HedgeDoc - Package Updates

[Package Updates]

[1.22.0]

• Update hedgedoc to 1.11.0
• Full Changelog
• GHSA-6c2w-8w96-3pcv reports a possible HTML injection via the localpart of an email address.
• GHSA-qj78-mjch-wwrv reports a possible Denial-of-Service attack using the YAML frontmatter parsing.
• GHSA-8v9p-5j95-826j reports a possible CSRF attack vector in the GitHub Gist export.
• GHSA-2f9f-w8xq-276v reports a rate-limiting bypass by abusing the CF-Connecting-IP header.
• When using Cloudflare in front of HedgeDoc, you should set rateLimitUsingCloudflare in the config.json or CMD_RATE_LIMIT_USING_CLOUDFLARE as environment variable to true.
• Added a warning page when clicking external links
• Improve the config.json.example file, which is used by bin/setup
• Allow configuration of login / signup rate-limits
• Allow configuration of Cloudflare usage in regards of rate-limits
• Several improvements in the documentation at https://docs.hedgedoc.org

[Package Updates]

[1.22.1]

• Update hedgedoc to 1.11.1
• Full Changelog
• GHSA-93w7-49m2-cqwg reports possible corruption of permission values due to missing validation. This should not impact permission checks, except when the note owner intentionally set their note permission to something invalid.
• Added external link warning setting (externalLinkWarning in config.json or CMD_EXTERNAL_LINK_WARNING) to disable the external link warning page entirely
• Added external link whitelist setting (externalLinkWhitelist in config.json or CMD_EXTERNAL_LINK_WHITELIST) to skip warning page for certain domains
• Added support for webp file uploads (for all backends except imgur, since that does not support these)
• Fixed external link warning for subpath instances
• Restore native browser zoom-in keyboard shortcuts in the editor
• Nested list items render properly again in the preview pane for slides
• Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
• Removed unused allowOrigin (environment variable CMD_ALLOW_ORIGIN) config option.
• Removed unnecessary/duplicate entries in the XSS filtering whitelist