox 131 (#1613)
CHANGED: Upgrading libraries to: bootstrap 5.3.8, DOMpurify 3.2.7 & ip-lib 1.21.0
FIXED: Allow pasting a password for decrypting a paste (#1620)
FIXED: Allow copying the shortened link after using a URL shortener (#1624)
FIXED: URL extraction fails when frame-ancestors is set in CSP (#1644)
FIXED: traffic limiter not working when using Filesystem storage and PHP opcache

Package Updates

[1.11.2]

Package Updates

[1.11.3]

Update PrivateBin to 2.0.3
Full Changelog
FIXED: Prevent arbitrary PHP file inclusion when enabling template switching
FIXED: Malicious filename can be used for self-XSS / HTML injection locally for users
FIXED: Unable to create a new paste from the cloned one when a JSON file attached (#1585)

Package Updates

[1.11.4]

Update PrivateBin to 2.0.4
Full Changelog
ADDED: Translations for Swedish & Persian
CHANGED: Deduplicate JSON error message translations
CHANGED: Refactored translation of exception messages
CHANGED: Upgrading libraries to: DOMpurify 3.4.1, ip-lib 1.22.0, polyfill-php80 1.34.0 & zlib 1.3.2
CHANGED: Remove obsolete X-XSS-Protection header (#1825)
FIXED: Some exceptions not getting translated
FIXED: Attachment disappears after a "paste" in the message area (#1731)
FIXED: The content format is not reset when creating a new document (#1707)

Package Updates

[1.11.5]

Update PrivateBin to 2.0.5
Full Changelog
CHANGED: Show OS-specific copy hotkey hint (Cmd+c on Mac, Ctrl+c on others) (#1506)
FIXED: Prevent browsers from rendering unsafe attachments like HTML in a new tab
FIXED: State corruption after "Remove attachment" (#1824)
FIXED: Copy button is hidden if the document is made as markdown (#1703)
FIXED: Shortened URLs from YOURLS received but failed to parse (#1844)
FIXED: Insert only base path in JSON API responses, without GET parameters

Package Updates

[1.11.6]

Update PrivateBin to 2.0.6
Full Changelog
CHANGED: Upgrading libraries to: DOMpurify 3.4.12
CHANGED: Switch to PHP native JsonException type
FIXED: Gracefully handle YOURLS replies with a 200 status code but no shorturl, instead of raising a TypeError
FIXED: Return "Invalid data." instead of HTTP 500 on malformed v2 JSON payloads (#1883)
FIXED: Dead PATH validation guard in Controller, the check for a missing trailing directory separator never ran (#1887)

Package Updates

[1.12.0]

Update PrivateBin to 2.1.0
Full Changelog
ADDED: Added shortenviachhoto endpoint with an chhoto configuration section
ADDED: Translation for Chinese (Traditional)
ADDED: Subject line to the "Email" share button's mailto link (#928)
ADDED: Send the document with Ctrl+S, or Cmd+S on macOS (#739)
CHANGED: We removed jQuery in the Frontend and replaced it with vanilla JS.
CHANGED: Removed support for Bootstrap 3 as it requires jQuery.
CHANGED: Encode documents with TextEncoder in compress(), instead of the utf16To8() percent-encoding round trip, which allocated ~20 times the payload
FIXED: Decode decompressed documents with TextDecoder instead of utf8To16(), which allocated ~3.4 GB for a 100 MB document and killed the tab (#2027)
FIXED: Prevent browsers guessing MIME types on JSON(LD) API responses (#164)
FIXED: Sanitize Markdown HTML from CSS classes & styles

Package Updates

[1.13.0]

Package Updates

[1.13.2]

Package Updates

[1.13.3]

Update PrivateBin to 2.1.1
Full Changelog
ADDED: Translation for Korean (#2071)
ADDED: Comments authenticate the IDs of their document and parent comment if present. Older comments without these IDs are still accepted and shown, unless the new discussionrequireauthenticatedids option is enabled to validate these fields (#2101)
CHANGED: Check sizelimit over full request, before attempting decoding
CHANGED: Database backend now logs errors when reading comments, like it already did for comment existence checks (#2100)
FIXED: Creating a document failed with a JavaScript error when the discussion, password, e-mail or QR code option is disabled, as the top navigation accessed the omitted elements
FIXED: Slovenian plural forms were stored in the wrong order, i.e. "1 uri" instead of "1 ura" for one hour (#1951)
FIXED: SVG attachment previews could turn non-ASCII characters into markup after sanitization, enabling script execution when opening the preview in a new tab
FIXED: SVG attachment previews use a data URL, so they no longer run in the instance's origin when opened in a new tab
FIXED: Password characters above U+00FF got truncated before key derivation, now passwords get UTF-8 encoded and existing documents remain readable
FIXED: E-mail button sent several e-mails after being shown again or after its confirmation dialog was dismissed

Cloudron Forum