|
1 | 1 | # Changelog |
2 | 2 |
|
| 3 | +## 1.7.1 |
| 4 | + |
| 5 | +### Security |
| 6 | + |
| 7 | +- `launder` now uses and exports the best available naughtyHref function for detecting malicious URLs. sanitize-html now depends on it, and apostrophe now uses type: 'url' for the link URL field of image widgets, which leverages it. Prior to this fix, it was possible for any user with editing privileges, including a contributor, to trigger arbitrary JavaScript via a javascript: URL in the link URL field of an image widget. A migration has been included to strip any such malicious URLs already present in the database. All users of apostrophe are encouraged to upgrade to get this security fix. Thanks to [Muhammad Uwais](https://github.com/MuhammadUwais) for reporting the issue. |
| 8 | + |
3 | 9 | ## 1.7.0 - 2023-05-03 |
4 | 10 |
|
5 | | -* Modernize dependencies to correct installation warnings, and eliminate use of `var`. |
| 11 | +- Modernize dependencies to correct installation warnings, and eliminate use of `var`. |
6 | 12 |
|
7 | 13 | ## 1.6.0 - 2023-03-06 |
8 | 14 |
|
9 | | -* `sms:` urls are now accepted. Thanks to [Ruben](https://github.com/reubendsouza) for this change. |
| 15 | +- `sms:` urls are now accepted. Thanks to [Ruben](https://github.com/reubendsouza) for this change. |
10 | 16 |
|
11 | 17 | ## 1.5.1 - 2021-10-28 |
12 | 18 |
|
13 | | -* The `date` method now correctly returns `null` if the date argument is unparseable and the `def` parameter is explicitly `null`. As was always documented, a default of `undefined` still returns the current date. |
| 19 | +- The `date` method now correctly returns `null` if the date argument is unparseable and the `def` parameter is explicitly `null`. As was always documented, a default of `undefined` still returns the current date. |
14 | 20 |
|
15 | 21 | ## 1.5.0 |
16 | 22 |
|
17 | | -* The `url` method now accepts a third argument, `httpsFix`. If it is `true` and the URL passed in has no protocol, the URL will be prepended with `https://` rather than `http://`. |
| 23 | +- The `url` method now accepts a third argument, `httpsFix`. If it is `true` and the URL passed in has no protocol, the URL will be prepended with `https://` rather than `http://`. |
18 | 24 |
|
19 | 25 | ## 1.4.0 |
20 | 26 |
|
21 | | -* `tel:` urls are now accepted. |
| 27 | +- `tel:` urls are now accepted. |
22 | 28 |
|
23 | 29 | ## 1.3.0 |
24 | 30 |
|
25 | | -* `booleanOrNull` accepts the string `'null'` as a synonym for `null`. Note that `'any'` was already accepted. `'null'` can be an attractive choice when the user will not see it in the query string and conflict with other uses of `'any'` is a concern. |
| 31 | +- `booleanOrNull` accepts the string `'null'` as a synonym for `null`. Note that `'any'` was already accepted. `'null'` can be an attractive choice when the user will not see it in the query string and conflict with other uses of `'any'` is a concern. |
26 | 32 |
|
27 | 33 | ## 1.2.0 |
28 | 34 |
|
29 | | -* `idRegExp` option may be passed to change the rules for `launder.id`. |
| 35 | +- `idRegExp` option may be passed to change the rules for `launder.id`. |
30 | 36 |
|
31 | 37 | ## 1.1.2 |
32 | 38 |
|
33 | | -* linting. |
| 39 | +- linting. |
34 | 40 |
|
35 | 41 | ## 1.1.1 |
36 | 42 |
|
37 | | -* for improved bc, `launder.select` does not crash if some of the choices given to `select` are null or undefined. Although this is a developer error rather than a sanitization issue, versions prior to 1.1.0 did tolerate this situation, so 1.1.1 does so as well. Thanks to Anthony Tarlao for his code contributions, and to Michelin for making this fix possible via [Apostrophe Enterprise Support](https://apostrophecms.com/support/enterprise-support). |
| 43 | +- for improved bc, `launder.select` does not crash if some of the choices given to `select` are null or undefined. Although this is a developer error rather than a sanitization issue, versions prior to 1.1.0 did tolerate this situation, so 1.1.1 does so as well. Thanks to Anthony Tarlao for his code contributions, and to Michelin for making this fix possible via [Apostrophe Enterprise Support](https://apostrophecms.com/support/enterprise-support). |
38 | 44 |
|
39 | 45 | ## 1.1.0 |
40 | 46 |
|
41 | | -* `launder.select` now handles numeric values for choices gracefully. Specifically, if the value passed in is a string, it will be validated as a match for a choice that is a number, as long as they have the same string representation, and the number (not the string) will be returned. Previously there was no match in this situation. |
| 47 | +- `launder.select` now handles numeric values for choices gracefully. Specifically, if the value passed in is a string, it will be validated as a match for a choice that is a number, as long as they have the same string representation, and the number (not the string) will be returned. Previously there was no match in this situation. |
42 | 48 |
|
43 | 49 | Thanks to Michelin for making this possible via [Apostrophe Enterprise Support](https://apostrophecms.com/support/enterprise-support). |
44 | 50 |
|
45 | 51 | ## 1.0.1 |
46 | 52 |
|
47 | | -* `launder.time` will now also accept a `.` (dot) as the separator (until now only `:` colon was recognized). Thanks to Lars Houmark. |
| 53 | +- `launder.time` will now also accept a `.` (dot) as the separator (until now only `:` colon was recognized). Thanks to Lars Houmark. |
48 | 54 |
|
49 | 55 | ## 1.0.0 |
50 | 56 |
|
51 | | -* switched to a maintained, secure fork of lodash 3, declared 1.0.0 as this has been a stable part of Apostrophe for years. |
| 57 | +- switched to a maintained, secure fork of lodash 3, declared 1.0.0 as this has been a stable part of Apostrophe for years. |
52 | 58 |
|
53 | 59 | ## 0.1.3 |
54 | 60 |
|
55 | | -* `launder.booleanOrNull` broken out from `launder.addBooleanFilterCriteria` so that you can get the tri-state value without modifying a criteria object. |
| 61 | +- `launder.booleanOrNull` broken out from `launder.addBooleanFilterCriteria` so that you can get the tri-state value without modifying a criteria object. |
56 | 62 |
|
57 | 63 | ## 0.1.2 |
58 | 64 |
|
59 | | -* `launder.tags` also accepts a comma-separated string. |
| 65 | +- `launder.tags` also accepts a comma-separated string. |
60 | 66 |
|
61 | 67 | ## 0.1.1 |
62 | 68 |
|
63 | | -* removed never-used and undocumented `parseTime` method. |
| 69 | +- removed never-used and undocumented `parseTime` method. |
64 | 70 |
|
65 | 71 | ## 0.1.0 |
66 | 72 |
|
67 | | -* initial release. Based on stable code recently refactored from Apostrophe 0.5.x. |
| 73 | +- initial release. Based on stable code recently refactored from Apostrophe 0.5.x. |
0 commit comments