• Update Instructions
• Update details on blog

This is a security release to address a range of vulnerabilities:

• Users could update attachments on pages they did not have permission to update.
• Request endpoints for drawings could be misused to create cross-site-scripting scenarios.
• Draft page endpoints could be misused to alter non-draft pages without needing edit permission for those pages.
• Draft pages created by other users could appear in certain search result lists.
• ZIP imports with certain content could lead to a remote-code-execution scenario.
• Page visibility rules may not be updated in certain recycle-bin-related scenarios.

Updating is generally advised, but strongly so where untrusted users have general access to the instance.

If untrusted users do have access, especially edit level access, it's advised to double check image upload folders to ensure there's no unexpected non-image content.
On a typical Linux-based system installation, this could be done using the find command from the BookStack installation folder like so:

# Check the general "public" server space
find ./public/uploads -type f ! \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.gif" -o -iname "*.webp" -o -iname "*.avif" -o -iname ".gitignore" -o -iname ".htaccess" \)

# Check the internal image storage space
find ./storage/uploads/images -type f ! \( -iname "*.jpg" -o -iname "*.jpeg" -o -iname "*.png" -o -iname "*.gif" -o -iname "*.webp" -o -iname "*.avif" \)

A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:

• ByteMe.Red (Website)
• Emanuele Cervelli (GitHub)
• SVO (Website)
• Ahmed Ibrahim (GitHub, Website)
• Submersion.ai Security Research Team (Website)

Full List of Changes

• Updated image serving with additional MIME-based content type check.
• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Fixed issue where anchor links would be removed or be made invalid. (#6178)
• Fixed issue where sftp links would be removed from content. (#6186)
• Fixed lack of content validation when storing base64 drawing content.
• Fixed lack of permission check on draft endpoints.
• Fixed lacking content validation checks on book covers during ZIP imports.
• Fixed missing update permission check on attachment API.
• Fixed scenario where joint permission table would not be updated for chapter pages which are in the recycle bin.
• Fixed search queries not filtering out drafts from other users.

• Update Instructions
• Update details on blog

This is a security release to address a range of vulnerabilities:

• External Authentication Use (OIDC/SAML2/LDAP) could potentially mismatch external authentication system users to BookStack users upon login, where unique IDs are very similar (same ID text but different casing, or accented characters).
• The login form could be abused to use timing to gain information about if a user exists in the system. This was already limited by request rate-limits, but could still have assisted targeted scenarios.
• Certain editor content could be used to load interactive content over file links when exported, which could then pose a risk after being exported in Windows environments which use NTLM.
• API errors could include debug details by default, and therefore potentially expose some system details like file paths.
• With our default PDF rendering option, certain content could be used to access/check for files on the BookStack host beyond the scope of what we'd expect.

Upgrading is generally advised, but more so for instances using OIDC, SAML2 or LDAP authentication.

Thanks to Tanner Marks (GitHub), Gurmandeep Deol (LinkedIn) and whale120 (Blog, X, Working with DEVCORE Internship Program) for responsibly reporting issues addressed in this release.

Full List of Changes

• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Updated login with fake hash and random delay on failed login.
• Updated allow list content filter to force the use of schemes.
• Updated allow list content filter with smarter srcset attribute parsing.
• Updated user external authentication ID queries, and database column collation, to ensure an exact match.
• Updated API exception handler to follow a more controlled error message approach.
• Fixed image delete API endpoint to avoid an error scenario.

• Update Instructions
• Update details on blog

This is a security release to address some edge case vulnerabilities related to URL filtering, redirect handling, and permission checking, while also updating dependencies to help prevent known potential vulnerabilities in those being exploited.

Upgrading is advised for instances with public access enabled, or for instances where untrusted users are able to edit content.

Thanks to Gurmandeep Deol (LinkedIn) and MFK25 for responsibly reporting issues addressed in this release.

Full List of Changes

• Added Serbian language to language_select array. Thanks to @PolarniMeda. (#6153)
• Updated PHP package versions.
• Updated translations with the latest crowdin changes.
• Updated content allow-filtering to consider protocols used in srcset attributes.
• Updated URL filtering with a more thorough centralized utility class.
• Updated comment delete action to also check comment visibility permissions.
• Updated referring URL use with stronger source validation.
• Updated translations with latest crowdin changes. (#6166)

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Attachment requests could be manipulated to leak details/links/metadata (not content) of attachments which the user did not have permission to view.
• The file:// protocol could be abused in some Windows-specific scenarios to auto-run requests with credential information when viewing exports.
  • This protocol is now filtered from interactive content.
• The search system could be abused to cause errors and fill logs.

Upgrade is advised for instances with public viewing enabled, or where untrusted users have authenticated access.

Thanks to Stephen O. / Sakusen (Codeberg, Website), Gurmandeep Deol (LinkedIn), Rafael Castilho (X account) and Gabriel Duarte Guerra (GitHub) for responsibly reporting these issues.

Full List of Changes

• Updated PHP package versions.
• Updated translations with the latest Crowdin changes.
• Updated content allow-filtering to only allow the file:// protocol on anchor hrefs, instead of in all dynamic content.
• Updated attachment update handling to validate permissions before request content.
• Fixed numeric handling issue in tag search when using non-standard numbers.

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Folder Permissions - Due to some changes in how fonts are used for exports, after updating you may need to ensure that the storage/fonts folder (and all folders within that) are accessible & writable by the web-server. If you start seeing errors on PDF export after updating, it's likely this issue. See this page for guidance on setting permissions.
• Revision Access - Revision access & visibility is now controlled separately to pages. In some cases, after upgrading, users may no longer be able to access revisions by default (for example, where users had access to view page content but had no role-level view permissions).

Full List of Changes

• Added page contents view to page editor. (#6131, #4218)
• Added API endpoints for browsing tags. (#6095, #5835)
• Added custom font load handling for default PDF renderer. (#6109, #148, #719, #5770)
• Added in-UI option to reset user multi-factor authentication methods. Thanks to @clauvaldez. (#6056)
• Added hints to sort rule selection alongside empty lists. (#5967)
• Added specific permission for revision viewing. (#6108, #4526)
• Added new image and CSS CSP controls. Thanks to @Zhey-on. (#6071, #6033)
• Added Thai language support. (#6105)
• Updated codebase to meet PHPStan Level 4. (#6085)
• Updated comment/description WYSIWYG editor to support inline code. (#6100, #6003)
• Updated HTML to plain text conversion handling. (#6083)
• Updated image upload handling to validate referenced page. (#6126)
• Updated JavaScript packages. (#6090)
• Updated module install command with usability improvements. (#6094, #6066)
• Updated new WYSIWYG editor with a range of fixes. (#6119, #5631)
• Updated translations with latest Crowdin changes. (#6084)
• Fixed misaligned link attachment validation rules. (#6093)
• Fixed non-ascii character issues in headers on PDF exports. Thanks to @alexwoo-awso. (#6069, #6107)

• Update Instructions
• Update details on blog

This is a security release to address a brute-force based vulnerability related to multi-factor authentication, and to update project libraries to help avoid potential vulnerabilities that have been reported in those.

Upgrade is generally advised, but strongly so where multi-factor authentication is used & considered as a critical layer of defense.

Thanks to Stephen O. / Sakusen (Codeberg, Website) for responsibly reporting these issues.

Full List of Changes

• Updated PHP package versions.
• Updated MFA verification routes with rate limiting.

• Update Instructions
• Update details on blog

This is a security release to improve attachment related permission checks, and URL validation for webhooks.

Upgrade is advised if you allow untrusted users to delete attachments, or if untrusted users have permission to create webhooks on instances which make use of the ALLOWED_SSR_HOSTS BookStack env file option.

Thanks to 404_pkj (GitHub) and naruhodoowl (GitHub) for responsibly reporting these issues.

Full List of Changes

• Updated PHP package versions.
• Updated attachment actions to align page access check.
• Updated URL validation in webhooks to help prevent escaping workarounds.
• Fixed issue where exact search term negation would lead to no results. (#6121)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated translations with latest Crowdin changes. (#6067)
• Updated PHP dependency versions.

• Update Instructions
• Update details on blog

This is a security release to address a vulnerability where the registration form could be manipulated to gain access to additional roles.

Upgrade is very strongly advised if your instance has user registration enabled.

Thanks to Kwonyong Lee (LinkedIn) for responsibly reporting this issue.
Also thanks to Boustani OSAMA (LinkedIn) for also reporting this before public announcement.

Full List of Changes

• Updated user creation to only use validated input from registration.
• Updated PHP package versions.
• Updated translations with latest Crowdin changes. (#6064)
• Updated PHP_CodeSniffer repository link. Thanks to @rodrigoprimo. (#6060)
• Updated WYSIWYG editors to have consistent collapsible block double click behavior. (#6059)

• Update Instructions
• Update details on blog

This is a security release to address a vulnerability where page content, which should be hidden by permissions, could be visible during certain markdown exports.

We strongly advise that you update your instance if you use permissions to control page visibility.

Thanks to Ghufran Raza Khan (GitHub Profile, LinkedIn Profile) for responsibly reporting this issue.
Also thanks to Alex Dan (GitHub Profile) for also reporting this before public announcement.

Full List of Changes

• Updated queries used for pages in markdown exports.
• Updated handling of filenames for file serving.
• Updated PHP package versions.

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Email/SMTP - The way BookStack sends messages has changed slightly (Specifically, the SMTP HELO domain). This isn't expected to be a breaking change but testing of emails (Using the test send action in Settings > Maintenance) is advised after updating to be sure there's no impact.
• Theme System - Within a theme directory, the modules/ folder is now dedicated to theme modules. If you happened to already have a folder of this name in your theme, it's advised to use a different folder name instead.

Full List of Changes

Released in v26.03

• Added new module system to the theme system. (#5998)
• Added logical theme events for page content render and pre-save. (#6049)
• Added logical theme event and class to allow inserting custom views before/after others. (#5998)
• Added logical theme event to allow customising the OIDC authentication URL. (#6014)
• Updated book delete to return to the parent shelf in a shelf context. (#6029)
• Updated book read API endpoint to provide parent shelf information. (#6006)
• Updated cursor to pointer for drawio diagrams. Thanks to @lublak. (#5864)
• Updated description for per-page display limits. (#6005)
• Updated emails to use the domain from the APP_URL in the SMTP HELO. (#5990)
• Updated translations with latest Crowdin changes. (#6007)
• Fixed empty extra space showing for descriptions when the input is left empty. (#5724)

• Update Instructions
• Update details on blog

BookStack v25.12.9 has been released.

This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area in some revision views, opening up risk of potential phishing and/or tracking by bad page editors.

We advise that you update your instance if you allow untrusted users to create or edit pages.

Thanks to Alex Dan (@windbreaker555 on GitHub) for their responsible discovery and reporting of this issue.

Full List of Changes

• Updated page revision diffs to use content filtering.
• Updated preference change redirect with stronger origin checks.
• Updated application PHP dependencies.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed content filtering removing link target attribute, which would impact "New Window" links. (#6034)
• Fixed content filtering to not remove user references in comments.
• Updated PHP package versions.

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated page document handling to handle empty content instead of throwing an error. (#6026)

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated content filter to allow required drawio diagram attributes. (#6026)

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated filter caching folder handling to avoid server filesystem permission issues. (#6023)

• Update Instructions
• Update details on blog

BookStack v25.12.4 has been released.

This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area, opening up risk of potential phishing and/or tracking by bad page editors.

We advise that you update your instance if you allow untrusted users to create or edit pages.

Thanks to SeongYun Moon (@Moonster8282 on GitHub) for their responsible discovery and reporting of this issue.

Additional Update Notices

• Page Content - As of this release, extra layers of filtering have been applied to page content. While we have tried to ensure this has minimal impact on content, it's possible this will lead to extra elements being filtered.
• Option Change - The ALLOW_CONTENT_SCRIPTS env option is now considered deprecated. It's advised to use the APP_CONTENT_FILTERING option, as documented here, instead if needed.

If you experience issues with your page content being over-filtered feel free to raise an issue on GitHub where we can check if the behaviour is intentional or something which needs to be patched.

You can use the new page content filtering option, with a value of jhf which should match the prior version filtering, but this will remove a layer of content filtering security so is not recommend.

Full List of Changes

• Added new option for more granular page filter control.
• Updated page content filtering to detect extra cases, and to apply a more aggressive allow-list style filter.
• Updated application PHP dependencies.

• Update Instructions
• Update details on blog

BookStack v25.12.3 has been released.

This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.

We strongly advise that you update your instance if you allow untrusted users to create or edit pages.

Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.

Additional Update Notices

• Page Content - As of this release, most types of form content are now removed from page content on render. If you applied customizations which made use of in-page form content, you may now need to find alternative methods.

Full List of Changes

• Updated application PHP dependencies.
• Updated session-based API authentication to only be active for GET requests.
• Updated page content filtering to remove many common form elements & attributes.
• Updated translations with latest Crowdin changes. (#5997)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated translations with latest Crowdin changes. (#5970)
• Updated PHP dependency versions.

• Update Instructions
• Update details on blog

BookStack v25.12.1 has been released.

This is a security release which adds limits to search operations, and adds size checks to ZIP import files before they are extracted.
These changes help prevent potential abuse to host disk space usage and/or service availability.

We recommended to update your instance if untrusted users have ZIP import permissions, or if untrusted users can perform searches.

Thanks to Jeong Woo Lee (@eclipse07077-ljw) and Gabriel Rodrigues (aka TEXUGO) for reporting these vulnerabilities.

Full List of Changes

• Updated application PHP dependencies.
• Add some additional resource-based limits. (#5968)
• Updated translations with latest Crowdin changes. (#5962)

• Release video overview
• Update instructions
• Update details on blog

Full List of Changes

• Added user mentions for comments. (#5944, #560)
• Added slug history tracking system. (#5913, #5411)
• Added initial developer API for the new WYSIWYG editor. (#5928, #5763)
• Added internal reference handling on content copying. (#5917, #3239)
• Added settings to control the number of books/shelves that will be displayed per page. Thanks to @Xenoamor. (#5606, #2343)
• Updated translations with latest Crowdin changes. (#5933)
• Updated new WYSIWYG editor with a range of fixes. (#5939)
• Updated BookStack system CLI to v0.4. (#5956)
• Updated CSS dark/light mode handling so all CSS variables exist by default. (#5923)
• Updated "Microsoft URL Rewrite Module for IIS" download link. Thanks to @gerundt. (#5952)
• Updated image thumbnail generation to more reliably log issues on error. (#5869)
• Updated database to add index to views table to make view-based queries more efficient. (#5948)
• Updated application database requirements. (#5882)
• Fixed search pagination not using APP_URL value, and breaking for sub-path usage. (#5951)
• Fixed search pagination overflowing view on smaller screen sizes. (#5920)

• Update Instructions
• Update details on blog

BookStack v25.11.6 has been released.

This is a security release to address a vulnerability in our dependencies related to XML
handling, which could allow users to replay SAML authentication requests with specially crafted & manipulated requests.

It's strongly advised to update if you're using SAML authentication for BookStack.

Full List of Changes

• Updated application PHP dependencies.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated OIDC state handling to prevent other requests causing the process to fail, which was occurring in Chromium based browsers. (#5929)
• Updated session history handling to prevent redirects to common asset locations. (#5925)
• Updated PHP dependency versions.

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed error thrown when attempting to send new comment notifications. (#5918)
• Updated PHP dependency versions.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed overly-strict image access permission changes in v25.11.2 which could block images when a secure storage option was used alongside public access. (#5906, #5909)
• Updated app PHP dependencies to latest versions.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed image permission checking in ZIP exports to prevent error and to align with UI access. (#5899, #5885)
• Updated translations with latest Crowdin changes. (#5887)
• Updated test environment refresh database command to set env timezone option to ensure test database is consistent. (#5881)
• Updated app PHP dependencies to latest versions.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixes database queries causing errors with versions of MySQL <= 5.7. (#5877)

• Release video overview
• Update instructions
• Update details on blog

Full List of Changes

• Added API endpoints for comments. (#5850, #4194))
• Added API endpoints for reading image data. (#5860, #5519)
• Added Groovy code syntax highlighting support. (#5822)
• Added new flags to the create admin command. (#5749)
• Added option for display timezone, and improved UI use consistency. (#5790, #4786)
• Added proper pagination to search. (#5854)
• Updated API docs with better model ordering, and quick navigation select. (#5865)
• Updated codebase to meet PHPstan level 3. (#5785)
• Updated database comments table to remove redundant text column. (#4821)
• Updated database format for core item types. (#5800)
• Updated framework to Laravel 12, and perform some major dependency upgrades. (#5782)
• Updated page delete handling to nullify related images instead of leaving old IDs. (#5846)
• Updated permission handling in code to use enums instead of strings. (#5793)
• Updated translations with latest Crowdin changes. (#5843)
• Updated user delete handling to nullify, or better handle, ID references on delete. (#5844)
• Fixed old API-scripts link leading to archived repo. (#5813)
• Fixed search timeout when a high per-page frequency match was encountered. (#5863)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated translations with latest Crowdin changes. (#5786)
• Updated PHP package versions.
• Fixed PWA manifest access when behind authenticated proxies. Thanks to @tfnh621. (#5820)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated new WYSIWYG editor with various fixes focused on collapsible block behaviour & interaction. (#5775)
• Updated translations with latest Crowdin changes. (#5759)
• Updated versions of PHP dependencies.
• Updated code to address some remaining PHP 8.4 deprecations.
• Fixed diagrams in ZIP imports not being editable post-import. (#5761)
• Fixed books detaching from shelves on shelf update where users don't have permission to view child books. (#5728)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated translations with latest Crowdin changes. (#5740)
• Updated PHP package versions.
• Fixed open redirect with stricter location checking.
• Fixed users being logged out on ZIP import errors. (#5754)
• Fixed menu accessibility tagging. (#5753, #5752)
• Fixed scenarios where MAIL_PORT could interfere with tests. (#5755)

• Release video overview
• Update instructions
• Update details on blog

Full List of Changes

• Added plaintext markdown page editor input option. (#5725, https://github.com/BookStackApp/BookStack/issues/5705)
• Added ZIP Import/Export API endpoints. Thanks to @LM-Nishant. (#5721, #5592)
• Added tag-classes based upon parent book/chapter. (#5681, #5217)
• Updated comment and description inputs to use the new WYSIWYG editor. (#5676)
• Updated 3-column layout with better usability. (#5685)
• Updated changelog input to large area with character counter. Thanks to @shresthkapoor7. (#5663, #5434)
• Updated mail logic to remove use of our custom patched Symfony mailer. (#5636)
• Updated translations with latest Crowdin changes. (#5696)
• Updated many actions to better handle parallel permission generation. (#5689, #4838)
• Updated new WYSIWYG editor with improvements & fixes. (#5731)
• Updated PHP package versions.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added Nepali Language. (#5677)
• Updated translations with latest Crowdin changes. (#5695)
• Updated PHP package versions.
• Updated content diffs to better group non-ascii language characters into words.
• Fixed error when loading opensearch endpoint with certain PHP in some environments. (#5673)
• Fixed namespace for test case. Thanks to @bumperbox. (#5668)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated new WYSIWYG editor with a range of fixes: (#5653)
  • Added toolbar for media elements for easier menu access.
  • Updated media embed code field to show existing embed code for direct editing.
  • Updated media resize handling to be more reliable and to retain focus after resize.
  • Updated table resize handles to be more efficient, and prevented them wondering far away from tables so often.
  • Fixed buggy media selection scenarios.
  • Fixed media form "src" field not working when video is using source elements.
  • Fixed table resize handles overlapping table captions.
  • Fixed text formatting being inconsistent on new paragraphs.
  • Fixed tiny image resize square on image insert.
• Fixed comment updates showing incorrect notification text. (#5642)
• Fixed search system ignoring words adjacent to non-breaking spaces. (#5640)
• Updated translations with latest Crowdin changes. (#5637)

• Release video overview
• Update instructions
• Update details on blog

Full List of Changes

• Added support for comments to reference page sections. (#5584, #1265)
• Added comment archive support. (#5584)
• Added AVIF image support. (#5625, #5474)
• Added new system info API endpoint. (#5607, #5603)
• Added user avatar image fetching for OIDC authentication. Thanks to @rubentalstra. (#5626, #5429, #4271)
• Updated new WYSIWYG editor with further fixes. (#5627)
• Updated page-edit redirect to page-view if permission failed on edit. (#5568)
• Updated translations with latest Crowdin changes. (#5622)
• Update codebase and packages to address php 8.4 depreactions. (#5358)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed incorrect image directory permissions. (#5609, #5605)
• Updated translations with latest Crowdin changes. (#5608)
• Updated PHP packages.
• Updated system CLI:
  • Fixed handling of database credentials with escaped special characters.
  • Updated download-vendor command with extra clean-up handling.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated PHP dependency package versions to fix compatibility issue on systems with recent libxml versions (eg. Arch Linux).

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated image file permission error handling for images to log instead of fail. (#5601, #5269)
• Fixed style issues in exports due to CSS variables being ignored. (#5576)
• Updated translations with latest Crowdin changes. (#5566)
• Updated PHP dependency package versions.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated name sort rule handling to consider accented characters. Thanks to @bernardo-campos. (#5550, #5542)
• Updated translations with latest Crowdin changes. (#5537)
• Updated PHP dependency package versions.
• Fixed a range of issues for the new WYSIWYG editor: (#5558)
  • Fixed content saving issues, specifically on save shortcut usage.
  • Fixed list conversion & parsing which was mishandling tasks lists.
  • Fixed a range of list selection and nesting scenarios.
  • Updated keyboard navigation to be more reliable around images & media embeds.
• Fixed comment times not being shown. (#5555)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added ipv6 database host address support. (#5464)
• Updated translations with latest Crowdin changes. (#5505)
• Updated revisions list to hide changes link for oldest revision. (#5454)
• Updated system CLI:
  • Added new download-vendor command.
  • Updated restore command to take environment variables into account. (#5489)
  • Updated backup command to use mariadb-dump where available. (#5373)
  • Updated update command to check, warn and exit early if the CLI is making changes to itself. (#5335)
  • Updated MySQL handling to use option files to pass details to CLI executions.
  • Updated MySQL handling to consider common xampp directory.
• Updated PHP dependencies.

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• PHP Version Requirement Change - The minimum supported PHP version has changed from PHP 8.1 to PHP 8.2 in this release. Please see our "Updating PHP & Composer" documentation page for guidance on updating PHP where needed.
• Sorting - Basic sort order changes for chapters and pages will no longer affect the "updated" time for these items. Wider changes during sorting (moving to a new parent) will still increment the "updated" time.
• Theme System - A public/ folder within an active theme folder will now be exposed for public access. If for some reason you already have such a folder that you don't want exposed, rename it before upgrading.

Full List of Changes

• Added sort rules with automatic book sorting. (#5457, #2065)
• Added method to serve public files via the theme system. (#5405, #3904)
• Updated app framework to Laravel 11. (#5400)
• Updated codebase minimum PHP version from 8.1 to 8.2. (#5397)
• Updated codebase to address various PHP 8.4 deprecations. (#5491)
• Updated new WYSIWYG editor with a range of fixes. (#5415)
• Updated search indexing to handle guillemets. Thanks to @inv-hareesh. (#5475, #5471)
• Updated search indexing with advanced tokenization along with hyphen handling. (#5488, #2095)
• Updated sort handling to not increment the updated date for sorted content. (#1777)
• Updated translations with latest Crowdin changes. (#5409, #5399)
• Fixed incorrect image orientation handling. (#5462)
• Fixed layout issues at specific breakpoints. (#5396)
• Fixed LDAP error thrown when server does not provide a cn value. (#5443)
• Fixed wrong condition for showing new books list. Thanks to @Silverlan. (#5470)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated export logic to have better temp file clean-up. (#5374, #5379)
• Updated in-app export endpoints to have rate limits. (#5379)
• Updated translations with latest Crowdin changes. (#5370)
• Updated PHP dependency package versions.
• Fixed markdown editor focus jumping on image insert. (#5384)

• Release video overview
• Update instructions
• Update details on blog

Full List of Changes

• Added new portable ZIP import/export format. (#5260, #43)
• Added support for concatenating multiple LDAP attributes in displayName. Thanks to @MatthieuLeboeuf. (#5295, #1684)
• Added book and chapter titles to search API results. Thanks to @rashadkhan359. (#5280, #5140)
• Added cover image details to book/shelf API list responses. (#5180)
• Updated dev dockerfile setup to simplify things. Thanks to @johnroyer. (#5293)
• Updated guest account form to hide language preference to prevent confusion. (#5356)
• Updated new WYSIWYG editor codebase to merge nodes & re-organise code. (#5349)
• Updated notification handling to not block user with errors on send failures. (#5315)
• Updated our JavaScript service files to TypeScript. (#5259)
• Updated project NPM package & SASS deprecations/changes. (#5354)
• Updated the new WYSIWYG editor with a range of fixes/updates. (#5365)
• Updated translations with latest Crowdin changes. (#5345)
• Fixed API attachment update issue when name not provided. (#5353)
• Fixed attachment actions showing when lacking permissions. (#5323)
• Fixed missing book description and formatting in markdown exports. Thanks to @czemu. (#5313)
• Fixed page indexing breaking with very large pages. (#5322)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated PHP dependency package versions.
• Updated translations with latest Crowdin changes. (#5331)
• Fixed attachment stream handling for better Chrome video support. (#5342, #5088)
• Fixed page include issue caused by PHP 8.3.14 bug. (#5341)
• Fixed OIDC userinfo handling when response included charset content type. Thanks to @wesbiggs. (#5337)
• Fixed differing code line height between dark/light modes. (#5146)

• Update Instructions
• Update details on blog

BookStack v24.10.2 has been released.

This is a security release to address a vulnerability in our dependencies where specifically formatted requests could be used to manipulate application configuration in environments where a certain PHP option (register_argc_argv) is enabled. This is not an option that's typically enabled in production web-serving environments, but it's advised to update where uncertain.

Full List of Changes

• Updated application PHP dependencies.
• Updated translations with latest Crowdin changes. (#5317)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated System CLI with fixes and updated dependencies. (#5312)
• Fixed update-url command not updating revisions & drafts. (#5292)
• Fixed the namespaces of some tests. Thanks to @LordSimal. (#5291, #5071)
• Fixed misaligned user input validation. (#5263)
• Updated setting categories to validate by for existing views, allowing custom categories to be used via the theme system. Thanks to @LachTrip. (#5255, #5251)
• Updated translations with latest Crowdin changes. (#5250)

• Release video overview
• Update instructions
• Update details on blog

Full List of Changes

• Added ability to configure the PDF export command timeout. (#5119)
• Added new Lexical based editor. (#5058)
• Added not operator to search. (#4536)
• Added OpenSearch support. Thanks to @maximilian-walter. (#5198)
• Added SAS and R code language support. (#5206)
• Added search term negation support. (#5239)
• Added Welsh language to language list. (#5240)
• Updated dompdf and bacon-qr-code libraries to new major versions. (#5222)
• Updated page editor type to always exist in API and database. (#5117)
• Updated translations with latest Crowdin changes. (#5188)
• Updated user account creation to provide better email failure feedback. (#5195)
• Fixed drifting search icon on smaller screen sizes. (#5204)

• Update Instructions
• Update details on blog

BookStack v24.05.4 has been released.

This is a security release to address issues found in LDAP group syncing, where in certain scenarios a user could be matched to extra roles incorrectly, and an issue with content visibility in "book-show" API responses which would not have permissions applied properly.

Upgrade is strongly advised for instances where LDAP authentication is used with group syncing, or where the REST API is used to fetch contents of books ("books-read" endpoint).

Thanks to Linus Nagel and their team at WorkSimple GmbH for reporting this API vulnerability.

Full List of Changes

• Updated API docs with consistent parameter types. (#5183)
• Updated default content iframe embed max-width to align with other content types. (#5130)
• Updated LDAP group sync to query via full DN.
• Updated translations with latest Crowdin changes. (#5118)
• Fixed books read API response not applying visibility control to chapter contents.
• Fixed API docs users response showing extra property. (#5178)
• Fixed database error thrown when using out dev docker setup. (#5124)
• Fixed RTL display issues with tasklist checkboxes. (#5134)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated translations with latest Crowdin changes. (#5065)
• Updated callouts with LTR text handling where supported. (#5104)
• Updated project PHP and JavaScript dependencies.
• Fixed blocked diagrams.net loading when using a custom URL that includes a port. (#5107)
• Fixed OIDC incorrectly calling userinfo endpoint when valid empty groups provided. (#5101)
• Fixed image replacement being case-sensitive when it should not be. Thanks to @DanielGordonIT. (#5096) (#5095)
• Fixed HTML code block highlighting when custom self-closing tags are used. (#5078)
• Fixed testing when custom ALLOWED_IFRAME_SOURCES is set. Thanks to @mueller-contria. (#5069) (#5068)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed initial page publish changelog message not being saved if set. (#5056)
• Fixed incorrect WYSIWYG code shortcut reference. Thanks to @bradenterpstra01. (#5036)
• Added role create/update validation to warn about too-long external auth ID values. (#5037)
• Updated GIF thumbnail generation to no support animation, to avoid issues with large-frame-count GIFs. (#5029)
• Updated translations with latest Crowdin changes. (#5022)
• Updated backup code description text to clarify their use. (#5017)
• Updated docker-compose.yml to remove deprecated version. Thanks to @michaelortnerit. (#5052)

• Update Instructions
• Update details on blog

BookStack v24.05.1 has been released.
This is a security release that adds extra rate-limiting to some forms that are accessible without authentication, while also implementing changes to prevent methods that could be used to indicate if specific user emails exist in the system.

Upgrade is advised for instances accessible on the public web.

Full List of Changes

• Updated PHP dependencies.
• Updated routes with IP-based rate limiting. (#4993)
• Updated email confirmation flow to not require email submission form.
• Updated translations with latest Crowdin changes. (#4994)
• Updated WYSIWYG alignment handling to also consider table align attributes. (#5011)
• Fixed attachment upload validation errors appearing as JSON. (#4996)
• Fixed incorrect notification preferences URL in email. Thanks to @KiDxS. (#5008, #5005)
• Fixed non-visible MFA setup titles in dark mode. (#5018)
• Fixed outdated path in visual theme system guidance. (#4998)
• Fixed potential cache permission issues by reverting cache location. (#4999)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• PHP Version Requirement Change - The minimum supported PHP version has changed from PHP 8.0.2 to PHP 8.1 in this release. Please see our "Updating PHP & Composer" documentation page for guidance on updating PHP.
• Composer Version Requirement Change - The minimum supported composer version has changed from v2.0 to v2.2 in this release. Please see our "Updating PHP & Composer" documentation page for guidance on updating Composer.
• Page Content - Text links in page content will now be underlined by default for accessibility. Refer to the release blogpost for an simple customization to override & revert this if desired.
• PDF Exports - The WKHTMLTOPDF option is now considered deprecated, with the alternative being the newly added EXPORT_PDF_COMMAND which is detailed in our documentation here. The WKHTMLTOPDF option will though remain supported for a number of feature releases though to avoid unexpected breaking changes.
• OIDC Authentication - The OIDC "userinfo" endpoint may now be called in very rare scenarios where not all expected claims were being properly provided in the user ID Token, which could alter the details used for new users on access, and the groups obtained for user group/role sync, but only in edge case scenarios where functionality was not matching configuration before the update.
• LDAP Authentication - The LDAP_USER_FILTER BookStack option now uses {user} as a placeholder instead of ${user} by default. The older ${user} placeholder format is still supported but you may want to use the new format instead. This should not cause any issues on existing instances, unless {user} was used as a literal part of your user filter which would be very unlikely.

Full List of Changes

• Added new command-based PDF export option. (#4969, #4732)
• Added Audit Log API list endpoint. (#4987, #4316)
• Added LDAP option to provide a custom CA cert. Thanks to @mmoore2012. (#4985, #4913)
• Added OIDC userinfo endpoint support. Thanks to @LukeShu. (#4955, #4726, #3873)
• Added simple registration form honeypot. Thanks to @nesges. (#4970)
• Added Scala to list of supported languages in code blocks. (#4953)
• Added licenses page supported by licenses list building process. (#4907)
• Updated app framework from Laravel 9 to 10. (#4903)
• Updated content links to be underlined by default for accessibility. (#4939)
• Updated dev Dockerfile with improvements. Thanks to @C0rn3j. (#4895)
• Updated included images with extra compression to save data. Thanks to @C0rn3j. (#4904)
• Updated JS build system to split markdown-focused packages to own file. (#4930, #4858)
• Updated LDAP user filter option to support new placeholder format. (#4967)
• Updated minimum required PHP version from 8.0 to 8.1. (#4894, #4893)
• Updated translations with latest Crowdin changes. (#4890)
• Fixed code direction in WYSWIYG editor lacking direction support in code editor. (#4943)
• Fixed difference of line-heights for paragraphs in tables between editor and page view. (#4960)
• Fixed extra space at the beginning of a translation. Thanks to @johnroyer. (#4972)
• Fixed failing drag and drop of attachments into editor on Chrome. (#4975)
• Fixed incorrect tag counts when tagged items are in the recycle bin. (#4892)
• Fixed WYSIWYG object embeds in the editor showing image toolbar button. (#4974)
• Fixed WYSIWYG table cell format handling which could clear styles unexpectedly. (#4964)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed non-working "Open Link In..." option for description editors. (#4925)
• Fixed failed reference loading when references are from recycle bin items. (#4918)
• Fixed failed code block rendering when a code language was not set. (#4917)
• Updated page editor max content widths to align with page display. (#4916)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• New version to address missed version and asset changes in v24.02.1. (#4889)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated translations with latest Crowdin changes. (#4877)
• Updated breadcrumb book & shelf lists to be name-ordered. (#4876)
• Updated MFA inputs to avoid auto-complete. Thanks to @ImMattic. (#4849)
• Fixed non-breaking spaces causing combined words in page navigation. (#4836)
• Fixed page navigation click not jumping to headers in nested collapsible blocks. (#4878)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Security - The v23.12 branch of BookStack recently had a security release, which you can find details of in our v23.12.3 blogpost.
• Comments - The ability to use markdown content in comments has been removed in this release, replaced by a WYSIWYG editor. Markdown in comments was a fairly hidden feature though so was not commonly utilised. Existing markdown comments will remain although formatting may be lost if old markdown comments are edited.
• Commands - The "Regenerate Comment Content" command has been removed in this release since this action is now redundant.
• OIDC Authentication - Proof Key for Code Exchange (PKCE) support has been added to BookStack OIDC authentication. This should not affect existing OIDC use but you may want to enforce PKCE to be required for BookStack on your authentication system, if supported, for extra security.

Full List of Changes

• Added simple WYSIWYG comment editor inputs. (#4815, #3018)
• Added default page templates for chapters. Thanks to @Man-in-Black. (#4750, #4764)
• Added PKCE support for OIDC. (#4804, #4734)
• Added "Clear table formatting" & "Resize to contents" WYSIWYG table options. (#4845)
• Added "Toggle header row" button to table toolbar in WYSWIYG editor. (#985)
• Added attachment serving range request support. (#4758, #3274)
• Added new AUTH_PRE_REGISTER logical theme event. (#4833)
• Updated app entity loading to be more efficient and avoid global addSelects. (#4827, #4823)
• Updated book/shelf cover image wording to make sizing in usage clearer. (#4748)
• Updated PWA manifest to allow landscape use. Thanks to @shashinma. (#4828)
• Updated redirect handling to reduce chance of redirecting to images. (#4863)
• Updated some EN text for consistency/readability. (#4794)
• Updated WYSIWYG editor with improved cell selection formatting clearing. (#4850)
• Updated WYSIWYG text direction & alignment controls to work more reliably on complex structures. (#4843)
• Fixed breadcrumb dropdowns being partially out of view on mobile screen sizes. (#4824)
• Fixed description WYSIWYG not respecting RTL text. (#4810)
• Fixed header bar collapse on smaller screen sizes when no name or logo is used. (#4841)
• Fixed incorrect pagination display in RTL layout. (#4808)
• Fixed JavaScript error logged on WYSIWYG editor load due to how custom styles were imported. (#4814)
• Fixed scrollbars showing on WYSIWYG table cell range selection in some browsers. (#4844)
• Fixed WYSIWYG code block text direction controls not being respected. (#4809)

• Update Instructions
• Update details on blog

BookStack v23.12.3 has been released.
This is a security release that addresses a vulnerability in PDF generation that could be exploited to perform blind server-side-request forgery.

Upgrade is advised where untrusted users have permission to create/edit/update page content in your instance.

Full List of Changes

• Updated PHP dependencies, primarily to update php-svg-lib package.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed attachment list ctrl-click not opening attachments inline. (#4782)
• Updated translations with latest Crowdin changes. (#4779)
• Fixed entity selector popup pre-fill not searching term as expected. (#4778)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed chapter API missing expected "book_slug" field. (#4765)
• Updated translations with latest Crowdin changes. (#4747)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Page Includes - The way page include content is fetched & merged has changed significantly in this release, which in some cases may alter how included content appears on the page.

Full List of Changes

• Added simple WYSIWYG for description fields. (#4729, #2354, #2203)
• Added default template option for books. Thanks to @lennertdaniels. (#4721, #3918, #1803)
• Added OIDC RP-initiated logout. Thanks to @joancyho. (#4714, #4467, #3715)
• Added new Logical Theme System event to register web routes. (#4663)
• Updated email notifications to include the page parent chapter/book. Thanks to @Man-in-Black. (#4629)
• Updated and standardised DOM handling in the codebase. (#4673)
• Updated back redirection handling to not rely on referrer headers. (#4656)
• Updated book/chapter/shelf description character limit. (#4085)
• Updated design of buttons to be a bit friendlier. (#4728)
• Updated HTML exporting with better RTL handling. (#4645)
• Updated include tag handling to be structure/DOM aware. (#4688)
• Updated SAML2 dump debug option to include group parsing details. (#4706)
• Updated translations with latest Crowdin changes. (#4658)
• Updated WYSIWYG editor to allow video/embed alignment controls. (#4727, #3378)
• Updated WYSIWYG library TinyMCE from 6.5.1 to 6.7.2. (#4661)
• Fixed extra paragraphs & invalid syntax when using page includes. (#3385)
• Fixed lack of user invite via the API in certain cases. (#4720)
• Fixed page includes leading to duplicate IDs. (#3982)
• Fixed permission generation failure with large amounts of content. (#4695)
• Fixed PHP mbstring deprecation warnings. (#4638)
• Fixed SAML2 Single Logout (SLO) not invalidating session at point defined by the spec. (#4713)

• Update Instructions
• Update details on blog

This is a security release that addresses a vulnerability in image handling which could be exploited to perform server-side requests or read the contents of files on the server system.
Additionally, this update addresses a lack of permission check in some image creation actions.

Upgrade is strongly advised where untrusted users have permission to create/edit/update page content in your instance.

Thanks to Carlos Bello from the Fluid Attacks Research Team for discovering and reporting this vulnerability.

Full List of Changes

• Updated thumbnail handling to for use of content as image data. (#4681)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed incorrect audit log dropdown behaviour. (#4652)
• Fixed redirects to the manfiest endpoint in some environments. (#4649)
• Updated translations with latest Crowdin changes. (#4643)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added "Norwegian Nynorsk" to user language options.
• Added JavaScript public event for customizing codemirror instances. (#4639)
• Added handling to allow jumping to headers/sections within collapsible sections. (#4637)
• Added PHP 8.3 support. (#4633)
• Updated translations with latest Crowdin changes. (#4631)
• Fixed header bar peeking through on markdown editor fullscreen mode. (#4641)
• Fixed incorrect color usage for editor toolbox active tabs. (#4630)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• User Detail/Preference Changes - Many of the URLs, paths and interfaces for user-self management have changed in this release. You may need to update any documentation or user guidance you may have surrounding users updating their own details or preferences.

Full List of Changes

• Added new "My Account" area. (#4615)
• Added Uzbek language translations. Thanks to @mrmuminov. (#4527)
• Added artisan command for re-fetching existing user avatar images. Thanks to @MarcHagen. (#4560, #1893)
• Added basic PWA support. Thanks to @GamerClassN7. (#4430, #1253)
• Added new header bar partials for easier customization. (#4564)
• Added "View Tags" button to non-default homepage views. (#4558)
• Updated page editor interface with a new design. (#4604)
• Updated app caching behaviour to avoid expiry scenarios. (#4600)
• Updated cleanup-images command to allow non-interactive running. (#4541)
• Updated comment notification options to only show if comments active. Thanks to @tusharnain4578. (#4552, #4508)
• Updated editor entity selector to pre-fill with selected text. (#4571)
• Updated file & image upload handling for better indication of issues. (#4578, #4454)
• Updated guest user logic to reduce complexity and overlapping methods. (#4554, #4448)
• Updated HTTP calling in the codebase to align all handling. (#4525)
• Updated icon handling to remove unneeded global helper. (#4553)
• Updated language handling to reduce complexity and duplicated logic. (#4555, #4501)
• Updated logical theme system to capture load errors for better reporting & debugging. (#4504)
• Updated mixed entity endpoints to share and align logic. (#4444)
• Updated OIDC config handling to move logic out of config file. (#4494)
• Updated OIDC request timeout to 5 seconds. (#4397)
• Updated older notifications codebase to align with newer code organisation. (#4500)
• Updated print view to ignore extra elements. (#4594)
• Updated Slack authentication to use official Laravel implementation. (#4464)
• Updated the default email settings to use example domain. (#4518)
• Updated translations with latest Crowdin changes. (#4523)
• Updated username truncation to always show some part of the name. Thanks to @Bajszi97. (#4533, #4489)
• Updated security docs to remove huntr references. Thanks to @radiantwave. (#4616, #4618)
• Fixed awkward sidebar scroll behaviour at mid-level screen sizes. Thanks to @LawssssCat. (#4562)
• Fixed buggy dark/light mode button when dark mode is the default. (#4543)
• Fixed enter press incorrectly clearing tag input field. (#4570)
• Fixed issue where "?" would show shortcuts when typing in an input. (#4606)
• Fixed lack of content in plaintext export options. (#4557)
• Fixed missing notification text in German-language emails. (#4567)
• Fixed odd default homepage layout at iPad-like width. (#4596)
• Fixed un-aligned text across elements when they show their empty states. (#4563)
• Enabled Albanian translations for BookStack on Crowdin. (#4065)
• Enabled Finnish translations for BookStack on Crowdin. (#4614)
• Enabled Norwegian Nynorsk translations for BookStack on Crowdin. (#4447)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed comment reply notifications not being sent to the correct/expected user. (#4548)
• Fixed JavaScript error that could appear when not having comment permissions. (#4531)
• Fixed wrong French translation in notification preferences. (#4511)
• Updated translations with latest Crowdin changes. (#4512)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed WYSIWYG filtering issue, introduced in v23.08.1, which breaks page editing and drawing use when certain elements exist in page content. (#4510, #4509)
• Updated translations with latest Crowdin changes. (#4506)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated preferences view styles to better respond to content and screen sizes to prevent wrapping buttons. (#4502)
• Updated WYSIWYG editor filtering to help prevent page pointer being pasted into pages. (#4474)
• Updated translations with latest Crowdin changes. (#4481)
• Fixed a range of typos in our dev docs. Thanks to @omahs. (#4484)
• Fixed deleted watched books/chapters/pages breaking notification preferences view from loading. (#4499)
• Fixed notifications not being sent in receiver language preference. (#4497, #4480)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Security - Webhooks - In scenarios where admin users are not trusted, webhooks could potentially be used maliciously. This update adds a control for such functionality. Please read our documentation for the new ALLOWED_SSR_HOSTS option if this may be a concern for your instance.

Full List of Changes

• Added content notification system. (#4390, #4371, #241)
• Added browser-based drawing backup storage mechanism. (#4457, #4421)
• Added order/priority control within books via the API. Thanks to @rouet. (#4313, #4298)
• Added host allow list option for server side requests like webhooks. (#4410)
• Added additional comment-specific activities. (#4389)
• Updated translations with latest Crowdin changes. (#4380, #4462)
• Fixed API docs caching failure when using DB cache driver. (#4453)
• Fixed overly wide page view when using an RTL language. (#4429)
• Fixed status cache check to work better for simultaneous requests. (#4396)
• Fixed markdown editor scrolling on mobile screen sizes. (#4466)

• Update instructions

Upgrade Notices

• Shelf Create Permissions - If you upgraded specifically to v23.06 or v23.06.1, then create permissions for bookshelves would have been removed upon upgrade. If you made use of these via the "Copy Permissions to Books" action, or CLI command, then you will need to re-apply these permissions where required. If you jumped right over v23.06 and v23.06.1, then no permissions were removed.

Full List of Changes

This release contains the following fixes and changes:

• Re-added shelf create permissions, now include a note to indicate permission usage. (#4375)
• Fixed issue causing some delete-based action webhooks to create not-found errors. (#4373)
• Updated translations with latest Crowdin changes. (#4367)

• Update instructions

Upgrade Notices

• Email Configuration (TLS) - Due to issues experienced in v23.06, MAIL_ENCRYPTION=ssl or MAIL_ENCRYPTION=tls will now simply ensure that TLS or STARTTLS are used, rather than forcing full TLS to be used. Our email documentation has been updated to reflect this.

Full List of Changes

This release contains the following fixes and changes:

• Updated MAIL_ENCRYPTION usage due to incorrectly forcing initial TLS usage. (#4358)
• Updated translations with latest Crowdin changes. (#4352)
• Fixed image updated timestamp not updating when gallery images are replaced. (#4354)
• Fixed sort options breaking roles page load. (#4350)
• Fixed IPv6 addresses in audit log spilling into date column. (#4349)
• Fixed many inaccuracies in API example responses. Thanks to @devdot. (#4344)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Email Configuration - If you've configured mail with MAIL_ENCRYPTION=ssl it's advised to test sending (via the button in "Settings > Maintenance") after updating to v23.06 since support for SSL has been dropped for email sending, but we instead now force TLS to be required when this option is set.
• Font Customization - The technique for customizing fonts has changed to be simpler, less fragile and more flexible. If customizing fonts it's advised to update to the new method as shown in our updated documentation on changing fonts.
• Guest User Account - Previously custom roles could be given to the "Guest" user account but permissions for those roles would not fully apply. That's been changed in v23.06 so additional role permissions fully apply but, as a precaution to prevent unexpected additional grant of permissions upon upgrade, any additional roles assigned to the "Guest" user will be removed upon update migration. If needed, simply re-assign any desired custom guest user roles after updating.

Full List of Changes

• Added visual comment threading. (#4286, #3400)
• Added read-only comments listing into page editor. (#4322)
• Added methods for screen-reader/keyboard-only users to use the page section popup. (#3975)
• Added option to delete the current page draft. (#3927)
• Added text for each activity type so that webhooks always have readable text. (#4216)
• Updated image manager with new design to be responsive and more accessible. (#4265)
• Updated how fonts are defined for easier CSS customization. (#4302, #4307)
• Updated pages API to provide raw html in single page responses. (#4310)
• Updated system status colors with dark variants and to be CSS variables for easier customization. (#4301)
• Updated API docs with multi-paragraph descriptions for endpoints. (#4332)
• Updated ldap_connect usage to avoid deprecated syntax. (#4274)
• Updated MAIL_ENCRYPTION options & guidance for clarity. (#4342)
• Updated command codebase to align logic. (#4262, #4225)
• Updated default page copy/move view to show the parent book of chapter targets. (#4264)
• Updated export styles to remove rules redundant for HTML/PDF exports. (#4303)
• Updated JsonDebugException to use the "Responsable" interface. Thanks to @devdot. (#4318)
• Updated shelf permissions view to not show the non-used "create" permission. (#2690)
• Updated translations with latest Crowdin changes. (#4256)
• Updated WYSIWYG editor library from TinyMCE 6.3.1 to 6.5.1.
• Fixed API chapter update not using "book_id" parameter. (#4272)
• Fixed API returns responses to return 404 instead of 500 on not found. Thanks to @devdot. (#4290, #4291)
• Fixed created/updated times not showing using the Romanian language. (#4297)
• Fixed guest user role handling so they can accept custom permissions from other roles. (#1229)
• Fixed inaction when certain parameters were combined using the content-permissions API. (#4323)
• Fixed incorrect times in Users list API. (#4325)
• Fixed misaligned case-sensitive sorting in shelves. (#4341)
• Fixed misaligned date and time format returned by the image gallery API. (#4294)
• Fixed growing table rows in the WYSIWYG when using Firefox. (#4337)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated view-only code block line highlighting to only show on focus. (#4254)
• Updated System CLI. (#4252)
  • Fixed issues regarding symlinked folders for backup and restore.
  • Fixed incorrect app directory searching.
• Updated image/attachment file upload buttons to allow selection of mulitple files. (#4241)
• Updated translations with latest Crowdin changes. (#4239)
• Updated attachment drag handling so they can be dragged via their name/link. (#591)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated system CLI. (#4229)
  • Fixed wrong env details being used on restore.
  • Updated update-url on restore to actually work.
  • Added better support for symlink-ed locations.
  • Added warning against updating in docker-like (non git controlled) environments.
• Updated "update-url" command to allow running non-interactively. (#4223)
• Updated translations with latest Crowdin changes. (#4211)
• Updated WYSWIYG code editor focus handling to more accurately return to editor. (#4109)
• Fixed code block formatting in print/export views. (#4215)
• Fixed extra spacing being added around horizontal rules within collapsible blocks within the WYSIWYG editor. (#3963)
• Fixed "Custom HTML Head Content" style blocks not being used for code blocks within the WYSWIYG editor. (#4228)
• Fixed UI shortcuts being incorrectly active within code blocks. (#4227)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Page Include Tags - Nesting is now allowed for include tags, up to 3 levels of depth. You may now see more content loaded for pages which previously had unparsed nested include tags.
• SAML2 - Single LogOut (SLO) requests will now include a "session_index" for the current user. This technically brings BookStack's implementation closer to the spec, and is not expected to cause issues, but if using SLO it may be wise to check your identity provider behavior remains the same as before during logout.
• Custom Code Block Themes - Due to a change of library, the method of defining custom codeblock themes has significantly changed, and "window.CodeTheme" code is no longer used. Refer to our "Changing Code Block Themes" documentation for further information.
• Editor Event - editor-markdown::setup - This event no longer contains "codeMirrorInstance" in the event data. It instead has a "cmEditorView" property. See the event docs for more details.
• Editor Event - editor-markdown-cm::pre-init - This event has been renamed to "editor-markdown-cm6::pre-init" and no longer contains "config" in the event data. It instead has a "editorViewConfig" property. See the event docs for more details.
• Upload Timeouts - The use of "window.uploadTimeout" has been removed as a way to control upload timeouts. This would previously only be used in certain cases. Instead, if required, timeouts can usually be enforced at the web-server level.

Full List of Changes

• Added system CLI for admin operations. (#4206, #3149)
• Added image gallery API Endpoints. (#4103)
• Added content permission API endpoints. (#2702, #4099)
• Added new logical theme event to customize OIDC ID token data. (#4200)
• Added Clojure syntax highlighting for code blocks. (#4112)
• Added option to disable SSL verification with SMTP email sending. Thanks to @vincentbernat. (#4126, #3166)
• Added support for three-levels of nested include tags. Thanks to @jasonF1000. (#4192, #2845)
• Added detailed documentation for public JS events. (#4179)
• Added standard JS codebase formatting via ESLint. (#4181, #4180)
• Updated code blocks & markdown editor to CodeMirror 6. (#3617, #3518)
• Updated file upload handling for images and attachments. (#4193)
• Updated SAML2 SLO requests to include a session index. (#3936)
• Updated translations with latest Crowdin changes. (#4163)
• Fixed audit log type filter leading to wrong location. (#4201)
• Fixed large videos within content escaping content area. Thanks to @chopin2712. (#4204)
• Fixed missing WKHTMLTOPDF in .env.example.complete file. Thanks to @7nohe. (#4145)
• Fixed not being able to search for terms containing backslashes . Thanks to @esakkiraja100116. (#4202, #4175)
• Fixed timestamp in API docs example chapter response. Thanks to @tigsikram. (#4191)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed issue where user delete fails when no "migration" user is selected. (#4162)
• Fixed tag selection via mouse on Safari. (#4139)
• Updated translations with latest Crowdin changes. (#4131)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed role deletion failing when submitting with empty migration role. (#4128)
• Fixed ownership migration upon user delete not working. (#4124)
• Updated translations with latest Crowdin changes. (#4074)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed an issue with language loading in certain scenarios. (#4068)
• Updated translations with latest Crowdin changes. (#4066)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• PHP Version Requirement Change - The minimum supported PHP version has changed from PHP 7.4 to PHP 8.0.2 in this release. Please see the v23.02 version-specific update instructions for guidance on updating PHP.
• Logical Theme System Event Change - The commonmark_environment_configure event argument and return types have changed. Please see the event definition to understand the new types if using this logical theme system event.

Full List of Changes

• Added user roles API endpoints. (#4051, #4034)
• Added configuration option for the sendmail command. (#4001)
• Added sort actions and accessible controls to the shelf book management interface. (#4049, #4031, #2050)
• Updated framework to Laravel 9. (#4021, #3123)
• Updated project minimum supported PHP version from 7.4 to 8.0.2. (#4029)
• Updated the URL length limit for link attachments to 2k characters. (#4044)
• Updated app icon handling to generate favicon.ico file where possible. (#4032)
• Updated setting loading to be more efficient. (#4062)
• Updated test handling with cleaner centralized filed/image handling. (#3995)
• Updated translations with latest Crowdin changes. (#4025)
• Fixed issue where uploaded images would not show in the gallery for draft pages. (#4028)
• Fixed issue with increasing WYSIWYG editor lag as pages grow. (#3981)
• Fixed potential pluralization issues in some languages. (#4040)
• Fixed slow response time when saving page due to URL parsing and handling. (#3932)

• Update Instructions
• Update details on blog

This is a security release that addresses a potential vulnerability in PDF generation that could be used to make server-side requests or run potential other PHP code.

Upgrade is advised where untrusted users have permission to create page content in your instance.

From testing, it appears that successful exploitation of this would require either the disabling of BookStack default security options, or access to the host machine system, but out of caution we're advising upgrade in any environment as specified above.

Full List of Changes

• Updated pdf library to address vulnerability. (#4010)
• Updated translations with latest Crowdin changes. (#4008)
• Fixed missing default 180px icon. (#4006)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Permission Changes - There have been changes to the permission system which can affect how permissions apply and therefore could lead to changes in provided abilities upon upgrade. This is only really relevant to complex permission scenarios that have only been possible since BookStack v22.10. Please see the Permission System Changes section below for more details on this.
• Database Upgrade Time - Changes to the permission system have required permissions to be regenerated upon upgrade. Due to this, the php artisan migrate upgrade step may take extra time to run, especially where there are a lot of content and/or roles in the system.

Full List of Changes

• Added ability to control app icon (favicon) via settings. (#3994, #3929, #301)
• Added ability to set separate colors for dark mode. (#2314, #4002)
• Added ability to set separate colors for primary color and links. (#3910, #4002)
• Added accessible controls to book sorting & improved user experience. (#3999, #3987)
• Added Scheme code highlight support. (#3954)
• Added SQL variant code highlighting support. (#3942)
• Added ability to configure an ID claim for OIDC. (#3914)
• Updated permission handling to be better defined and predictable. (#3986)
• Updated tag handling to show new row earlier. (#3931)
• Updated translations with latest Crowdin changes. (#3925)
• Updated codebase to address a range of PHP deprecations. (#3969)
• Updated internal testing to run OIDC tests faster. (#3985)
• Fixed header search results preview not being clickable in Safari. (#3926)
• Fixed informal German not receiving correct pluralisation. (#3976)
• Fixed lack of drawing access leading to infinite loading. (#3955)
• Fixed user image id existing after user avatar removal. (#3977)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added smarty and twig template code language support. Thanks to @jhit. (#3879)
• Updated translations with latest Crowdin changes. (#3881)
• Fixed global search focus issue with arrow keys. (#3920)
• Fixed lack of scroll in editor sidebar views. (#2887)
• Fixed not being able to remove all user roles. (#3922)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

No notices for this release

Full List of Changes

• Added user interface shortcuts system. (#3830, #1216)
• Added global search live preview. (#3850)
• Added markdown preview pane resize/hide/sync controls. (#2215)
• Added Dart/Flutter support for code blocks & editor. (#3808)
• Added Swift language support for code blocks & editor. (#3847)
• Added login/register message partials for easier use via theme system. (#3848, #608)
• Added Georgian Language support on Crowdin. (#3823)
• Updated all interface tabular list views to new format with added functionality. (#3821)
• Updated markdown codebase to be modular and tidied some styles. (#3875)
• Updated dark mode styles with fixes and browser color scheme support. (#3878)
• Updated email confirmation routes to be confirmed via POST. (#3797)
• Updated JavaScript usage to align on single cleaned-up component system. (#3853)
• Updated our testing process to ensure PHP8.2 Support. (#3852)
• Updated tests to cover issue of permission regeneration with chapter in the recycle bin. (#3796)
• Updated translations with latest Crowdin changes. (#3828)
• Fixed app logo not being stored for public access when using "local_secure_restricted" images. (#3827)
• Fixed missing translations for some editor elements. (#3822)
• Fixed OIDC JWKs parsing when "use" property missing on keys. (#3869)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated translations with latest changes from Crowdin (#3791).

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixes issue with generation permissions where a chapter is in the recycle bin. (commit)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Permission Management Changes - The interface and logic for managing shelf, book, chapter & page permissions has changed significantly in this release. The following should be noted:
  • Content permissions that were not active (where the "Enable Custom Permissions" checkbox was unchecked) will be removed upon upgrade to v22.10.
  • Content permission role entries, that had no permissions provided, will not be reflected/shown as a row in the permissions interface immediately upon upgrade. Instead such cases will be reflected via the "Everyone Else" permission entry being active, in a non-inheriting state, with no permissions set.
  • There should be no functional change to active permissions upon upgrade. Care has been taken to ensure existing permissions are migrated so that access control remains the same as pre-upgrade.

Full List of Changes

• Added Greek language. (#3732)
• Added MATLAB code syntax highlighting. (#3744)
• Added toolbar for code blocks in WYSIWYG editor to make mobile editing possible. (#2815)
• Updated content permissions interface & logic to allow more selective/intuitive control. (#3760)
• Update WYSIWYG table toolbar icons to be a little more legible. (#3397)
• Updated auth controller components to not depend on older Laravel library. (#3745, #3627)
• Updated book copy behaviour to copy book-shelf relations if permissions allow. (#3699)
• Updated books-read API endpoint to list child book/chapter tree. (#3734)
• Updated list style handling to align deeply nested list styling in & out of editor. (#3685)
• Updated shelf book management for easier touch device usage. (#2301)
• Updated tag suggestions to provide more accurate results. (#3720)
• Updated testing to support parallel running. (#3751)
• Updated tests to align/clean-up certain common actions. (#3757)
• Updated translations with latest Crowdin changes. (#3737)
• Fixed custom code block theme not used within the WYSIWYG editor. (#3753)
• Fixed issue where revision delete control would show to those without permission. (#3723)
• Fixed justified text not applying to list content. (#3750)
• Fixed not being able to deselect "Created/Update by me" search options. Thanks to @Wertisdk. (#3770, #3762)
• Fixed page popover being hidden behind content in chromium-based browsers. (#3774)
• Fixed SAML2 metadata display depending on external IDP metadata page. (#2480)
• Fixed squashing of columns in users list. (#3787)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added PHPCS for project PHP formatting. (#3728)
• Updated SAML error handling to display additional error detail. (#3731)
• Updated translations with latest Crowdin updates. (#3710)
• Updated locale setting to help apply right locale on Windows. (#3650)

• Release video overview
• Update instructions
• Update details on blog

Upgrade Notices

• Security - This release cycle contained a security release that added detail that's important to consider when BookStack content is used externally. See the v22.07.3 post for more detail.
• Revision Visibility - This update fixes a permission disparity with revisions. Revision content has always been accessible to those with page-view permissions, but the links to the revisions list previously required page-edit permission to show. This has been aligned, which may mean page revision links may now show to those that did not previously see them.
• Revision Limit Change - The default, per-page, revision limit has been doubled from 50 to 100, to account for new system-content updates that may occur. If desired, you can configure this to a custom value.
• Reference Index - New features have been added to track links between content in BookStack, which uses an internal reference index. Upon upgrade from an older BookStack version, this index will need to be rebuilt. This can be done with the "Regenerate References" command or via the "Regenerate References" maintenance action within BookStack.

Full List of Changes

• Added cross-item link reference tracking & updating. (#3656, #3683, #1969)
• Added OIDC group sync functionality. (#3616, #3004)
• Added reference view to shelves, chapters, books & pages. (#2864)
• Added new local_secure_restricted image storage option. (#3693)
• Added "page_include_parse" theme event. (#3698)
• Updated API docs to add detail for the request format. (#3652)
• Updated revision link visibility to show to users. (#2946)
• Updated shelf naming to be consistent across system. (#3553)
• Updated translations with latest Crowdin changes. (#3643, #3701)
• Updated role edit/create form with clarification upon image access permissions. (#3688)
• Fixed dates not using the correct encoding on some systems. (#3590)
• Fixed image delete button showing to those without permission to delete. (#3697)
• Fixed incorrect comment counts on Chinese language options. (#3554)
• Fixed list indentation when next to floated images. (#3672)
• Fixed various RTL text interface issues. (#3702)
• Fixed WYSIWYG drawing update not triggering draft save. (#3682)
• Fixed some additional SVG-based script cases not being filtered. (#3705)

• Update Instructions
• Update details on blog

This is a security release that adds additional filtering to page content to prevent certain cross-site-scripting techniques. These cross-site-scripting techniques would be already by blocked by BookStack's usage of Content-Security-Policy, but this change will help scenarios where BookStack content is used externally.

In addition, the API documentation has been updated with a section focused on content security to explain the security techniques BookStack uses by default, and to relay considerations for using BookStack content in an external system. The security page of our documentation has also been updated with such considerations:

https://www.bookstackapp.com/docs/admin/security/#using-content-externally

Upgrade is advised where BookStack content, accessible to edit by untrusted users, is used externally.
Those using BookStack content externally (API-based app developers) should read the new documentation and add any advised protections as necessary.

Thanks to the "JPCERT/CC Vulnerability Coordination Group" contact and the original reporter, Kenichi Okuno of Mitsui Bussan Secure Directions, Inc, for disclosing their report of the relevant vulnerability scenarios.

Full List of Changes

• Added API documentation section to advise of content security. (#3636)
• Updated Persian translations. Thanks to @samadha56. (#3639)
• Updated code block rendering to help prevent blank blocks on fresh cache. (#3637)
• Updated HTML filtering to prevent SVG animate case. (#3636)
• Updated translations with latest changes from Crowdin. (#3635)
• Updated revision list view to help prevent system memory exhaustion. (#3633)
• Fixed issue with permission checking prevent certain actions where permission should have allowed. (#3632)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added body-start/end partials to export template, for easier export customization via the visual theme system. (#3630)
• Added activity recording for revision delete/restore. (#3628)
• Updated translations with latest changes from Crowdin. (#3625)
• Updated user validation with sensible limit to name input. (#3614)
• Fixed issue where activity type could not be selected in the audit log. (#3623)
• Fixed possibility of breaking page load due to bad user language input. (#3615)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed issue where old WYSWYG editor code would be cached, preventing the editor from showing. (#3611)
• Updated translations with latest Crowdin changes. (#3605)

• Update instructions
• Update details on blog

Full List of Changes

• Added 'Sort Book' action to chapters. (#3598, #2335)
• Added ability to favourite code languages in the WYSIWYG code editor. (#3593, #3542)
• Added option to set IP address storage precision. (#3560)
• Added tag-based css classes to the HTML body tag for tag-based content CSS targeting. (#3583)
• Added new Logical Theme System event, emitted upon any system activity event. (#3572)
• Added editor shortcuts for bullet and numbered lists. (#3599, #1269)
• Updated shelf book management interface with better usability and book search bar. (#3591, #3266)
• Updated translations with latest changes from Crowdin. (#3600, #3545)
• Updated WYSIWYG editor to TinyMCE 6. (#3580, #3517)
• Updated DOMPDF, and other PHP dependencies. (#3579)
• Updated permission system to only "cache" view-based permissions for better performance, and made many other performance improvements. (#3569)
• Updated WYSIWYG color options to have no names, for better cross-language usage. (#3530)
• Updated tests to use ssddanbrown/asserthtml library. (#3519)
• Fixed comment count translation in Chinese translations. Thanks to @GongMingCai. (#3556)
• Fixed issue where AVATAR_URL=false would not properly disable Gravatar fetching. (#1835)
• Fixed some German translation typos and grammar. Thanks to @smartshogu. (#3570)
• Fixed issue where WYSIWYG toolbar would remain when after inserting a drawing. (#3597)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated translations with latest CrowdIn changes. (#3540, #3531)
• Fixed bug causing LDAP/SAML2 group mapping to fail if the "External Auth Ids" role field contained upper case characters. (#3535)
• Fixed differing behaviour, between select button and double-click, in the link selector popup. (#3534)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated entity-selector-popup to reset state upon successful selection. (#3528)
• Updated translations with latest CrowdIn changes. (#3526)
• Fixed non-translated settings category options. (#3529)
• Fixed issue where tags would not be saved upon book update. (#3527)
• Fixed long code in "Custom Head" setting breaking page layout. (#3523)

• Update instructions
• Update details on blog

Upgrade Notices

• SAML/LDAP Group Mapping - Within the "External Authentication Ids" field for a BookStack role, a backslash followed by a comma (\,) will now cause the comma to be treated as a literal comma within the mapping name, instead of acting as a value separator to define multiple mappings.

Full List of Changes

• Added ability to convert chapters to books, and books to shelves. (#3499, #1087)
• Added ability to auto-initiate login for SAML and OIDC auth users. Thanks to @rjmidau. (#3406, #3216, #2175)
• Added ability to use commas in the role "External Auth ID". (#3416, #3405)
• Added body-start/end templates as a convenience to theme system users. (#894)
• Added OCaml to the code editor language list and fixed highlighting type. (#3511)
• Added TypeScript to the code editor language list. (#3494)
• Added common audio types to our WebSafeMimeSniffer for non-download attachment usage. (#3485)
• Added LaTex to the code editor language list. (#3458)
• Updated the UI/design with a mass of fixes & improvements. (#3433)
• Updated WYSIWYG code editor interface. (#3512)
• Updated API docs to remove non-existant image_id field. (#3474)
• Updated logging system to not log StoppedAuthenticationException events. (#3468)
• Updated the markdown editor preview display to be patch-updated. (#3454)
• Updated export templates into smaller chunks for easier override. (#3443)
• Updated translations with latest Crowdin changes. (#3428)
• Fixed tag overview entity-counts showing incorrect values. (#3435)
• Fixed incorrectly placed debug script on default home page. (#3430)
• Fixed text after line-breaks not being indexed. (#3508)
• Fixed new WYSIWYG code snippets being shown as a single line. (#3507)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added Persian to language list. (#3426)
• Updated API docs to detail rate-limit information. (#3423)
• Updated translations with latest Crowdin changes. (#3418)
• Fixed broken attachment downloads in environments where PHP output buffering is disabled. (#3415)
• Fixed LDAP_DUMP_* options throwing error when LDAP details contain binary data. (#3396)
• Updated PHP dependency versions.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed issue where a duplicate slash could occur in the URL leading to a 404 page. (#3404)
• Updated translations with latest changes from Crowdin. (#3402)

• Update instructions
• Update details on blog

Upgrade Notices

• Database Changes - This release makes some significant changes to data within the database which may cause the update to take a little longer than usual to run. Please give the update extra time to complete.
• REST API Page Create/Update Changes - Create & update page requests now have the potential to change the current editor type for that page, depending on the content type sent in the request, if the API user has permission to change the page editor.
• URL Handling - The way we handle URLs has changed this release to hopefully address some issues in specific scenarios. These changes have been tested and should not affect existing working environments but there's an increased risk this release for setups with more complex URL handling. Please raise an issue or jump into our Discord server if you have any issues with URLs after upgrading.

Full List of Changes

• Added ability to switch editor types on a per-page basis. (#3387, #458, #369)
• Added new recycle bin API endpoints. Thanks to @Julesdevops. (#3377, #3372)
• Added ability to pass diagrams.net configuration options. (#3391)
• Added Uzbek language option to allow translation, not yet active in the interface. (#3383)
• Updated translations with latest Crowdin updates. (#3384, #3358)
• Updated database polymorphic relations to simpler morphmap. (#3395)
• Updated file handling in many cases to stream data for better efficiency, reduce memory usage and avoid hitting limits. (#3365, #2886)
• Updated URL handling to be more stable in sub-path scenarios. (#3364, #2765, #2058)
• Updated content update handling to increment updated_at field, even if only tags are changed. (#3319)
• Fixed editor Portuguese translation duplication. Thanks to @evandroamaro. (#3373)
• Fixed API issue where tags would not be applied on API shelf update. (#3370)
• Fixed development build command lacking Windows/non-bash compatibility. (#3323)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed issue where /settings redirect would lead to wrong location in some scenarios. (#3356)
• Fixed non-active prevention of custom HTML head content on settings views. (#3355)
• Updated translations with latest Crowdin changes. (#3354)
• Updated project PHP dependencies.

• Update instructions
• Update details on blog

Upgrade Notices

• Webhook Data Changes - Properties found at the related_item -> created_by/updated_by/owned_by path of the webhook data will now be an object instead of an ID integer. If you were using these ids you'd now need to access them within the relevant objects. (For example related_item.created_by.id).

Full List of Changes

• Added support for checkbox tasklists in the WYSIWYG editor. (#3333, #4)
• Added WYSIWYG control to remove & edit links. (#3276, #3298)
• Added WYSIWYG Ctrl+Shift+K shortcut to show entity selector popup shortcut in WYSIWYG editor. (#3244, #3298)
• Added LDAP user group debugging option. (#3345)
• Added support for the Basque language. (#3296)
• Updated settings view with a re-organized layout for a less confusing user experience. (#3349, #3221)
• Updated code block rendering in WYSIWYG to help prevent scroll jumping upon undo/redo. (#3326)
• Updated translations with latest Crowdin updates. (#3320)
• Updated webhook data to include details of page/chapter/shelf/book creator/updater/owner. (#3279)
• Updated webhook data to include revision details on page_update and page_create events. (#3218)
• Fixed lack of translation support for some editor buttons. (#3342)
• Fixed incorrect page concatenation in book markdown export. (#3341)
• Fixed usage of <br> tags within code blocks instead of newlines when using the WYSIWYG editor. (#3327)
• Fixed image thumbnail generation not taking EXIF rotation data into account. (#1854)

• Update Instructions
• Update details on blog

This is a security release that adds better protections against embedded content that could be used in malicious ways. This effectively restricts embedded iframe content in an allow-list approach.

A new ALLOWED_IFRAME_SOURCES option has been added to provide configuration of allowed embed/iframe sources within BookStack pages, and this defaults to a couple of popular services such as YouTube and Vimeo.

Please see this link for more detail regarding this option:

• https://www.bookstackapp.com/docs/admin/security/#iframe-src-control
  • ("Iframe Source Control" section)

It's advised to upgrade as soon as possible if untrusted users can create or update pages within your BookStack instance.

Thanks to @416e6e61 (Anna) for discovering and reporting this vulnerability via huntr.dev.

Full List of Changes

• Added iframe allow-list control to prevent a range of malicious uses of untrusted iframe sources. (#3314)
• Updated translations with latest Crowdin changes. (#3312)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added cache breaker to WYSIWYG onward loading to prevent plugin errors appearing if cached. (#3303)
• Updated translations with latest Crowdin changes. (#3301)
• Updated sidebar fade to be more subtle when in dark mode. (#3203)
• Fixed WYISWYG editor issue where blank lines would collapse. (#3302)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated editor references to avoid caching issue that would prevent WYSIWYG editor from opening. (#3293)
• Updated code blocks within the editor to be more reliable, especially on first insertion. (#3292)
• Updated translations with latest changes from Crowdin. (#3291)

• Update instructions
• Update details on blog

Upgrade Notices

• PHP Requirements Change - The minimum required version of PHP has changed from 7.3 to 7.4.

Full List of Changes

• Added collapsible content blocks support to the WYSIWYG editor. (#78, #3260)
• Added translation support to the WYSIWYG editor. (#1838)
• Added user management API endpoints. (#3238, #1363, #2701)
• Changed minimum PHP version from 7.3 to 7.4. (#3245, #3152)
• Updated translations with latest Crowdin changes. (#3258, #3251, #3259)
• Updated Korean translations. Thanks to @ististyle. (#3256)
• Updated TinyMCE WYSIWYG editor to the latest version. (#3247)
• Improved PDF export rendering of images within tables. (#3190)
• Fixed potential web console error message when loading the editor. (#2461)
• Fixed issue where OIDC token failures would not be shown to the user. (#3264)
• Fixed issue where the editor could jump-scroll to the top after format change on FireFox (#2692)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added text for "file" validation messages to provide better responses in Attachment API validation failures. (#3248)
• Fixed WYSIWYG editor code block creation across mulitple lines and block elements. Thanks to @Julesdevops. (#3246, #3200)
• Fixed markdown image data URI extraction failing on large images due to regex match limits. (#3249)
• Updated translations with latest Crowdin changes. (#3225)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added --external-auth-id option to the bookstack:create-admin command for use with LDAP/SAML2/OIDC instances. (#3222)
• Added the ability select preferred language when creating a new user. (#2408, #2576)
• Added configuration option for PDF export page size. (#995)
• Updated 503 error view to simplify and prevent thrown errors. Thanks to @Julesdevops. (#3210, #3205)
• Updated translations with latest Crowdin changes. (#3214)
• Fixed mis-represented default registration role and allowed disabling of this option. (#3220, #2338)
• Fixed OIDC autodiscovery when keys are provided in a certain format, as provided by Azure. (#3206)
• Development change: The default development branch name is now development instead of master. (#3195)

• Update instructions

Upgrade Notices

• Composer Version Requirement Change - Composer v2.0 or greater is now required to install or update BookStack.
  • You can check your composer version by running composer -V.
  • You can often update composer by running sudo composer self-update
    • (Or you may be prompted to run sudo composer self-update --2).
  • If you're using a system-supplied composer package you may need to first uninstall that (eg. sudo apt remove composer) then follow the composer download documentation to get the latest version.
    • Take notice of the sudo mv composer.phar /usr/local/bin/composer command shown in the documentation to install composer globally for easier usage.

Full List of Changes

This release contains the following fixes and changes:

• Updated development docker environment with xdebug support. Thanks to @Julesdevops. (#3193)
• Updated user creation flow to not persist the user on invitation sending failure. Thanks to @Julesdevops. (#3179, #3174)
• Updated "Recently Updated Pages" view to show update author and date. Thanks to @Julesdevops. (#3177, #3045)
• Updated translations with latest Crowdin changes. (#3158)
• Updated PDF page export image display to help fix image sizing issues again. (#3120)
• Updated "Recently Updated Pages" view to show parent context chain. (#3183)
• Fixed potential errors in revision diff view when multi-byte characters are used. (#3170)
• Fixed duplicate display in image gallery when uploading multiple images at once. (#3160)
• Fixed inaccurate markdown editor cursor position upon sidebar usage. (#3186)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Improved handling of uploaded images when thumbnails fail to load. (#3142)
• Updated translations with latest Crowdin changes. (#3148)
• Fixed issue where webhooks would error for specific recycle bin operations. (#3154)
• Fixed Spanish invite email subject translation. Thanks to @AitorMatxi. (#3153)
• Fixed issue where custom homepage could cause strange deletion behavior and lead to errors. (#3150)

• Update Instructions
• Update details on blog

BookStack v21.12.1 has been released.
This is a security release that better enforces permissions on book-sort & chapter-move operations to address scenarios where content could be moved to non-permissible locations.

It's advised to upgrade as soon as possible if untrusted users can update books or chapters in your BookStack instance.

Thanks again to @haxatron for discovering and reporting this vulnerability via huntr.dev.

Full List of Changes

• Added timeout and debugging statuses to webhooks. (#3139)
• Added new webhook_call_before logical theme system event hook. (#3138)
• Updated support for APNG images to retain animation. (#3136)
• Updated book sort and chapter move handling to enforce more permissions. (#3134)
• Updated item-search/select box to autofocus on search field. (#3127)
• Updated webhooks to not stop application on endpoint call failure. (#3122)
• Updated translations with latest Crowdin changes. (#3117)
• Fixed webhooks list view issue where columns would become to narrow. (#3135)
• Fixed linked images showing small in PDF export. (#3120)
• Fixed issue where pasting certain code blocks would cause erratic editor behavior. (#3133)

• Update instructions
• Update details on blog

Full List of Changes

• Added webhooks. (#147, #3099)
• Added ability to copy books, chapters & roles. (#3118, #1123)
• Added audit log IP address search. Thanks to @johnroyer. (#3081)
• Updated translations with latest Crowdin changes. (#3117)
• Fixed issue where non-ascii content could break search result previews. Thanks to @Kristian-Krastev. (#3113)
• Fixed mismatched password validation rules across the application. (#2237)

• Update Instructions
• Update details on blog

BookStack v21.11.3 has been released.
This is a security release that helps prevent potential discovery and harvesting of user details including name and email address.

It's advised to upgrade as soon as possible if your BookStack instance is public or is used by untrusted members.

Thanks to @haxatron for discovering and reporting this vulnerability via huntr.dev.

Full List of Changes

• Helped prevent discovery and harvesting of user information. Thanks @haxatron for reporting. (#3108)
• Updated search API results to include the highlighted preview content. (#3096)
• Updated search API results to include item URL. (#3080)
• Updated translations with latest Crowdin changes. (#3093)

• Update Instructions
• Update details on blog

BookStack v21.11.2 has been released.
This is a security release that address a couple of vulnerabilities relating to API access and page draft related content visibility:

• If the "Public" role was provided API access then the API could be accessed, in certain scenarios by non-authenticated users even if the "Allow public access" setting was disabled.
• In some specific scenarios, content related to page drafts (Such as attachments) could be visible to non-owners (Whom would have permission to view the page if saved as a non-draft at that point).

It's advised to upgrade as soon as possible if the API has been enabled for roles within your instance or if draft page content visibility could be a security concern for you.

Full List of Changes

• Fixed issue with greater-than-expected visibility on page-draft-related items. Thanks @haxatron for reporting. (#3086)
• Fixed issue where public API access was not limited by system public control in certain conditions. (#3091)
• Updated translations from latest Crowdin changes. (#3076)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added custom command support to the logical theme system. (#3072)
• Added support for prefers-contrast media setting to increase contrast in faded areas when active. (#2634)
• Updated TOTP confirmation view to autofocus on code input. Thanks to @raccettura. (#3068)
• Updated translations with latest changes from Crowdin. (#3057)
• Updated any links on homepage lists to be more obvious & accessible. (#3046)
• Fixed faulty page navigation links when headers are nested within other content. Thanks to @Julesdevops. (#3069, #3058)

• Update instructions
• Update details on blog

Upgrade Notices

• Security Releases - There were some security vulnerabilities found during the life of v21.10. See the v21.10.1, v21.10.2 and v21.10.3 posts for more details.
• API Changes - As of v21.11 any dates in API responses will be formatted as per ISO-8601, with 2019-12-02T20:01:00.283041Z reflecting an example of this format. You may need to review any of your scripts that utilise dates from API responses.
• Upload Limit - System file upload limits are now configured using a FILE_UPLOAD_SIZE_LIMIT option in your
  .env file. This value is specified as an integer and represents the max upload size in MegaBytes. This defaults to 50MB. This replaces the old window.uploadLimit HTML head option that could be set.
• Search Index Changes - There have been search indexing and scoring changes in v21.11.
  It's recommended to run php artisan bookstack:regenerate-search to ensure a consistent search experience and take
  advantage of these changes.
• Logout Endpoints - Logout endpoints have now changed to be CSRF protected POST endpoints instead of GET endpoints. If you were using these for any external purposes you may now need to implement an alternative workflow.

Full List of Changes

• Added a new tag view. (#3042, #738)
• Added a wide series of improvements to the search system, including: (#3043, #2840)
  • Added highlighting of search terms in search results. (#1891, #997)
  • Added matching of tag names and values through normal search terms. (#1577)
• Added search API endpoints. (#909)
• Added new .env option to limit file uploads. (#3033)
• Updated the used Laravel framework from version 6 to version 8. Thanks to @laravel-shift for accelerating this. (#3012, #3011)
• Implemented initial use of static analysis for PHP code. (#3039)
• Updated Slack and Facebook logos to be current. Thanks to @na3shkw. (#3032)
• Updated user invite/email-confirmation journeys to help prevent potential malicious user manipulation. Thanks again to @haxatron for reporting. (#3050)
• Updated logout endpoints to be POST to prevent potential CSRF concerns. Thanks to @hdvinnie for reporting. (#3047)
• Updated page include system to retain the pre tags when including a code block. (#2406)
• Updated translations with latest changes from Crowdin. (#3040)
• Fixed issue where using the back button in the page editor could lead you to the same page. (#2834)
• Fixed issue where setting new search filters could remove existing created_by & updated_by filters. (#2736)
• Fixed issue where markdown draft pages could convert to HTML. (#3054)
• Fixed issue where "Skip to content" link could be visible on print views. (#3051)

• Update Instructions
• Update details on blog

BookStack v21.10.3 has been released. This is a security release that address a couple of vulnerabilities within the attachment and image
serving mechanisms. The attachment vulnerability could result in users uploading content to be served in a way that can be utilized for phishing. The image serving vulnerability could result in unintended file access within your BookStack storage folder.

If you allow untrusted users to login or upload attachments you should update as soon as possible.

Full List of Changes

• Updated AzureAD login library to work with the new Microsoft Graph API. (#3028)
• Fixed path image file path traversal vulnerability. Thanks @theworstcomrade for reporting. (#3030)
• Prevented HTML attachments being served inline. Thanks @theworstcomrade for reporting. (#3027)
• Updated translations from latest Crowdin changes. (#3023)

• Update Instructions
• Update details on blog

BookStack v21.10.2 has been released. This is a security release that builds upon changes in v21.10.1 which covers a vulnerability which would allow malicious users, who have permission to update or create pages, to upload content that could then be utilized for phishing or other general malicious intent.

If you allow untrusted users to edit page content you should update as soon as possible.

Full List of Changes

• Made further fixes to address image upload vulnerability. Thanks again to @haxatron (#3019)
• Updated translations with latest changes from Crowdin. (#3014)

• Update Instructions
• Update details on blog

BookStack v21.10.1 has been released. This is a security release that covers a vulnerability
which would allow malicious users, who have permission to update or create pages, to upload
content that could then be utilized for phishing or other general malicious intent.

If you allow untrusted users to edit page content you should update as soon as possible.

Full List of Changes

• Fixed image upload vulnerability. Thanks to @haxatron (#3010)
• Fixed capitalization for Estonian language option. Thanks to @IndrekHaav. (#3008)
• Updated PHP packages to prevent abandoned warning. (#3007)
• Updated translations with latest changes from Crowdin. (#3006)

• Update instructions
• Update details on blog

Full List of Changes

• Added OpenID Connect authentication option. Thanks to @jasperweyne. (#2960, #2169, #1390, #1157)
• Added Attachment API endpoints. (#2986, #2942)
• Added Estonian language to BookStack via Crowdin. (#2979)
• Added support for SAML2 SLS signing to help address issues with ADFS. Thanks to @theodor-franke. (#2902)
• Added support for base64 image content within markdown text via page POST/PUT. (#2898)
• Updated translations from Crowdin contributors. (#2983)
• Updated SAML ACS post flow to retain user session and therefore redirect to the correct location upon login. (#2996, #2552)
• Fixed padding within book-tree sidebar items. Thanks to @ffranchina. (#3000)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added custom whoops-based debug view which fixes issue where debug view would not show content due to CSP rules. (#2977, #2976)
• Added throttling to password reset requests. (ca764ca)
• Updated translations with latest changes from Crowdin. (#2980)
• Updated DOMPDF chroot directory to prevent potential unintended file access. (#2965)
• Fixed issue where TOTP setup would provide guest email address upon QR code scan when MFA setup was enforced at login. (#2971)

• Update Instructions
• Update details on blog

This security release covers a vulnerability which would allow malicious users, who have permission to update or create pages, to load content from files stored within the storage/ or public/ directories (Such as application logs) via the page HTML export system.

If you allow untrusted users to edit page content you should update as soon as possible.

This release also changes the way browser response caching is performed, while logged in, to help prevent navigating back to confidential content after logout.

• Update instructions
• GitHub release page

Additional Changes

• Added concurrent page editing warnings upon draft save events. Thanks to @MatthieuParis (#2877)
• Updated translations with the latest changes from Crowdin. (#2953)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added IP address to tracked activities and displayed in audit log. Thanks to @johnroyer. (#2936, #2747)
• Added the option to use database table prefixes. Thanks to @floviolleau. (#2935)
• Allowed the use of content includes when using a custom homepage.
• Updated translations with latest content from Crowdin. (#2926)
• Converted old test cases to remove reliance on BrowserKit. (#2928)
• Fixed incorrect audit log detail on social account sign-in. (#2930)
• Fixed issue where QR codes were not readable when using dark mode. (#2925)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed certain "Custom HTML Head Content" being incorrectly altered or converted. (#2923, #2914)
• Updated translations with latest Crowdin updates. (#2915)

• Update Instructions
• Update details on blog

This security release is intended to cover a couple of XSS vulnerabilities, where a malicious user with page edit access could enter script that would execute upon page view. You should update as soon as possible if you allow untrusted users to edit content in your instance.

In addition, this releases expands the CSP headers set by BookStack to help avoid any similar vulnerabilities from being effective going forward. If you've performed some more advanced customizations on your instance, they may need to be altered to work with the built-in CSP system.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated TOTP setup flow to display a URL of the QR code contents during setup for non-QR scanning usage. (#2908)
• Updated translations with latest Crowdin updates. (#2906)
• Fixed broken page ordering on various views. (#2905)

• Update instructions
• Update details on blog

Upgrade Notices

• Config & Administration - The introduction of multi-factor authentication brings the first use of encryption in the platform.
  This uses the APP_KEY value in your .env file. Ensure you have this stored safely since it would be required if you ever
  restore/migrate your instance to another system.
• Security/Exports - During this release cycle it was highlighted that server-side request forgery could be achieved via the
  PDF export system. External fetching in the default PDF renderer has been disabled by default. The WKHTMLtoPDF renderer will now
  not be used if active. Either of these changes can be overridden by setting ALLOW_UNTRUSTED_SERVER_FETCHING=true in your .env file.
  This should only be used were only trusted users can create and export content. To support this we've added permissions that allow disabling of exports per role.
• Security/Authentication - A slight change was made in relation to how email addresses are confirmed. Email confirmations are now primarily checked at point-of-login rather
  than being checked on every request. Enabling email confirmation, or email domain restrictions, may no longer take action on unconfirmed users right away in the future.

Full List of Changes

• Added multi-factor authentication system. (#2827, #1118)
• Added the ability to export content as Markdown. Thanks to @nikhiljha. (#2115, #1717)
• Added role permissions for exporting content. (#2899, #1251)
• Added an advisory notice on the shelf permissions page regarding the lack of cascade. (#2876)
• Added Lithuanian language translations. Thanks to @ffranchina. (#2868)
• Added item parent link in recycle bin restore to make parent item restore easier. Thanks to @arjvand. (#2682, #2594)
• Added some core opengraph tags to content. Thanks to @james-geiger. (#2393, #2348)
• Updated blade views to be more consistent and follow a documented convention. (#2805)
• Fixed markdown blockquotes not rendering correctly in preview. (#2858, #2837)
• Fixed issue on API where page updates can remove HTML. (#2856)
• Fixed inconsistency in list display and nesting. (#2854)
• Standardised styling of the codebase. (#2820)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added VB.NET code block highlighting option. (#2869)
• Improved audit log user select list stability. (#2863)
• Fixed issue where user profile pages item "View All" links used ids hence did not link to proper searches. (#2857)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added a "Skip to content" link as first page focus item for accessibility use. (#2810)
• Updated social account detachment to have CSRF protection. (#2808)
• Updated PHP dependency versions.
• Fixed issue where translations system may attempt to load from the root directory when a theme was not in use. (#2836)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added the ability to server attachments without forcing downloads. (#2791)
• Fixed issue where empty HTML comments could cause errors. (#2804)
• Updated translations with latest changes from Crowdin. (#2790)
• Extracted not found text into it's own view for easier overriding (58117bc)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added base64 image extraction within page content. Thanks to @awarre. (#2700, #2631)
• Added Croatian translations. Thanks to @ffranchina. (#2784, #2785)
• Updated item permission roles list to be sorted alphabetically. (#2782)
• Merged in latest Crowdin translations. (#2787, #2777)
• Fixed incorrect styling of favourites sidebar when using a non-default homepage option. (#2783)

• Update instructions
• Update details on blog

Full List of Changes

• Added shelf/book/chapter/page favourite system. (#2748)
• Added previous/next navigation to chapters and pages. Thanks to @shubhamosmosys. (#2511, #1381)
• Added display of tags within search results. Thanks to @burnoutberni. (#2487, #2462)
• Added the ability to import JPEG user avatar images during LDAP login/registration. Thanks to @jasonhoule. (#2320, #1161)
• Updated export meta date format to align with the format used in revisions. (#2771)
• Updated drawing manager system to verify host on post messages for additional security. (#2769)
• Updated potential external links with rel="noopener" for better security . Thanks to @CorruptComputer. (#2768)
• Updated drawing upload error handling to better advise when images are too large for the server. (#2740)
• Updated page deletions to also delete related revisions. (#2668)
• Updated shelf, book & chapter creation/edit views to autofocus on the name input. (#1956)
• Updated translations with latest Crowdin changes. (#2764)
• Fixed issue where user search field could stack too early in certain languages. (#2147)

• Update instructions

This release contains the following fixes and changes:

• Added a way to configure options on a social driver, for the initial redirects, through the Theme::addSocialDriver system. (#2759)
• Fixed scenario where recent Image upload visibility changes caused issues on hosting where webserver and PHP process group/user differ. (#2758)

• Update instructions

This release contains the following fixes and changes:

• Fixed error during PDF export in some cases due to incorrect path. (#2746)
• Fixed error thrown when saving a markdown page with empty content. (#2741)
• Updated S3 ACL setting so ACLs are set via another request, as per pre-v21.04.2, but only when actually use AWS S3. (#2739)
• Updated translations with latest Crowdin changes. (#2737)
• Updated overflowing table content to be consistent. Thanks to @dopyrory3. (#2735, #2732)

• Update instructions

This release contains the following fixes and changes:

• Added a new SAML2_IDP_AUTHNCONTEXT option for SAML2 authentication since the default did not work well for some Windows environments. Thanks to @ivir. (#1998)
• Updated translations with latest Crowdin changes. (#2719)
• Updated Korean translations. Thanks to @Jokuna. (#2716)
• Improved error messaging when attempting to access a non-existent image file. (#2696)
• Updated table style handling across exports types to be consistent. (#2666)
• Updated export system to remove JavaScript used in Custom HTML Head Content to prevent errors or strange behaviour. (#2490)
• Fixed page export error thrown when the created by, or last updated by user, had been deleted. (#2733)
• Fixed white borders on layout buttons when in dark mode when using Safari. (#2728)

• Update instructions

This release contains the following fixes and changes:

• Updated migration string column lengths to better fit within restrictive index limits (#2710)
• Updated select box styles with to work around default iOS styles causing issues in dark mode. (#2709)
• Updated translations with latest Crowdin changes. (#2695)
• Updated styles of layout view buttons in mobile screen sizes to respect dark mode.
• Updated image upload behaviour for s3 style uploads to set public permissions as part of the upload request instead of a separate request.
• Fixed issue where "Recently Viewed" would show non-viewed content for new users. (#2703)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed issue where a page could become inaccessible when the creator no longer existed. (#2687)
• Updated translations with latest Crowdin changes. (#2691)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated mobile header elements for much better keyboard/screen-reader accessibility. (#2681)
• Updated translations with latest CrowdIn changes. (#2672)
• Updated WYSIWYG editor code-block handling provide a more stable undo/redo experience. (#2602)
• Updated AWS S3 SDK to fix incompatibility with Minio. (#2689)
• Fixed HTTP JSON detection when an encoding is in the response JSON content type. (#2684)

• Update instructions
• Update details on blog

Update Notices

Requirements Change - PHP 7.3 or greater is now required to run BookStack. If you previously installed BookStack using the 18.04 script, please see the details of this release in our update notes for the commands that should help you upgrade to PHP 8.

URL/Search-Filter Change - User profile pages, and user-based search filters, now use name-based "slugs" rather than being ID based. Any old links or instructions you may have for these elements may need to be updated.

Full List of Changes

• Added back-end theme system. (#2639)
• Added APP_VIEWS_BOOKSHELF .env option to set default view type within a shelf. Thanks to @philjak. (#2591)
• Added owned_by search filter. Thanks to @benediktvolke. (#2561)
• Added sorting for Books within Shelves. Thanks to @guillaumehanotel. (#2515, #1742)
• Added user filter to the Audit Log. (#2472)
• Added a healthcheck endpoint. (#2467)
• Added TLS support to the LDAP system. Thanks to @Body4. (#2376)
• Added .env variable to set default system light/dark mode option. (#2081)
• Added the ability to configure custom footer links via the settings screen. Thanks to @james-geiger. (#1973)
• Added create buttons to the books and shelves homepage view options. Thanks to @philjak. (#1756)
• Updated minimum required PHP version to 7.3 and added PHP 8.0 support. (#2648, #2388)
• Updated non-admin reference to users to be slug-based instead of id-based. (#2626, #2525)
• Updated file upload system to remove dots in the filename instead of simply preventing upload. Thanks to @Hecke29. (#2611, #2217)
• Updated the versioning system used by the project. (#2570)
• Updated export format to not include user and revision links in content meta details. (#2526)
• Updated docker development environment to work with our php tests and to fix permissions with the node service. Thanks to @Abijeet. (#2522, #2510)
• Updated the systems for loading code blocks to be quicker & more efficient, especially within the WYSIWYG editor. (#2518)
• Updated libraries used for revision diffs to provide much better performance with large amounts of content. (#2503)
• Updated user profile password fields to disable autocomplete. Thanks to @l1n. (#2484)
• Updated header so search is more commonly centered. (#2310)
• Updated "Move Page" interface to allow efficient keyboard navigation. (#2064)
• Updated our test-case files so they are less likely to trigger virus scan systems. (#1571)
• Updated WYSIWYG editor to include some bottom padding for readability. (#1075)
• Fixed issue where code blocks would not appear when within <details> HTML elements, added via the markdown editor. (#781)
• Fixed issue where the bookstack:update-url would not change the URL used for a custom header logo image. (#2546)
• Fixed issue where saving without any changes would still result in revisions being created. (#1846, #1737)
• Optimized and cleaned some core permission system components. (#2633)
• Removed mentions of unavailable mail mail driver from our files. (#2657)

• Update instructions

Full List of Changes

This release was primarily intended to fix a single issue:

• Fixed chapter and page book id misalignment that could occur when the page was in the recycle bin. Could cause some issues with permission generation which have also been addressed. (#2603)

• Update instructions

Full List of Changes

This release was primarily intended to fix a single issue:

• Fixed incorrect URL being used when using an s3-like file storage service. (#2603)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed issue thrown when deleting shelves from the recycle bin. Thanks to @i4j5. (#2543, #2534, #2530)
• Fixed issue where restoring a revision would restore as HTML instead of Markdown. (#2496)

As with the previous release (v0.31.4) this updates the Laravel framework version used to help avoid a potential vulnerability when requests were crafted in a certain manner. While it is not known if such a case exists in BookStack, this release updates the framework as a pre-emptive measure.

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated laravel/framework to prevent potential security vulnerability.

This security release updates the Laravel framework version, due to a vulnerability that could occur if request data was crafted and then used in a certain way. While it is not known if such a case exists in BookStack, this release updates the framework as a pre-emptive measure.

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated framework to prevent potential security vulnerability.
• Added WYSIWYG image options button back in, after accidentially removing in v0.31. (#2493)
• Updated Chinese Traditional translations. (#2482)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed issue where markdown strikethroughs were not rendering in the markdown editor. (#2470)
• Updated Turkish translations. (#2469)
• Updated some user, page and shelf views to use more efficient database querying.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated recycle bin nav header to be wider and not line break on some languages. (#2468)
• Updated Chinese, Italian & Russian translations. (#2464)
• Fixed issue where copying a page would not properly copy the contents. (#2463)
• Fixed issue where tables and task-lists, when saved in the Markdown editor, would not be converted to the page HTML output. (#2452)
• Fixed "FatalThrowableError" that could appear on failed user avatar fetch. (#2449)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Fixed issue where markdown content would not be stored on first page save (HTML content would still be stored). (#2446)
• Fixed issue where the new content owner fields were not be used for the manage-own-permission role permission. (#2445)
• Fixed recycle bin table style issue which could cause the dropdown menu to be cut-off. (#2442)
• Updated Chinese, Spanish and French translations. (#2441)

• Update instructions
• Update details on blog

Update Notices

Requirements Change - The minimum required PHP version has changed from 7.2 to 7.2.5. Additionally, the Tidy PHP extension is no longer required.

GitLab Authentication - The read_user scope will now be passed and is required on the "Application" setup within GitLab. Not having this scope may lead to errors when users attempt to authenticate via GitLab.

Security & IFrame Usage - By default BookStack will set headers to prevent usage within an iframe. You can set trusted iframe hosts through the ALLOWED_IFRAME_HOSTS option in your .env file. See the security page for more information on this option.

Full List of Changes

• Added recycle bin implementation. (#2283, #2183, #280)
• Added Norwegian translations to BookStack. Thanks to @Swoy. (#2336)
• Added ownership system for pages, chapters, books and shelves. (#2436, #2246)
• Added host iframe control with cookie security management. (#2427, #2207)
• Added API endpoints for pages. (#2382)
• Added many more activity types to the audit-log. (#2360, #1243)
• Added a sortable "Latest Activity" column to the users list. (#848)
• Replaced revision diff library so that the php tidy extension is no longer required. (#2347, #1553)
• Updated GitLab authentication to use the read_user scope. (#2359)
• Updated revision restore to add sensible default change summary text. Thanks to @rondaa. (#2353, #2349)
• Updated the "Cleanup Images" maintenance option wording for clarity. (#2352)
• Updated dev docker setup to install composer dependencies in Docker entrypoint. Thanks to @timoschwarzer. (#2298)
• Updated chapter delete behaviour so pages are removed instead of being moved to the parent book. (#2164)
• Updated grid-layout book/shelf item names to better fit into two lines. (#1469)
• Updated translations. (#2439, #2327)
• Fixed issue where the export dropdown may show cut-off with options hidden. Thanks to @shubhamosmosys. (#2416)

• Update Instructions
• Vulnerability Report
• Update details on blog

This release addresses an issue where page content could be visible to those without permission via the export options. The content of pages made non-viewable to a user via permissions, within a visible parent, could be seen via the plaintext export option. Before v0.30.6 this would have applied only to scenarios where all pages within the chapter were made non-visible. In v0.30.6 this would make all pages within the chapter visible.

Further details can be found in the vulnerability report.

• Update Instructions
• Vulnerability Report
• Update details on blog

This release addresses an issue where page content could be visible to those without permission. If a chapter was visible to a user, but all of it's pages were made not visible, then the details of these pages could be visible. Within the BookStack interface, the names of the pages and preview content could be seen. If the parent book was exported then this would include the content of the pages that had been restricted.

Further details can be found in the vulnerability report.

• Update Instructions
• Vulnerability Report: Server Side Request Forgery Through Content Exports
• Update details on blog

Phishing and and server-side request forgery vulnerabilities have been found within BookStack. Release v0.30.5 will remove this server-side request forgery issue while bringing updated wording and advisories to prevent the potential phishing vulnerability. You should ensure you've set the APP_URL option in your .env file to prevent likelihood of the phishing attack. Please view the above report or blogpost links for more detail.

• Update Instructions
• Vulnerability Reports:
  • Cross-Site Scripting and Redirects Through Page Content
  • Cross-Site Scripting Through Link Attachments
• Update details on blog

This release addresses XSS and user-injected auto-redirect vulnerabilities within the page content & attachment components of BookStack. These are primarily a concern if untrusted users can edit content on your BookStack instance. Please view the above report or blogpost links for more detail.

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Added VBScript syntax highlighting to the code block editor. Thanks to @nutsflag. (#2302, #2255)
• Fixed issue where drawings would not save in the Markdown editor. (#2313, #2321)
• Updated some Spanish and Chinese translations. (#2303)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated JavaScript build system to provide slightly better browser compatibility.
• Updated page-content save parsing to update anchor references on IDs changed by BookStack. (#2278)
• Fixed issue where creating a link attachment after mulitple validation failures would result in many duplicate links being created. (#2286)
• Updated drawing integration to, by default, use diagrams.net instead of draw.io. (#2285, #2044)
• Updated default .htaccess to align with laravel's and allow canonical redirects on non-root url app instances. Thanks to @jakubboucek. (#2272)

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated translations. (#2262)
• Updated settings header bar to adapt better for longer-text languages. (#2265)
• Updated callout link formatting to use callout text style rather than theme color. Thanks to @alexmannuk. (#2233, #303)
• Updated Book export content so that page includes are parsed. Thanks to @mr-vinn. (#2227, #2228)
• Fixed issue where the markdown editor preview pane would be empty. (#2280)
• Fixed incorrect spelling of "Ubuntu Mono" font definition. Thanks to @abulgatz. (#2274)
• Fixed incorrect AddActivityIndexes migration 'down' action. Thanks to @gertjankrol. (#2268)
• Fixed unexpected scroll bars on code blocks. (#2267)
• Fixed issue where notification would not shown upon SAML login where there's an existing non-matching user. (#2263)

• Update instructions
• Update details on blog

Update Notices

Security Notice - Possible Privilege Escalation

Thanks to @Defelo
it was advised that current privilege escalation situations are not made clear when applying role permissions.
Any user with a "Manage app settings", "Manage users" or "Manage roles & role permissions" system permission
assigned to one of their roles could technically alter their own permissions to gain wider access.
A clear advisory of these cases has been added in the UI in v0.30
but admins are advised to review which users have these permissions with the above in mind.

LDAP & SAML Group Matching - Potential Change

Thanks to @nem1989 it was found that
BookStack roles would be matched to LDAP/SAML groups based upon the role display name, which is expected,
but only those roles with a matching "name" value would be considered for this matching. This "name" field was redundant,
and has now been removed, but it would store a cleaned version the first-set name of the role.
All roles will now be considered before being matched on name which may mean that roles which did not sync before,
that would have been expected to based on their name, may now start to sync.

Full List of Changes

• Added API endpoints for chapters.
• Added audit log to the settings area. (#2173, #1167)
• Added the ability to insert an attachment link directly into the current editor window. (#1460)
• Added session-based code-block editor auto-save to prevent potential loss of content. (#1398)
• Added warning wording around role system permissions to indicate what permissions could allow privilege escalation. (#2105)
• Added the ability to log login failures to a file. Thanks to @benrubson. (#1881, #728)
• Updated Simplified Chinese translations. Thanks to @Honvid. (#2157)
• Updated WYSIWYG editor css to put editor in it's own layer to improve degraded dark mode performance. (#2154)
• Updated Czech translations. Thanks to @jakubboucek. (#2238)
• Updated permission system so that the permission map table does not contain ID's since database limits could be met in scenarios where permissions were automatically refreshed on a frequent basis. (#2091)
• Updated to role table in the database to remove a redundant name field which fixes issue where changing a role name would not change the name used to match with LDAP groups. (#2032)
• Updated URL slug generation to achieve a much cleaner result when non-ascii characters are used. Thanks to @drzippie. (#2165, #2026, #1765)
• Updated error reporting so that not-found errors are not written to the log, causing logs to fill much quicker than expected. (#2110)
• Updated dark mode styles to remove filters applied to images so that they display as expected. (#2045)
• Removed Vue.js from project & started standardisation of custom basic component system. (#2202)
• Replaced dev usage of node-sass with dart-sass. Thanks to @timoschwarzer. (#2166)
• Fixed issue where, upon role delete, users would not be migrated when specified to during role delete flow. (#2211)
• Fixed issue where the system would error on upload of images that contain a hash in the name. (#2161)
• Fixed scenario where page drafts would show as saved where request would actually fail, leading to loss of data. Added a browser-side storage mechanism for emergency use. (#2150)
• Fixed issue where LDAP groups would not sync on initial login due to the email confirmation system taking over before the group sync would run. (#2082)
• Fixed issue where the redirect upon login could lead to an external site. (#2073)
• Fixed low visibility of horizontal lines when dark mode is in use. (#2209)
• Fixed issue where HTML entities would be seen in page preview content. Thanks to @mr-vinn. (#2257, #2114)
• Fixed issue where previous page content would be indexed upon save instead of the fresh content. (#2042)
• Fixed issue where an error would be thrown on SAML logout request from the IdP. (#2002)
• Fixed bad pagination styling which would result in invisible numbering. (#1839)
• Fixed incorrect and misleading behaviour when saving a comment with no content. (#1836)

• Update Instructions
• Vulnerability Report

This release addresses issue #2111 where the name of a restricted book could be viewed by non-authorised users when the book was on a shelf, and the shelves were viewed in "List View". This could expose book names to those that did not have permission to see them, when part of a shelf.

• Update Instructions
• Vulnerability Report

This release addresses vulnerabilities in the comment system. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines.

This most impacts scenarios where not-trusted users are given permission to create comments.

After upgrading, The command php artisan bookstack:regenerate-comment-content should be ran to remove any pre-existing dangerous content.

• Update instructions
• Update details on blog

Full List of Changes

This release contains the following fixes and changes:

• Added multi-item select to the book-sort interface. (#2067)
• Updated authentication system to prevent admins being logged out when changing authentication type, useful when setting up LDAP or SAML. (#2031)
• Updated editor focus so that the title is ready-selected if the default, otherwise the editor is focused. (#2036)
• Updated translations for Dutch, Korean, French, Turkish, Spanish. Thanks to Crowdin Users. (#2028, #2071)
• Fixed issue where callout styles could not be cycled through via shortcut when in-callout formatting was selected in the editor. (#2061)
• Fixed issue where the selection area was not visible in code blocks or the markdown editor when using dark mode. (#2060)
• Fixed issue where callouts and code blocks would overlap floated images. (#2055)
• Fixed issue where no notification would show on an LDAP Login when email already exists. (#2048)
• Fixed API issue where "total" on a listing response would be incorrect when an offset was given. (#2043)

• Update instructions
• Update details on blog

Full List of Changes

• Added a user-selectable dark-mode option. (#2022, #1234)
• Added the ability to define a custom draw.io URL and therefore use a custom instance if preferred. (#826)
• Added grid-view support, with toggle, to the shelf view. Thanks to @philjak. (#1755, #1221)
• Added a list of bookshelves that a book belongs when viewing a book. Thanks to @cw1998. (#1688, #1598)
• Added a new command to update your BookStack URL in the database. (#1225)
• Added shelf API endpoints. Thanks to @osmansorkar. (#1908)
• Added book-export API endpoints.
• Updated password reset flows to avoid indicating if a email is in use within the system. (#2016)
• Updated WYSIWYG entity-link-insert to set link text to entity name, if input is empty. (#2014)
• Updated styles with better RTL support through the use of CSS logical properties/values. (#2003)
• Updated the name of saved drawings to not include the user's name, to prevent issues with non-standard characters. (#1993)
• Removed BMP and TIFF from the list of allows image upload types since these could not be resized properly. (#1990)
• Updated code-block insert to handle focus, so code blocks can be inserted smoothly via keyboard alone. (#1972)
• Updated namespacing used in tests to avoid warnings on recent versions of composer. (#1924)
• Updated Chinese translations. Thanks to @jzoy. (#2023)
• Updated translations for Turkish, Slovenian, Swedish, Spanish, Italian, Russian, German Informal, German, French, Chinese Simplified, Portuguese, Brazilian & Hungarian. Thanks to Crowdin Users.
• Updated default .htaccess to allow Authorization header for API usage. Thanks to @osmansorkar. (#1908)
• Updated GitHub authorization library to avoid use of deprecated auth methods. (#1879)
• Fixed issue where ordered list numbers could be cut-off. This was most apparent on Safari.(#1978)

• Update instructions
• Update details on blog

Full List of Changes

This release contains the following fixes and changes:

• Added Slovenian language support. Thanks to @mrjaboozy. (#1946)
• Added Vietnamese Language support. Thanks to @vuongtrunghieu (#1883)
• Added Hebrew Translations. Thanks to @Binternet. (#1827)
• Added support for Fortran language code blocks. Thanks to @JHenneberg. (#1878)
• Updated spacing in colour picker components to be consistent and prevent text-dropdown on longer-text languages. Thanks to @Statium. (#1943, #1930)
• Updated login and registration header actions to be consistent with other header links. Thanks to @Statium. (#1942)
• Updated install instructions and scripts to not install development composer packages. (#1928)
• Updated list styles to prevent additional margin/padding showing in nested lists. Thanks to @MikeyMJCO. (#1913, #1911)
• Updated Russian translations. Thanks to @kostefun & @Statium. (#1885, #1837)
• Updated translations for Vietnamese, Danish, Slovenian, Russian, German Informal; German, French, Czech, Swedish, Spanish, Hungarian, Portuguese, Brazilian, Japanese & Chinese Simplified. Thanks to Crowdin Users.
• Updated "Intended URL" logic to work when "Public Access" is enabled. Thanks to @Xiphoseer. (#1817, #1706)
• Fixed error that would throw if a user logs in with GitHub while having has a blank 'name'. (#1853)
• Fixed validation issues that could occur on image uploads in some environments. Thanks to @TBK. (#1900, #1570)
• Fixed 'interaction_required' response returned for the Azure login that would show when MFA is enabled. Thanks to @ch0wm3in. (#1889, #1903)

• Fixed side-effect in binary LDAP handling that was added in v0.28.1 (commit)

• Fixed issue where WYSIWYG editor would freeze when a code block is dragged. (#1901)
• Fixed shelf cover images not be stored on creation. Thanks @TBK. (#1899, #1897)
• Fixed css issue that prevented DOMPDF exports. (#1886)
• Fixed issue where breadcrumb dropdown menus would display error messages. (#1884)
• Fixed error that was thrown on LDAP login when no matching user was found. (#1876)
• Updated code block rendering to avoid showing an empty new-line at the end of a block. (#1877)
• Updated test email send functionality to capture and show any errors thrown. (#1874)
• Added ability to mark LDAP attributes as binary so they can be converted to hex for storage. (#1872)
• Added LDAP option to dump fetched user details to assist debugging. (#1872)

• Update instructions
• Update details on blog

Requirements Change

• Minimum required version of PHP has changed from 7.0.5 to 7.2.

Full List of Changes

Additions

• Added a baseline API implementation. (#1414, #1826)
• Added SAML2 authentication option. Thanks to @Xiphoseer. (#1787, #1576, #276)
• Added ability to override translations with custom text using the theme system. (#1749)
• Added the ability to customise application theme colours in settings. Thanks to @james-geiger. (#1723, #1380)
• Added ability to send test e-mails. Thanks to @timoschwarzer. (#1719, #1696)
• Added Pascal support for content code blocks. Thanks to @albergoniSivaf. (#1730)
• Added support INI syntax in code editor. Thanks to @c0shea. (#1667, #1648)
• Added event hooks for core editor setup actions. (#1721)
• Added a "Cascade Shelf Permissions" command to copy shelf permission to books. (#1091)
• Added ability to fullscreen markdown editor and improved mobile layout. (#1675)

Updates

• Updated focus outline to be a sensible width and consistent across browsers. (#1738)
• Updated page deletion flow so the user lands on the parent chapter if existing. (#1715)
• Updated book-create-cancel flow to return to shelf if that's the origin. Thanks to @cw1998. (#1687, #1662)
• Updated collapsible form sections to auto-open if containing validation errors. (#1693)
• Updated LDAP functionality to fetch gravatar upon registration. Thanks to @philjak. (#1746)
• Updated the login fields to autofocus on visit. Thanks to @almandin. (#1584)
• Updated PHP code block syntax highlighting to detect, and highlight, PHP code without opening <?php tags. (#1557)
• Updated registration settings to indicate non-used settings when LDAP/SAML is active and removed confusing overriding behaviour. (#1541)
• Updated image upload handling to prevent generated thumbnails being used if larger than original image. (#1751)
• Updated LDAP authentication to allow the attribute, that's stored and used as a unique identifier, to be configurable. (#592)
• Updated notifications to show a close icon. Thanks to @SoarinFerret. (#1845, #1525)
• Updated maintenance page to link to GitHub release page. Thanks to @DeftNerd. (#1462)
• Updated codeblocks so white-space is not trimmed. (#1771)

Translations

• Updated Traditional Chinese translations. Thanks to @johnroyer. (#1819)
• Updated Polish translations. Thanks to @artskoczylas. (#1804)
• Updated Italian translations. Thanks to @dellamina. (#1762)
• Updated Simplified Chinese translations. Thanks to @qianmengnet and @jzoy. (#1797, #1791)
• Updated Korean translations. Thanks to @ististudio. (#1734)
• Updated French translations. Thanks to @qligier. (#1695)
• Updated 'Spanish Argentina' translations. Thanks to @leomartinez. (#1681)
• Updated Turkish translations. Thanks to @oykenfurkan. (#1660)
• Updated Russian translations. Thanks to @kostefun. (#1646)
• Updated German translations. Thanks to @ezzra. (#1503)
• Updated translations for: Portuguese, Brazilian; Chinese Traditional; Chinese Simplified; Dutch; Italian; Ukrainian; Polish; Spanish; Hungarian; German; Turkish; French; Danish; German Informal; Russian; Korean; Spanish, Argentina. Thanks to Crowdin Users.

Maintenance

• Upgraded framework to Laravel 6. Thanks to @timoschwarzer and @JtheBAB for assisting with this. (#1641, #1600)
• Setup Crowdin to manage translations. (#1261)
• Refactored entity repository code & refactored core controllers. (#1690)
• Aligned authentication service functionality, config & behaviour. (#1866)

Fixes

• Fixed issue where base64 images would paste as text. (#1697)
• Fixed issue where pasted images would not auto upload in some circumstances. (#1651)
• Fixed issue where code block content would be hidden until clicked. (#1672)
• Fixed a possible middleware exception. Thanks to @abublihi. (#1793)
• Fixed issue where a shelf image may not be assigned properly. Thanks to @philjak. (#1735)
• Fixed missing git dependency in developer docker setup. Thanks to @ammardev. (#1698)
• Fixed issue where inline code blocks could overrun the page and cut-off. Thanks to @james-geiger. (#1587, #1575)
• Fixed missing translations for "actions". Thanks to @ezzra. (#1502)

• Fixed overlapping text on book sort box. (#1654)
• Fixed issue where comments could not be deleted. (#1650)
• Improved the logic used to animate slide-up/slide-down sections to help prevent them getting stuck. (#1643)

• Fixes UI issue that make book quick-sort options not be clickable. (#1639)
• Updated Russian translations. Thanks to @kostefun. (#1637, #1636, #1635, #1630, #1629, #1628, #1627, #1626, #1624)
• Updated Spanish translations. Thanks to @moucho. (#1633)
• Updated 'Spanish Argentina' translations. Thanks to @leomartinez. (#1623)

• Fixed issue where images could not be pasted due to incorrect handling of FormData requests. (#1621)

• Fixed issue where the URL generation logic could use an incorrect scheme to that set via APP_URL. (#1613)

• Fixed issue causing the markdown editor to not display a preview in Firefox.
• Fixed issue causing page popover edit button icon not to show. (#1616)
• Fixed export style issue causing grey backgrounds to be shown.

• Update instructions
• Update details on blog

Full List of Changes

• Reviewed accessibility of BookStack to move towards WCAG 2.0 Support. (#1320, #1476)
• Added page templating functionality. (#129, #1527)
• Added the ability to send a new user a sign-up link where the user can set their own password. (#316)
• Added docker development environment. Thanks to @timoschwarzer. (#1504)
• Added the ability to set seperate storage types for Images and Attachments. (#1302)
• Added Hungarian translations. Thanks to @miles75. (#1554, #1573)
• Added notice to the "Custom HTML Head Content" setting to advise it does not apply while on the settings page. (#1144)
• Updated entity permissions table so it's hidden unless custom permissions are enabled to prevent confusion. Thanks to @timoschwarzer. (#1505)
• Updated French translations. Thanks to @lucaguindani. (#1485)
• Updated German translations. Thanks to @danielroehrig-mm. (#1561)
• Updated Brazilian Portuguese translations. Thanks to @DeehSlash. (#1534)
• Updated HTML code of base templates with locale definition. Thanks to @kostasdizas. (#1486)
• Updated the debug bar so it does not show unless explicitly enabled. (#1508)
• Updated entity colors so they can be easily overridden.
• Updated page navigation so full headings are included in the output but then truncated via CSS which can be overridden. (#1206)
• Updated markdown editor to render the preview in a sandboxed iframe that does not run JavaScript. (#1531).
• Re-wrote URL generation system to avoid incorrect redirects occurring during certain actions such as login and list view change. (#1536, #1459)
• Made it possible to run phpunit via the composer-installed copy. (#1555)
• Moved 'config' directory into 'app' directory to avoid confusion. (#1506)
• Redesigned front-end translation system to prevent an addition HTTP call on each page load. (#1258)
• Fixed issue causing main menu to be hidden by the page editor at certain widths. (#1556)
• Fixed missing word in social account description text. Thanks to @bjubes. (#1517)
• Fixed print CSS to work with the recent design changes. (#1472)
• Fixed sidebar layout issues on mid-level screen sizes. (#1434)
• Fixed issue that prevented scrolling in the WYSIWYG editor on iOS devices. (#1058)
• Fixed issue where multi-byte characters would not render correctly in the sidebar. (#1172)
• Fixed incorrect page navigation indentation. (#542)
• Removed use of babel and css autoprefixer from dev build system for faster builds. (#1468)
• Removed jQuery and replaced jQuery-based libraries.

Update instructions

The release enhances the security of BookStack in a few different areas:

• Updated user profile behaviour so that users cannot change their email address unless they have permission to manage users. This is to prevent a user acting as an imposter, changing their email to one they don't own. Thanks to @Irrational-NX for raising.
• Improved the script escaping logic that was enhanced in the previous release, by also checking for iframes using javascript or data urls. Thanks again to @billford for raising this issue. (#1531)
• Updated the provided, and added an additional, .htaccess file to prevent apache indexes from listing image directories. Thanks to @davidtessier for raising.

This release improves the escape logic for scripts that have been placed in page content. Thanks to @billford for raising this issue. (#1531)

• Updated Russian translations. Thanks to @kostefun. (#1446, #1445, #1444, #1443)
• Updated Dutch translations. Thanks to @NootoNooto. (#1437)
• Updated page navigation to exclude empty heading items. (#1429)
• Updated custom-homepage views to display more consistently. (#1423)
• Updated image uploads to resize at double the previous resolution. (#1108)
• Fixed issue where chapter description would not show on book export. (#1465)
• Fixed page navigation to work on when used on mobile screen sizes. (#1454)
• Fixed issue casing a redirect to the 404 page upon login. (#1452)
• Fixed missing search bar on mobile search page. (#1450)
• Fixed issue where a page could be deleted when previously set as the homepage option. (#1447)
• Fixed issue causing horizontal scrollbar to show on some mobile views. (#1441)
• Fixed text shown on 'Info' mobile tab being overly faded-out. (#1441)
• Fixed issue where some UI elements would shown over the page editor when in mobile full-screen mode. (#1424)
• Fixed issue where pasting table content would insert as an image instead of a table or text. (#987)
• Fixed issue where book description would not show if it contained multi-byte characters. (#816)

• Updated Swedish translations. Thanks to @Hambern. (#1433)
• Updated Spanish translations. Thanks to @moucho. (#1420)
• Updated Ukrainian translations. Thanks to @Mant1kor. (#1419)
• Updated tabbing order on login forms to be consistent and as expected. (#1418)
• Fixed issue where "Toggle Details" Button does not properly save state when using the Guest user. (#1431)
• Fixed issue where editor image paste, and markdown drawing insert, would fail with an error. (#1428)
• Fixed styling of card headers on the 404 page. (#1427)
• Fixed issues where Book names could leak via the shelves listing when set as the homepage option. (#1425)

Special thanks to @Bolthier for providing many good, detailed, bug reports since yesterday's release.

• Update instructions
• Update details on blog

Upgrade Notes

Internet Explorer Support - IE11 Support has now been dropped. We may support any critical issues for view-only scenarios otherwise please use a modern browser.

Translations - Since many interfaces and lines of text have been updated, It may take a little while for some translations to catch-up. Expect to see more English text than usual if you're using a non-English language option.

Images - Due to changes how images are handled, as detailed below, some types of images may become inaccessible. Old logo images will be deleted when changed. Unused Book/Shelf cover images & User profile images will be become inaccessible after the update so you may want to delete them before upgrade.

Security - On previous versions of BookStack it was possible for users to insert JavaScript via the Markdown editor using on* html attributes. These will now be removed on page render unless you have set ALLOW_CONTENT_SCRIPTS=true. If untrusted users has access to your BookStack you may want to scan for <<space_char>>on in the HTML column of the pages table to identify any malicious intent.

Full List of Changes

• Updated the application design for better mobile functionality and improved general UX. (#1153)
• Updated how profile, system & cover images are set & added extra permission checks on image actions. (#1410, #1307, #1128)
• Added the possibility to create a book directly within a shelf. Thanks to @cw1998. (#1366, #1260)
• Added sign-up link to login form and fixed differing name validation on sign-up. Thanks to @cw1998. (#1395, #1239)
• Added code block syntax highlight for OCaml, Haskell, Rust. Thanks to @XVilka. (#1344)
• Updated page content script escaping logic to strip inline JS event attributes. Thanks to @Xiphoseer for reporting.
• Updated revision restore to require confirmation and changed the method from GET so it's less likely to be accidentally triggered. (#1321)
• Updated shortcut used for markdown drawing manager to be cross-platform. (#1228)
• Updated Swedish translations. Thanks to @Hambern. (#1417)
• Fixed issue where duplicate ID's could sometimes break pages. (#1393)
• Fixed issue where user role assignments were not remembered, for roles with a dot in the name, on validation failure. Thanks to @cw1998. (#1392, #1325)
• Fixed issue where the port would be ignored if a full LDAP server URI was used. (#1386, #1278)
• Dropped IE11 support. (#1164)

This release works on the changes from v0.25.4 and v0.25.3 to include additional security measures on file uploads.

For this release, Uploaded image files which have a name that includes more than a single extension are prevented from being uploaded since these could be used to upload executable files on some web-servers. In addition, Attachment uploads are now saved with randomly generated file names to make such upload operations safer to file name exploits.

Additional Changes

This release also contains the following translation updates:

• Added Czech translations. Thanks to @cima. (#1347)
• Updated russian translations . Thanks to @agvol. (#1348)
• Updated 'Spanish Argentina' translation. Thanks to @leomartinez. (#1327)

This release patches a security vulnerability that allowed PHP files, using a non-.php extension, to be uploaded via image upload endpoints. The PHP files could then be called externally to perform malicious activity.

This is a continuation upon the security updates enforced in v0.25.3. Please see that release for further information on this kind of vulnerability.

This update applies a whitelist to file extensions for uploaded images to ensure php-like files, such as .phtml or .php3, cannot exploit web servers that execute such files.

This release patches a security vulnerability that allowed PHP files to be uploaded via image upload endpoints. The PHP files could then be called externally to perform malicious activity.

This is particularly an issue in environments where untrusted users have the necessary permissions to upload images.

Please consider that malicious exploitation of this vulnerability may have allowed access to other files on your server that the PHP process has access to, Including your BookStack .env file, so consider updating any passwords or keys if you think this had a possibility of being exploited on your instance.

It is advised you update your BookStack instance as soon as possible.

This release contains the following fixes and changes:

• Added PowerShell code highlighting to code blocks. Thanks to @christophert. (#1263, #1040)
• Added LUA code highlighting to code blocks. (#1223)
• Added LDAP option to set a custom "Display Name" property. Thanks to @dfanara. (#1317, #1306)
• Added possibility to set a password for Redis connections. (#1283)
• Updated front-end file upload size limit to be configurable. (#1293)
• Updated Dutch translations for the password hint. Thanks to @maantje. (#1314)
• Updated image paste/drop uploads to properly set page relations so image permissions are active. (#1287)
• Updated German translations to include translations for shelves. Thanks to @Xiphoseer. (#1272)
• Updated permissions checked for "Page Copy" function to be more accurate to what permissions are actually required. Thanks to @mark-james. (#1202, #1199)
• Updated permissions checked for the "Shelves" header item to be visible. Now takes into account custom shelve-level permissions. (#1201)
• Fixed bug where using alignment properties could break tables. (#1284)
• Fixed issue where default system language would not be reflected when viewing another user's profile. (#1316)
• Fixed issue where image-manager tooltips could be cut-off. Thanks to @Abijeet. (#1238, #1186)

This release contains the following fixes and changes:

• Updated revision listing so dates can show localised if the relevant locale is installed on the host system. (#1214)
• Added support for s3 compatible storage services such as Minio. (#1195, #1192)
• Updated Google authentication to not use Google+ API. (#1190)
• Fixed "Rubber banding" effect when scrolling in certain conditions when comments were disabled. (#1218)
• Fixed isssue causing only show a single page to show when using Firefox's print option. (#1211)

Requirements Change - Minimum required version of PHP has changed from 7.0.0 to 7.0.5.

Configuration Change - The .env option GRAVATAR_URL=false has been replaced by AVATAR_URL=false.

• Update instructions
• Update details on blog

Full List of Changes

• Added Ukrainian translations. Thanks to @Mant1kor. (#1183)
• Added German informal translations. Thanks to @ezzra. (#1159, #890)
• Updated Polish translations. Thanks to @vasiliev123. (#1180)
• Updated Spanish translation formatting. Thanks to @moucho. (#1197)
• Added proper escaping to LDAP authentication variables. (#1163)
• Added anchor links to user profile sections and added "Register" to header for guest users. Thanks to @qianmengnet. (#1146)
• Added configurable timeout for file & image uploads. Thanks to @Abijeet. (#1133, #876)
• Added system to prevent the last admin from removing themselves as an admin. (#1124)
• Added link to manage users in header if user has permission to do so but does not have permission to change system settings. Thanks to @cw1998. (#1119, #1110)
• Added support for custom avatar provider. Thanks to @Vinrobot. (#1111)
• Added option to disable LDAPS Certificate Validation. Thanks to @christophert. (#1065)
• Added testing coverage to user avatar fetching. (#1193)
  (#1096)
• Updated times in page exports to use absolute time formats instead of relative formats.
• Updated "Move" operations so that "Delete" permissions are required on the item being moved. (#1200)
• Updated page preview/search system to prevent leaks in included content when permissions are set on included content. (#1178)
• Re-enabled missing plaintext copies on system-generated emails. (#1182)
• Improved 'SQL' code block highlighting. (#1181)
• Simplified ".env.example" file and created full example version. (#1205)
• Fixed WYSIWYG editor issue that could reset cursor position on code block click. (#1162).

• Fixes image deletion failing in subdirectory. Thanks to @Abijeet. (#1143, #1092)
• Updated 'Spanish Argentina' translations. Thanks to @leomartinez. (#1117)
• Updated German translations. Thanks to @CliffyPrime. (#1072)

• Added Korean translations. Thanks to @limkukhyun. (#1066)
• Added option to Google authentication to force account selection. Thanks to @justein230. (#1063)
• Updated Brazilian Portuguese translations. Thanks to @DeehSlash. (#1034)
• Updated Chinese translations. Thanks to @qianmengnet. (#1109)
• Updated French translations. Thanks to @TheLastOperator. (#1098)
• Updated Traditional Chinese translations. Thanks to @kejjang. (#1088)
• Markdown editor now wraps images with link to original file on insert. Thanks to @thomasjsn. (#1064,#1062)
• Fixed incorrect login redirect if using BookStack on a sub-path. ((#1048,#956))
• Updated laravel to fix compact() issue on page load when using PHP 7.3. (#1095)
• Major re-structure to many core parts of the application back-end code.
• Updated all JavaScript modules to use ES6 import/export instead of require syntax.

• Fixed update database issues with certain role configurations and database types. (#1027)

If you previously experienced issues upgrading to v0.24 please try following the update commands again to update to v0.24.1.

• Update instructions
• Update details on blog

Full List of Changes

• Added bookshelves, A level above books. (#947, #1023, #95)
• Added ability to remove particular revisions. Thanks to @Abijeet. (#1008, #784)
• Added social auto-registration option.
  Thanks to @ibrahimennafaa. (#966, #574, #572, #477)
• Added Arabic language and initial RTL language support. Thanks to @kmoj86. (#945, #939)
• Added ability to scroll past the end in the Markdown editor. (#1020)
• Updated default cookie name and made configurable via .env file. (#1018)
• Updated revision limit to be configurable. (#1004)
• Updated export templates to include custom styles. (#981)
• Updated database migrations so MyISAM engine is never forced and so that fulltext index support is not required. (#726)
• Updated Spanish translations. Thanks to @moucho. (#1025, #1021)
• Updated German translations. Thanks to @vriic. (#983, #1026)
• Updated Russian translations. Thanks to @mullinsmikey. (#1002)
• Updated Brazilian Portuguese translations. Thanks to @DeehSlash. (#986)
• Fixed chapter content dropdown acting unreliably. Thanks to @Abijeet. (#1009, #960)
• Fixed duplicate role attachment database error that could occur on LDAP group sync. (#1003)
• Fixed issue in WYSIWYG editor where the "No color" option would disappear or not be present. (#999)
• Fixed issue where code block content may be hidden by the copy button. (#980)
• Fixed issue in WYSIWYG where it could be hard to escape a blockquote section. (#961)
• Fixed hardcoded English text in search page. (#864)
• Fixed issue causing Safari to download items as .dms files. Thanks to @ajvolin. (#581)

• Fixed LDAP group sync fail that could occur if your user filter was not uid based. (#959, Credit to @yoyokko)

• Added .env option to disable public user locale autodetect. (#944)
• Updated Spanish translations. Thanks to @moucho. (#957)
• Updated 'Spanish Argentina' translations. Thanks to @leomartinez. (#952)
• Updated Chinese translations. Thanks to @houbaron. (#948)
• Updated Swedish translations. Thanks to @marcusforsberg. (#942)
• Fixed error that could be thrown when mapping LDAP groups. (#951)
• Updated composer dependencies.

Full List of Changes

• Added LDAP group sync. Thanks to @brennanmurphy. (#911)
• Added Discord as social login provider. Thanks to @lommes. (#904, #903)
• Added ability to select a particular section of a page to edit. Thanks to @Abijeet. (#875)
• Added copy icon & functionality to codeblocks (#858)
• Updated French translations. Thanks to @nicobubulle. (#933)
• Updated German notification translations. Thanks to @alex2702. (#925)
• Updated Brazilian Portuguese translations. Thanks to @DeehSlash. (#918)
• Updated 'Spanish Argentina' translations. Thanks to @leomartinez. (#886)
• Updated Spanish translations. Thanks to @moucho. (#865)
• Updated dates shown in the image-manager to be much cleaner. Thanks to @Abijeet. (#907)
• Fixed permission bug causing page create to fail within chapter if lacking permissions to view the parent book. (#912)
• Fixed issue with code not wrapping on revision page. Thanks to @Abijeet. (#906, #888)
• Fixed error notification briefly showing on initial load. (#897)
• Fixed incorrect and confusing attachment deletion behaviour. Thanks to @Abijeet. (#892, #884)
• Fixed undefined error when clicking on link under page navigation. Thanks to @Abijeet. (#874, #873)

Full List of Changes

• Added setting to set the Books view as the homepage. Thanks to @Abijeet. (#615,#830)
• Updated German translations. Thanks to @vriic. (#851)
• Updated Spanish translations. Thanks to @moucho. (#846)
• Updated Swedish translations. Thanks to @marcusforsberg. (#802)
• Ubuntu 18.04 install script now available. (#850)
• Updated tag and details design in sidebar to be more compact and cleaner. (#838)
• Drawings now create new image records instead of overwriting existing content. (#837, #770)
• Added new 'Maintenance' area to settings with option to clean-up images. (#837)
• Updated design of image manager and fixed search-cancel button to not always clear all images shown. (#837)
• Updated back-to-top button to not show on not scrollable pages such as the edit view. (#824)
• Added .env option to set Secure/HTTPS only cookies. (#817)
• Updated link attaching to allow any link types, Not only links matching a set pattern. (#812)
• Updated Secure Images setting to not alter names of uploaded images, Only their paths.
• Fixed relative CSS references causing WKHTML PDF exports to fail. Now callout icons will show in exports. (#796)
• Fixed issue with c-like languages not highlighting correctly in code blocks. (#849)
• Fixed design bug causing search icon to overlap input in header. (#859)

Full List of Changes

• Added the ability to insert videos via the WYSIWYG editor. Thanks to @Abijeet. (#768#266
• Added the ability to copy a page. (#673)
• Rolled out tag system to chapters and books. (#121)
• Updated export image processing to include images when using "local_secure" option. (#786)
• Robots.txt file is now dynamic and configurable. (#779)
• Added traditional Chinese translations. Thanks to @jasoncheng7115. (#780)
• Updated Spanish translations. Thanks to @moucho. (#783)
• Updated 'Spanish Argentina' translations. Thanks to @leomartinez. (#806)
• Updated German translations. Thanks to @abno85. (#798)
• Updated Japanese translations. Thanks to @msaus. (#767)
• Updated 'Reset Password' flow with newer design (#800)
• Fixed issue where old books would not update with cover image on save. (#773)
• Added proper permission checking when moving pages and chapters (cdb1c7ef)

• Fixed CSS file references for Book & Chapter exports (#774).

This release contains the following fixes and changes:

• GIF images now animate as expected. Thanks to @Abijeet. (#755,#223)
• Improved image manager uploader user-experience with many fixes and tweaks. Thanks to @Abijeet. (#754,#741)
• Added toggle-able JavaScript escaping on page render. (#575)
• Updated book/page/chapter create urls to prevent conflicting with entity names. (#758)
• Updated all icons to SVG in a way that can be override via theming. (#704)
• Updated dependencies so the project works correcting after installing with composer install --no-dev. (#742)
• Update to Japanese translations. Thanks to @msaus. (#761)
• Update to French translations. Thanks to @Alwaysin. (#753,#752)
• Update to Italian translations. Thanks to @cipi1965. (#743)
• Update to Polish translations. Thanks to @artur-trzesiok. (#718)
• Update to 'Spanish Argentina' translations. Thanks to @leomartinez. (#709)
• Added ability to configure email sender name. Thanks to @duncanbarnes. (#711)
• Added CACHE_PREFIX to the .env.example file. Thanks to @pataar. (#714)
• Updated form styling to be little cleaner.
• Improved search efficiency, by reducing required DB queries, and tweak search scoring to weight entities. Books > Chapters > Pages
• Converted CSS/JS build system to webpack.
• Fixed page preview text showing whitespace causing a lot of wasted space in listings. (#739)
• Fixed issue where app logo would not load when using secure local images. (#725)
• Fixed incorrect cursor position after pasting an image in the Markdown editor. (#751)
• Fixed markdown editor resizing with long strings. Thanks to @BackwardSpy. (#716,#715)
• Fixed error that could occur due to search results clashing with Vue syntax.

Full List of Changes

• Added Draw.io integration. (#632, #66, #619)
• Added language - Swedish. Thanks to @marcusforsberg. (#679)
• Added language - Simplified Chinese(zh-CN). Thanks to @yuezhihan. (#696)
• Added GitLab authentication. Thanks to @jozefbalun. (#691, #476, #349)
• Added Twitch authentication. Thanks to @moutonnoireu. (#684, #680)
• Added ability to secure images behind authentication. (#665)
• Added button to allow quick switching between grid and list book views. Thanks to @Abijeet. (#635, #613)
• Added utility command to delete all users from the system. Thanks to @Abijeet. (#621, #579)
• Added utility command to add an admin user. (#609)
• Added '.env' option to set default books view. (#675)
• Updated book sort operation to check permission of all involved entities before sorting. Thanks to @Abijeet. (#651)
• Updated books 'Grid' view so it now uses CSS grid so books align in height. (#701)
• Standardised PHP code to follow PSR-2. (#649)
• Corrected the example configuration for okta auth. Thanks to @lommes. (#692)
• Fixed long code block lines going off the page on PDF exports. (#676)
• Fixed long text pushing out the view width on mobile devices when viewing books and chapters. (#669)
• Fixed bug causing markdown editor preview to collapse. (#658)
• Fixed bug causing page to refresh when clicking search in the image manager. (#697)
• Fixed styling issue preventing code editor save button from showing on smaller-screen devices. (#650)
• Fixed error thrown when user accesses an attachment without permission. (#681)
• Fixed font-size difference between list types in comments. Thanks to @Abijeet. (#644, #643)
• Fixed content includes to not break code structure if targeting a table or list. (#640)

For this update the minimum PHP version has changed from 5.6.4 to 7.0.0

Full List of Changes

• Added book cover art and grid display view. Thanks to @bharadwajag, @nileshdeepak and @AbijeetP. (#181, #494)
• Added ability to disable comments. Thanks to @Abijeet. (#593, #541)
• Added Okta authentication option. Thanks to @lommes. (#598)
• Added page navigation highlighting on page scroll. Thanks to @Abijeet. (#580, #466)
• Updated Laravel framework to 5.5. (#590)
• Added CTRL+Enter shortcut to "Save and continue" when editing a page. (#604)
• Fixed WYSIWYG rendering issues when in fullscreen mode. (#605)
• Updated custom head content to also function within the WYSIWYG editor. (#562)
• Set up a simple tool to assist with translation management. (#373)
• Added way to specify trusted proxies. (#146)

• Fixed issue where email confirmation was not forced when domain restriction was enabled. (#573)

This issue meant that if you have domain restriction enabled on sign-up, and you did not enable email confirmation, a user could sign up via email (Using an approved email domain) but then login right away without confirming they own the email.

It is suggested that if you had email confirmation disabled but domain restriction enabled you check all user accounts to ensure they are legitimate. This change may also mean that, after updating, some users will need to confirm their email address to access the BookStack instance.

This release also contains the following fixes and changes:

• Prevented duplicate hypens in generated slugs. (#589)
• Fixed url slugs when multi-byte characters are included. Thanks to @wowkaster. (#582)
• Allow custom session lifetime expiry. (#570)
• Fixed tag suggestions not functioning when BookStack is on a URI sub-path. Thanks to @10bass. (#563)
• Updated pt_BR translations. Thanks to @lbguilherme. (#558)

• Fixed editing/viewing content with include tags. (#553)
• Fixed markdown editor width growing with very wide content. (#552)
• Added check to prevent homepages being deleted. (#546)
• Updated search system to split words at more characters. (#531)

• Improved image fetching for exporting. A hopeful solution to #392.

• Updated code colorscheme to highlight shell commands. (#535)
• Prevented homepage item 'details' overflowing out of the lists. (#533)
• Improved search indexing to better split words apart. Fixes words at the start of sentances not being searchable. (#531)
• Updated Italian translations. Thanks to @cipi1965. (#529)
• Updated Russian translations. Thanks to @turbotankist. (#528)
• Update Dutch translations. Thanks to @sanderdw. (#523)
• Removed trailing spaces from input to achieve cleaner URLs. (#526)
• Migrated all AngularJS code. Results in much less JavaScript. (#524)
• Added Office 365/AzureAD as a social auth option. (#509)
• Added search filter to sort pages by last commented. (#440)
• Fixed issues where shortcuts would overwrite 'Alt-Gr' based character input. (#330)

Full List of Changes

• Added commenting system (Thanks to @Abijeet, #261, #47).
• Large project-wide design revamp (#480).
• Switch all fonts to use system fonts (#423).
• Added Italian Translations (#501, Thanks to @cipi1965).
• Updated German Translations (#474, Thanks to @timoschwarzer).
• Updated Japanese Translations (#483, Thanks to @msaus).
• Improved customization options:
  • Added setting for a custom homepage to be set (#372, #126).
  • Made it possible to override codemirror (Code block) theme (#455).
  • Added docs instructions for overriding BookStack fonts (#423).
• Converted most of the angular code to Vue.JS or vanilla JS.
• Updated some views to support better cross-language pluralization (#417).
• Fixed design bug with long attachment names (#460).
• Fixed issue with markdown callout shortcut producing bad HTML (#470).
• Fixed broken quick-save shortcut in WYSIWYG editor (#467).

• Added breadcrumbs to pages in entity select dialog. (#391)
• Fixed redirect issues in search system. (Thanks @10bass) (#448)
• Improved French translations. (Thanks @Joorem) (#446)
• Added newline support in chapter and book descriptions. (Thanks @Claymm) (#438)
• Added Polish translations. (Thanks @JachuPL) (#435)
• Updated and expanded editor keyboard shortcuts. (#85)

• Fixed issue with page text generation from previous release.
• Updated LDAP testing.

• Made UTF8mb4 upgrade manual with command. Details here. (#425)
• Improved responsiveness of breadcrumbs. (#426)
• Fixed code blocks when exporting as PDF and using DOMPDF. (#427)
• Updated page preview snippets to show included content. (#442)
• Updated dropdowns to hide upon option click. (#429)

• Fixed use of base LDAP domain when using with AD (#317)
• Fixed bug causing text to not be copied from markdown editor (#424)

Due to database charset changes, Migrations may take a little longer than usual

Full List of Changes

• Code display/edit changes: (Fixes #382, #346, #296)
  • Highlight.js replaced with codemirror instances.
  • Custom code block system built for TinyMCE editor.
  • Markdown editor revamped with codemirror instance.
• Japanese language support added (Thanks to @S64).
• Database charset changed from utf8 to utf8mb4 to support emoji. (#405)
• Tests added to cover previous permission bug. (#409)
• Empty state actions ('Create new page', 'Create Chapter') in books will now hide for users without permission. (#411)
• Fixed some inconsistent padding in the subheader toolbar.

• Removing permissions from a role will not take effect.

Running php artisan bookstack:regenerate-permissions from the BookStack install folder is advised to ensure all permissions are set correctly.

• Fixed permission system bug when using a non-native MySQL PHP driver (#383)

• Fixed permission updates on large books failing due to MySQL placeholder count (#374)
• Added functionality to check 'Accept-Language' header to provide translations when not logged in. (#375)
• Added HTML support back into the Markdown editor. (#378)
• Refactored permission system for general speedups.

Full List of Changes

• New search system with new search filter system.
  • New UI for searching content.
  • Fixes issues with search terms that are short or contain accents.
• Added spell checker support to WYSIYG page editor. (Thanks to @Abitjeet).
• Page revision ID/Count system added.
• Slovak translations added. (Thanks to @jendrol).
• Spanish translations updated. (Thanks to @diegoseso).
• The page navigation highlighting will now fade out.
• Option to configure logging method added. (Thanks to @solidnerd).
• Switched out markdown renderer library to markdown-it:
  • Fixes ability to have brackets in markdown urls.
  • Allows backslash escaping in markdown tables.
• Updated permission system with ability to hide parent items and have the child be visible.
• Confirmation emails may now be queued (Thanks to @DaneEveritt).

• Fix for bug preventing revision restoration.
• Fixed back button behaviour on book create/edit forms.

• Partial Spanish and Dutch translations implemented (Thanks to diegoseso and arietimmerman).
• Updated how JavaScript translations are fetched to prevent conflicting webserver rules.
• Updated user edit page to be more responsive and fixed 'Cancel' button for non-admin users.
• Improved testing coverage of language system.

• Updated update script so cached app files do not break upgrading from BookStack versions before v0.15

Full List of Changes

• Export options added for books and chapters.
• Added Slack, Facebook & Twitter signin/signup options.
• Added list checkbox support to the markdown editor.
• Added commands to clear revisions and activity.
• Allow custom LDAP email attribute to be set.
• More complete German translations added (Thanks to ReeseSebastian).
• Changed callout styling slighlty to prevent the icon being wrapped by text.
• Increased testing coverage for sorting operations.
• Fixed issue preventing page revisions from being viewable when not an admin.
• Prevented custom HTML from being inserted into the settings page to allow fixing bad input.
• Updated Laravel framework to 5.4.
• Cleaned login/register design up with better social icons.

• On 404 page/chapter/book names were visible. No content of those items were visible, just the names. This included on instances that had 'public viewing' turned off.

Sincere apologies for this issue.

• Missing Subscript Styling (#284)
• Fixed book contents not showing in some instances (#287, #294)
• Fixed possible issue with bad user thumbnails (#292)

• Possibility that all permissions could be deleted on book sort. (#282)

If this issue happens permission can be regenerated via the command line using php artisan permissions:regen from your BookStack install folder.

Full List of Features, Changes & Fixes

• Added full support for mulitple languages.
• French & Brazillian Portuguese languages added (Thanks to sirgix and NakaharaL).
• Added support for page/page-content includes within other pages.
• Added support for using the database to store the cache and session.
• Added option to use WKHTMLtoPDF for improved PDF rendering. Details here.
• Added auto-linking in the WYSIWYG editor.
• Updated page nav to scale if only smaller headers are used.
• Fixed bug causing offset first lines in code blocks when using the markdown editor.
• Fixed issue preventing non-admin users from deleting images or attachments.
• Fixed page navigation not working on some browsers when the link contains special characters.
• Fixed issue where panes could be blank if the default app color was used.
• Fixed page link popover copy button to work on modern non-flash-enabled browsers.
• Increased testing coverage of social authentication methods.
• Standardised breadcrumbs across BookStack views.
• Refactored entity code and permissions code to be more efficient.
• Updated LDAP config to allow a protocol to be defined which allows use of ldaps connections (Thanks to fredericmohr).

• Moved page tag display to the sidebar to prevent visual positioning issues with other elements.
• Fixed broken callout display. #238
• Fixed social login/registration which was broken in the last update. #239

Update instructions can be found here.

Detailed update information can be found on our blog here.

New Features

• Added page attachment system.
• Added page revision diff view (Thanks younes0).
• Added permission controls and visible role & user for non-authenticated visitors.
• Added page navigation to page sidebar.

Changes & Bugfixes

• Added settings for showing app name in the header bar.
• Base framework updated to Laravel 5.3.
• Sign-up & Password reset emails have been updated to be standardised and fit in with the new Laravel 5.3 notifications system.
• Allowed a wider range of UTF8 characters to be used as page/chapter/book slugs.
• Ensured new user Gravatar/Signup email requests fail gracefully.
• Tweaked page headers to allow a greater range of sizes.
• Added page auto-save failure notification (For if you go offline during a page edit).
• Changed versioning system so app version will no display correctly in settings.
• Added initial support for German translations (Thanks robertlandes).
• Fixed tag & number search.

• Fixed callouts from overflowing over tags. #179
• Fixed ordered list numbers being cut off over two digits (Now allows up to 3 digits). #204
• Fixed table width in PDF exports, They are now made to go full-width. #203
• Improved reset password UI with additional notifications and links. #210
• Fixed custom HTML head content to show on public pages. #211
• Fixed search when a search term only contains punctuation. #212
• Fixed links on emails to not be relative but contain a full link. #218

Update instructions can be found here.

• Updated TinyMCE (WYSIWYG Editor) version to latest to get latest fixes.
• Updated new WYSIWYG editor shortcuts to prevent clashes with save shortcut and to make use of a mac's command key. The inline code shortcut has changed from (Ctrl+s to Ctrl+Shift+E).
• Changed the styling for tables to prevent cutting of words on IE/FF and to hopefully be more predictable.

Update instructions can be found here.

Detailed update information can be found on our blog here.

New Features

• Edit summary text can now be set when editing a page. The list of summaries can be seen in the page revisions. Thanks @younes0
• Added a Book/Chapter/Page link selector to both page editors.
• Added image paste and image file dropping to the markdown editor.
• Added the following shortcuts to the WYSIWYG editor:

The above inline code shortcut was changed to (Ctrl+Shift+E) in the closely following 0.12.1 release to prevent clashing with the save shortcut, For Macs the command key was also used in this release rather than the ctrl key

Changes & Bugfixes

• S3 uploads are now made public during upload process. Thanks @younes0
• S3 uploads will use a shorter URL if the bucket name does not contain a period. Thanks @younes0
• Fixed erratic back-to-top button behaviour on FireFox.
• Removed critical page content animations to ensure viewable in all browsers.
• Fixed quoted search terms when they only contain a single word.
• Improved sort and permission system efficiency by over a factor of 10.
• Updated the design of the image manager popup to be cleaner and more consistent with the ui.
• Added draft save indicator which animates on page save to provide success feedback to the user.
• Fixed cross-browser flexbox styling issues.
• Changed the way image and link references are put in pages, They now contain the full url, rather than being relative to the current domain.

• Updated some login redirects that did not work when using a custom url path.
• Cleaned up the PDF export format to prevent the page footer being merged in the page content.

Update instructions can be found here. If you're having issues you may have to run composer dump-autoload followed by php artisan clear-compiled.

• Updated all url references to allow BookStack to be placed at a non-root location on a domain.
• Fixed no borders on table heading rows.
• Fixed creation of books/chapters/pages with only punctuation titles.
• Fixed issues with double braces in both editors.
• Fixed safari rendering of page tag manager. Also updated page editor to ensure it spans full page height.

Update instructions can be found here. If you're having issues you may have to run composer dump-autoload followed by php artisan clear-compiled.

• Added WYSIWYG editor callouts/alert blocks.
• Added basic scroll syncing to markdown editor.
• Added Ctrl+S shortcut to editor for forcing a draft save.
• Added single page and single chapter move interfaces.
• Added some level of MySQL 5.5 support and fixed saving bug for mysql php plugin users.
• Updated tag auto-suggestions to be smarter depending on current input.
• Updated tag auto-suggestions to show on empty input.
• Updated tag auto-suggestion shortcuts so tab can be used to select.
• Tightened up some list styles and made homepage empty list messages a bit friendlier.
• Made homepage queries a little more efficient.
• Fixed theme colors not showing on fresh instances.
• Fixed bug with new chapters having an incorrect initial list priority/ordering set.
• Fixed page sidebar not reacting to window resize.
• Fixed bug preventing images from being deleted.
• Fixed activity list bug causing too many hidden activities.

Update instructions can be found here.

Changes

• Added View permissions at a role level to allow a 'whitelisting' approach to permissions.
• Added a query-able page tagging system with auto-suggestions.
• Added extra setting to allow custom content to be inserted into the <head> section of every page.
• Permission system internally revamped with an intermediate table for quick queries.
• Fixed markdown editor not scrolling on Firefox.
• Allowed sorting & searching on the users page.
• Reworked the database migrations only use simple non-app code to avoid future breakages.
• Cleaned some of the settings layouts for better consistency and hid more links when you don't have permissions to click them.
• Made user names as the bottom of entities linked to user profiles.

• Better quality Roboto fonts used and added in cyrillic support.
• Updated the WYSIWYG hr insertion to be more reliable to avoid unwanted whitespace.
• Made the settings screen a little less jumpy.
• Added app version number to the bottom of the settings screen for easy referencing.

• Fixed nested lists becoming broken after saving (#97)
• Fixed page sorting 404'ing when a draft page is involved. Draft pages will no longer show since they are forcefully sorted anyway. (#100)

• Fixes the Redis config being undefined when no redis servers are specified

• Added initial markdown editor implementation.
• Added search and 'uploaded to' filter to the image editor.
• Made the 'Require email confirmation' setting work when using LDAP authentication.
• Fixed draft saved message to use local timezone.
• Added Redis cache/session support via the .env file.
• Added some friendlier error messages when using LDAP and there is an user mismatch.
• Added a list of users when editing a user role for visibility.
• Fixed pages in chapters not being given the correct order on creation.

• Added restricted images (Based on page access).
• Added new page drafts (Are purple in colour).
• Added editing autosaving drafts.
• Added system to warn of others editing the same page.
• Changed logo to be more custom-colour friendly.
• TinyMCE update to 4.3.7 to hopefully fix a few bugs.
• Updated the styling for bullet & numbered lists to prevent them bugging out in Firefox.
• Improved button text size consistency.
• Fixed list styling issues that caused the theme colour to be used incorrectly.
• Made the scrollbar static on most pages to prevent erratic page width changes.

• Added custom role system.
• Added granular Book, Chapter & Page restrictions.
• Added setting to allow a custom site primary color.
• Added quoted search to allow phrase search.
• Added memcached configration options via .env file.
• Fixed bug in homepage recently updated list.

Thanks to @nwalke for contributing loads in this release.

Thanks @nwalke for the pull requests in this release.

• Added experimental LDAP user authentication (Instructions in readme).
• Added single-page export options including HTML, TXT & PDF.
• Updated Laravel base to 5.2.
• Increased testing coverage and fixed some user/auth related issues in the process.
• Improved image upload error handling.