2.0-RC4

[lwindolf]

This is another security bugfix release. Please upgrade!

Give feedback!

If you are testing this 2.0 release candidate please give feedback in the Github discussion
created for this release: https://github.com/lwindolf/liferea/discussions

Changes

* Fixes a RCE vulnerability when importing OPML files containing
  script commands. Now script commands from untrusted OPML files are
  always dropped.
  (reported by Laurence Tennant)

* Fixes a RCE vulnerability in the download manager plugin where
  a command could have been injected into file paths.
  (reported by Laurence Tennant)

* Fixes #1519: fatal errors on unsupported URI schemes
  (Lars Windolf)

* Fixes #1533: missing refresh of feed info after updates
  (Lars Windolf)

* Fixes regression when adding newsbins
  (Lars Windolf)

* Improved handling for image loading, overly large images (e.g.
  from HTML scraping) are now shrunk to their effective size.
  (Lars Windolf)

* Do not show "0" for news bin count, when "show total count" is enabled
  (Lars Windolf)

---

This discussion was created from the release 2.0-RC4.

[marciof]

Hi, what qualifies an OPML file as untrusted? I regularly backup feedlist.opml which includes my own filtercmd. Do these latest changes mean that if I were to import my own OPML file then all filtercmd would be ignored?

[AndyM48]

#1534 & #1535 still apply

viz: