What's Changed

Security fix

Upgrading is recommended for all installations.

Unpublishing a book, or removing a reader, did not revoke its cover and picture images. Anyone who had the image URLs while the book was readable, including the cover link that link previews and crawlers collect automatically, could keep loading them indefinitely. Covers, picture-page images and page attachments are now served only while their book is published or to someone with access to it, and this applies to URLs handed out before the upgrade. (GHSA-g585-6qcv-fxc8)

What changes for operators: book images are now marked privately cacheable, so browsers still cache them but a CDN or other shared cache in front of Writebook no longer will. Active Storage's proxy URLs, which Writebook never uses, now return 404. Uploaded files that aren't attached to a book are no longer downloadable. Book covers, picture images and page uploads are accepted only as files uploaded with the form, not as a reference to a file already stored.

Reported by @makino-yuto.

Require a signed-in user for Active Storage direct uploads (#487).
Refuse to serve an upload whose book can't be determined, instead of serving it (#486).
Restrict the HTML allowed in page content to an explicit attribute allowlist (#485).
Add an opt-in allowlist of iframe embed providers, on by default for new installs (#480).
Remove a book's revision history, including earlier drafts and their images, when the book is deleted (#489).

Background jobs run again: the worker now boots the app, so file cleanup after deletions happens (1611741).
Escape image titles and alt text in Markdown (#493).
Searching with an empty query or search-operator characters no longer errors (#481).

Full changelog: v1.2.2...v1.2.3