forked from globaleaks/GlobaLeaks
-
Notifications
You must be signed in to change notification settings - Fork 0
/
CHANGELOG
4597 lines (3817 loc) · 186 KB
/
CHANGELOG
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Changes in version 4.12.9
Add fieldset and legend to radio buttons inputs (#3433)
Add label to language selector (#3574)
Fix LE renewal compatibility with python3-acme 2.1.0 (#3571)
Changes in version 4.12.8
Remove report labels from mail notifications
Fix defect #3565
Update translations
Changes in version 4.12.7
Revise fix for issue #3556
Changes in version 4.12.6
Fix issues: #3549, #3556
Changes in version 4.12.5
Fix bug loading of Tor onion services introduced in 4.12.0
Changes in version 4.12.4
Fix issue #3555
Revise migration of receiver files
Update translations
Changes in version 4.12.3
Avoid to create first questionnaire step that seems to confuse users
Simplify whistleblowing interface related to files
Fix duplication of questionnaires using field templates
Correct validation of questionaires in relation to addition of feature #3426
Fix regression #3546
Changes in version 4.12.2
Vary the permission policy in relation to feature #3426
Correct title of emails for new reports
Update translations
Changes in version 4.12.1
Fix regression on receipt visualization introduced during packaging of 4.12.0
Changes in version 4.12.0
Add packaging for Debian 12 Bookworm (#3485)
Perform full application review following AgID advice on accessibility
The full whistleblowing process is now accessible with screen readers
Implement notification for reports reminders (#3419)
Add two factor authentication on file based' configurations
Automatically configure a self signed certificate to ensure every
connection is always encrypted
Implement encryption of identity access requests and replies
Implement encryption of reports label
Perform db migration in RAM to ensure shorter downtimes on update
Enable file viewer by default
Make it possible to configure a Privacy Policy link
Make it possible to configure a Whistleblowing Policy link
Add support for Basque (Euskara) language
Update translations
Fix issues #3442, #3456, #3466, #3471, 3504
Voice question
[doc] Update documentation
[doc] Update ER schema representation
Changes in version 4.11.5
Fix regression on ip filter check introduced in 4.11.4
causing authorized connections to be blocked
Bump npm dependencies to latest version
Update translations
Changes in version 4.11.4
Implement database sessions caching
Optimize API cache
Changes in version 4.11.3
Improve TOTP implementation adding a 1 step window
Fix packaging in relation to missing license file
Changes in version 4.11.2
Revise content security policy
Revise HTML to improve accessibility (#3373)
Fix issues #3407, #3412
Bump npm dependencies to latest version
Update translations
Changes in version 4.11.1
Fix packaging of PDF.js library (#3400)
Automatically delete demo platforms older than 30 days
Bump npm dependencies to latest versions
Update translations
[doc] Align documentation to latest development
Changes in version 4.11.0
Add optional sandboxed viewer to open some types of files (#3345)
Make it optional for administrators to usage of PGP (#3382)
Make it possible for users to configure a custom reminder on reports (#2866)
Remove possibility to close the Privacy Badge when clicked (#3387)
Make it possible to customize the "Request Support" feature (#3335)
Fix regression on unread reports reminder introduced in commit cf708b2
Prevent users to delete users when escrow keys could be invalidated
Revise Content Security Policy restricting priviledges on general API
Set Cross-Origin-Resource-Policy to same-origin instead of same-site
Add PDF.js library by @mozilla
Deprecate use of FileSaver.js library
Adopt Inter Noto Sans font families to improve sw internationalization
Bump npm dependencies to latest versions
Update translations
[doc] Update documentation on the implemented Content Security Policy
[doc] Revise ApplicationSecurity documentation
Changes in version 4.10.18
Fix wizard when performed using a remote connection
Changes in version 4.10.17
Revise checks on browser compatibility
Fix code related to re-generation of onion services
Changes in version 4.10.16
Fix packaging issue preventing release 4.10.15 to work
Changes in version 4.10.15
Fix regression on multimedia content visualization due to restricted
Content Security Policy (#3307)
Modify Tor indicator to track if the whistleblower has always used
Tor (#3299)
Make it possible to load GIF and JPEG images as logo (#3301)
Revise password scoring function to require at least 12 characters
and at least 10 different characters (#3311)
Added data filters on report list page
Implement responsive menu and add icons to menu items
Update translations
[doc] Revise Application Security section
[doc] Update documentation about the content security policy
Changes in version 4.10.14
Apply minor UI fixes
Bump client dependencies to latest versions
Update translations
Changes in version 4.10.13
Revise fix fo regression on ACME key generation introduced in 3.10.11 (#3295)
Changes in version 4.10.12
Fix regression on generation of Acme Account Key introduced in 4.10.11
Update translations
Changes in version 4.10.11
Randomize LetsEncrypt renewal solving failing issues on congested times
Revise packaging of client libraries
Fix jslint errors
Fix submission reset feature in relation to the addition
of two factor authentication check
Remove outdated code invalidating session when visiting the homepage
Preserve internal user sessions in the sessionStorage
When whistleblower session expires redirect the user on
a blank page (#3293)
Map locationStorage on sessionStorage (#3277)
Fix issue #3277
Bump npm dependencies to latest version
Update translations
Changes in version 4.10.10
Fix corrupted file upload problem for files bigger than 1MB
introduced in 4.10.0
Update the last update date when the report status is changed
Revert fix for issue #3272
Revise Debian packaging
Bump npm dependencies to latest versions
Update translations
Changes in version 4.10.9
Fix issue #3272
Changes in version 4.10.8
Fix password confirmation in relation to unicode escape encoding
Extend image file types supported by the application adding gif and jpeg
Perform logout when navigating pages that do not require auth (#3221)
Fix issue #3225
Bump npm dependencies to latest versions
Changes in version 4.10.7
Fix regression on users password change introduced in 4.10.0
Changes in version 4.10.6
Replace usage of python random module with python secrets module
Fix mimetype for javascript files in relation to IANA definititions
Bump terser to latest version
Changes in version 4.10.5
Fix regression in relation to password resets requiring old passwords
Fix regression in relation to old reports introduced in 0750098ef936452904f666bcb5aefc24fcfade84
Remove redundant interface for loading PGP keys by copy/paste
Bump npm dependencies to latest version
Update translations
[doc] Add reference to ROS Security Audit 2022
[doc] Update documentation images
Changes in version 4.10.4
Revise mime types fixing loading of favicon files (#3258)
Make it possible to filter receiver tips by date args (updated_after, updated_before)
Changes in version 4.10.3
Fix initialization of onion servers
Changes in version 4.10.2
Revise mime types fixing loading of favicon files (#3258)
Fix client failure when testing email notifications (#3259)
Fix duplicated option visualization in advanced settings (#3260)
Fix loading of custom scripts from /var/globaleaks/scripts/ directory
Bump npm dependencies to latest version
Update translations
Changes in version 4.10.1
Fix certificate renewal failure introduced in 4.10.1
Changes in version 4.10.0
Validate url argument of support handler using regexp matching
Remove interface for immediate user activation
Avoid to fix file permissions at runtime
Implement dedicated handlers for password change
Drop privileges as soon that command line arguments are parsed and sockets are binded
Remove web possiblity to load javascript customization via web interface
Limit accepted mimetypes depending on the handler
Add requirement of two factor authenticatioon confirmation to set of operations
- Enabling encryption
- Disabling 2fa
- Toggling system key escrows
- Toggling user key escrows
- Visualizing account recovery keys
- Resetting system reports
- Using password reset links
Prevent two factor token reuse
Do not load file customizations when managing tenants
Limit listing files loaded for public access to administrators or privileged recipients
Restrict content security policies limiting resources that could be loaded
Add directory traversal checks after loading paths from the database
Enforce failure when apparmor or iptables support is missing
Revise signup form removing redundant data collection
Strip html tags before processing markdown
Ensure token decorator could not be bypassed
Ensure uploded file names do not contain slashes
Add warning in case of use of default smtp configuration
Modify simplified login to not expose usernames
Improve templating avoiding templates injection
Bind only on local host when in development mode
Make it possible to change network configuration only by root tenants admins
Avoid to change page title to "Report" to limit traces on browser history
Ensure to not write files bigger than the defined maximum file size
Require explicit opt-in to enable developers exception notifications
Remove web possiblity to load javascript customization via web interface
Change token decorator using path variable instead of uri variable
Disable developers exception notifications by default
Remove API for client exception reporting
Disable APIs for exporting HTTPS certificates' keys
Bump npm dependencies to latest versions
Update translations
Changes in version 4.9.9
Reintroduce Tor Exit IP check based on onionoo data
Bump npm dependencies to latest versions
Update translations
Changes in version 4.9.8
Revise teardown of onion services
Fix margins in RTL layout
Update translations
Changes in version 4.9.7
Fix compatibility with old versions of txtorcon (#3229)
The failure was causing failure on ubuntu bionic for version 4.9.6
Changes in version 4.9.6
Improve resiliency of onion services setup and teardown
Optimize application state and tenants
Set Gzip Encoder compression level to 1 prioritizing speed over compression
Remove "-" character from <title> tag when the page title is not set
Remove duplicated IDs from submissions form (#3222)
Add aria label on "Plus" button for multi-answer questions (#3222)
Add aria label on "Close" button of disclaimer modal (#3222)
Add h1 tag on page title (#3222)
Add for attribute to labels referred to form inputs (#3222)
Improve accessibility of receipt interface interconnectin label and input (#3222)
Bump npm dependencies to latest versions
Update translations
Changes in version 4.9.5
Fix exception triggered when recipients download their own files (#3220)
Bump npm dependencies to latest versions
Update translations
Changes in version 4.9.4
Fix regression on download of files uploaded by recipients introduced in 4.9.1
Fix regression on simplified login introduced in 4.9.0
Correct Lithuanian language name incorrectly shown as Latvian
Bump npm dependencies to latest versions
Update translations
Changes in version 4.9.3
Fix regression on Tenant Auth Switch introduced in 4.9.1
Bump npm dependencies to latest versions
Update translations
Changes in version 4.9.2
Fix regression on Export/Download of Files introduced in 4.9.1
Changes in version 4.9.1
Complete bugfixing for new package for Ubuntu Jammy 22.04
Extend proof of work protection to every not authenticated request != GET, OPTIONS
Change default user permissions removing delete priviledge
Fix regression on feature #2915
Bump npm dependencies to latest versions
Update translations
[doc] Update Threat Model texts
[doc] Update Application Security document in relation to hashcash policy on unauthenticated requests
Changes in version 4.9.0
Silence notification of common exceptions
Prepare packaging for Ubuntu Jammy (#3185)
Fix visibility of reports related to deleted contexts (#3209)
Fix export failure for reports with large number of attachments (#3212)
Fix compatibility with both SQLAlchemy 1.3 and 1.4
Add migration script 62
Add archived db version 62 used for tested purposes
Implement SQLITE lockdown state (#3206)
Simplify configuration of context hidden status
Simplify configuration of users enabled status
Deliver submissions also to recipients which account have been disabled
Remove database support for incomplete features #2523 and #2552
Fix regression on notification of certificate renewal failure introduced in 4.8.1
Add autoincrement property to Tenant ID attribute (#3197)
Change the type of the ID attribute of Audit Log to be an autoincremented integer (#3198)
Bump npm dependencies to latest versions
Update translations
[doc] Update documentation images
[doc] Update ER representation of the database
[doc] Update documentation in relation to application testing
[doc] Add documentation about hardened database configuration
Changes in version 4.8.1
Improve performances of https renewal job
Revise audit log marking system' report deletion by tenant
Ensure that the local copy of the receipt is deleted after logout
Deprecate outdated Tor check based on check.torproject.org
Bump npm dependencies to latest versions
Update translations
Changes in version 4.8.0
Improve audit log adding entry for reports deleted automatically by the system
Improve audit log adding information about software updates (#3194)
Improve self password reset feature making caseinsensitive email lookup
Cancel deferred processing when client connection is closed
Fix visualization of buttons for ordering contexts
Fix failure on pgp encryption of wbfiles for recipients
Hide no-configurable options from referenced fields templates instances
Add missing multichoice input choice on fields creation
Update default globaleaks questionnaire
Optimize database removing id attribute on fieldattr model
Fix issue #3193
Bump npm dependencies to latest versions
Update translations
[doc] Revise features documentation
[doc] Update documentation images
Changes in version 4.7.17
This version just fixes version numbering
Changes in version 4.7.16
Deprecate haveged on systems running kernel >= 5.6 (#3184)
Deprecate outdated and unused code related to old version of haveged #1722
Make it possible to reset template override setting (#2908)
Fix regression on #3116
Bump npm dependencies to latest versions
Changes in version 4.7.15
Fix exception on interrupted connections (#2706)
Bump npm dependencies to lates versions
Changes in version 4.7.14
Fix incorrect bump of bootstrap library to version 5
Fix exception on logout introducted in 4.7.12
Changes in version 4.7.13
Fix wrong release numbering stating 4.7.12 is still 4.7.11
Bump npm dependencies to latest versions
Changes in version 4.7.12
Filter recurring meaningless exceptions from Twisted from notification
Prevent users to revoke their own access to reports (#3182)
Optimize Content Security Policy
Fix regression on report postpone feature introduced in 4.7.11
Fix issue #3180
Bump npm dependencies to latest versions
Update translations
[doc] Update documentation about CSP
[doc] Add reference link for AppArmor
[doc] Add reference link for iptables
Changes in version 4.7.11
Revise revoke access functionality to show real users' names
Fix issues #3171, #3175
Bump FontAwesome from 5 to 6
Bump npm dependencies to latest versions
Stop including fonts inside minified css
Revise postpone feature in relation to #3166
Bump npm dependencies to latest versions
Update translations
[doc] Update documentation images
Changes in version 4.7.10
Fix regression on files uploads introduced in 4.7.8
Changes in version 4.7.9
Avoid to serialize templates when exporting questionnaire
Changes in version 4.7.8
Make it possible for secondary tenants to not be exposed via Tor (#3155)
Reimplement tenant api removing direct acces by tenant number
Make it possible to access secondary tenants via /t/subdomain path
Restore possibility to provide a message to users that
decide to not provide their identity
Improve questionnaire template UI marking template questions
with "Template" type (#3156)
Add exception on permission checks for directory 'lost+found' (#3159)
Fix regression on advanced field options configurations (#3154)
Enable users to review file uploads before effective upload
Fix issues #3157, #3160
Bump npm dependencies to latest version
Update translations
Changes in version 4.7.7
Add report progressive number to audit log (#3145)
Implement serverside validation of password strength (#3150)
Fix issues #3146 and #3149
Bump npm dependencies to latest version
Update translations
Changes in version 4.7.6
Fix regression #3135
Bump npm dependencies to latest version
Update translations
Changes in version 4.7.5
Make it possible to restart the application
without invalidating password reset tokens
Make it possible to customize Steps descriptions with markdown
Bump npm dependencies to latest versions
Update translations
Changes in version 4.7.4
Fix regression on generation of PGP encrypted emails
Update translations
Changes in version 4.7.3
Revise apparmor script fixing permissions to generate password reset token
Avoid to encrypt email subjects as in releases before 4.6.0
Changes in version 4.7.2
Fix regression on report export introduced in 4.7.0 for report
including files updloaded by recipients
Fix regression on report search introduced in 4.7.0 (#3131)
Changes in version 4.7.1
Fix regression #3130 introduced in 4.7.0
Changes in version 4.7.0
Revise TLS configuration by specifically disabling TLS1 and TLS1.1 on SMTP connections
Decouple encryption keys of submissions from encryption keys of files
Optimize database and API for fetching reports summaries #3125
Optimize database by setting sqlite temp_store to memory on every new connection (#3125)
Optimize database enabling automatic indexing is enabled on sqlite database (#3125)
Fix migration of questions generated from templates by running migrations with foreign keys
Fix loading of receipt page when context id is provided within the uri
Modify grant tip access function to show real users' names (#3127)
Bump npm dependencies to latest version
Update translations
[doc] Update ER representation of the database
Changes in version 4.6.1
Fix regression in 4.6.0 preventing to visualize reports labels
Update translations
Changes in version 4.6.0
Adopt ECC keys of 384bits
Modify ECDH configuration to use curve NID_secp384r1
Implement securitytxt (#2647)
Register first access to files by whistleblowers
Register first access to files by recipients
Register first access to reports by recipients
Optimize database removing unused attributes
Add email validation on Signup and Support requests
Revise code relate to mandatory-check on file uploads
Make it possible to require whistleblowers to upload files
before proceeding with the completion of the submission (#3116)
Revise code relate to mandatory-check on file uploads
Notify recipients when whistleblowers disclose their own identity
Notify recipients when whistleblowers fills the secondary questionnaire
Always strip the email subject when sending PGP encrypted emails
Add Brave to the list of supported browsers (#3121)
Correct Github donation link (#3120)
Add support for Crimean Turkish translation
Update translations
[doc] Add Secure File Download measures section
[doc] Add Browser History and Forensic Traces section
[doc] Add TLS certificate keys section
[doc] Revise section about Cache-Control header
[doc] Revise application glossary
[doc] Add documentation about supported browsers
[doc] Update number of supported languages
Changes in version 4.5.8
Fix self reset password regression introduced in 4.4.5
Set session keepalive period to 5 minutes
Do not invalidate password reset tokens till actual password change
Update translations
Changes in version 4.5.7
Implement Cross-Origin-Embedder Policy
Implement Cross-Origin-Resource Policy
Fix issues #3117 and #3118
Update translations
Changes in version 4.5.6
Fix regression on password reset links introduced in 4.4.5
Optimize serialization of public API reducing set of exported keys
Open link for testing contexts on a new page
Fix issue #3113
Changes in version 4.5.5
Add URL to support requests emails
Fixes issue #3108, #3109, #3110, #3111
Bump npm dependencies to latest versions
Update translations
Changes in version 4.5.4
Implement session keep-alive and check on session expiration
Fix issues #603, #2842, #3104, #3105, #3106
Bump npm dependencies to latest versions
Changes in version 4.5.3
Fix regression on Simplified Login when combined with 2FA
(regression introduced in 4.5.0)
Changes in version 4.5.2
Implement Cross-Origin-Opener-Policy (#3103)
Make it possible for administrators to configure the public name of users (#3094)
Open TOS attachments and TOS reference link on a new page (#3097)
Replace automatic link sanitizer with an explicit target=_blank directive
Fix audit log in relation to visualization of images for users' 2fa status
Revise UI of project logo upload functionality removing double click issue
Always show hours and minutes on dates of file uploads
Fix issues #3093 and #3095, #3098, #3100, #3101, #3102
Changes in version 4.5.1
Fix authenticaton on secondary tenants by root tenant users
(regression introduced in 4.5.0)
Changes in version 4.5.0
Fix internationalization of close button in support modal (#3084)
Fix regression on compatibility with Internet Explorer (#3085)
Avoid to show logout button on homepage and submission page
Show explicit logout link on whistleblower sessions
Revise login interface resetting inputs on failure
Make it possible to manually configure TOTP secret (#3088)
Add "Copy to clipboard" functionality on 2FA qrcode interface
Fix possibility to provide identity after submission
Always encrypt downloads with PGP when the user key is available (#3087)
Fix bug on invalidation of escrow key when enabling key escrow of secondary tenants
Always fetch user preferences when the user preferences are accessed
Fix issue #3086, #3090
Bump npm dependencies to latest versions
Improve request support feature by prepopulating the email field
Update translations
Changes in version 4.4.5
Revise rate limiting decorator limiting only whistleblowers' sessions #3076
Simplify handling of recipient public names
Fix possibility of adding multiple file questions
Make it possible to use drag and drop on admin file configurations
Fix issue #3075
Bump npm dependencies to latest version
Update translations
Changes in version 4.4.4
Make it possible for recipient to choose the postpone date #3068
Make it possible for recipients to see real user names #3064
Make it possible for any recipient to remove files loaded by other recipients
Make it possible to filter sites by any property
Add audit log for password reset considering it as a login
Fix reordering of submission substatuses #3066
Remove possibility to postpone expiration of multiple reports at once
Simplify API removing proof of work token from authenticated APIs
Implement session on any whistleblower action
Implement rate limiting on user sessions
Deprecate multisite login functionality
Limit the maximum payload of any request to 2MB
Remove outdated section of signup template
Fix issues #2972, #3069
Revise exception handling
Improve responsiveness of logo and page title on small screens
Revise of comments and message buttons
Bump npm dependencies to latest version
Update translations
Changes in version 4.4.3
Add NTP as package dependency on debian buster and ubuntu bionic
Simplify interface of questionnaire configuration when only one step
is present
Revise layout of login and 2fa pages
Fix functionality of self password recovery on the page that requires
the account recovery key
Update translations
Changes in version 4.4.2
Apply minor bugfixing
Revise native language names
Add support for Bashkir language
Update translations
Changes in version 4.4.1
Add support for Serbian (Montenegro) and Tatar language
Fix regression causing failure on file uploads and other mail exceptions (#3035)
Update translations
Changes in version 4.4.0
Bump database version to 56 to fix specific issue on db version 55
Changes in version 4.3.2
Fix regression on visualization on answers to fieldgroups introduced in 4.3.0 (#3053)
Update translations
Changes in version 4.3.1
Fix issues #2525, #2768, #3051, #3052
When key escrow is enabled activate user encryption as soon that users are created
Apply minor bugfixing of new interfaces
Update translations
Changes in version 4.3.0
Make it possible for recipients to add a new recipient to their submissions (#2595)
Implement Request Support feature (#3035)
Revise data collected when asking whistleblower's identity (#3032)
Logs when recipients access whistleblowers's identity
Enable custodian functionality when a custodian user exists
Prioritizing new encryption model over PGP encryption
Deprecate support of HTTPS NPN protocol
Revise password reset token setting expiration to 7 days
Track access to submissions that are exported
Make it possible to customize the text shown over the context selection
Reorganize secondary tenant creation to not require wizard completion
Improve 2FA account name to show: $hostname ($username) (#3021)
Fix issues #3027, #3041
Bump npm dependencies to latest version
Add support Persian (Afghanistan) language
Add support for Armenian language
Add support for Belarusian
Add support for Checken language
Add support for Kazakh language
Add support for Kyrgyz language
Add support for Pashto language
Add support for Serbian (Latin) language
Add support for Turkmen language
Add support for Tajik language
Add support for Uzbek language
Update translations
Changes in version 4.2.13
Deprecate onion services v2 #2894
Add Debian Bullseye (11) packaging #3019
Show receipt box only when /#/submission url is visited directly #3026
Revise TLS implementation improving security and performance
Fix integration of ug@Cyrl language
Apply minor bugfixing
Update translations
Bump client dependencies to lates version
Changes in version 4.2.12
Fix regression #3029 on UI mocks visualization added in 4.2.11
Changes in version 4.2.11
Implement copy to clipboard function on encryption recovery key
Implement copy to clipboard functionality on receipts (#1143)
Implement copy to clipboard function on onion address (#1040)
Re-implement feature #3026 with proper handling of responsiveness
Make it possible to show comments and messages sent before
disabling commenting and messaging
Implement link to the homepage on logo and project title
Fix regression on feature #2521
Fix issue #3015
Fix export of submissions including both files and comments
Fix password reset link functionality when triggered by
administrators of secondary sites
Disable autocomplete on password change for modern browsers
Log ip and user agent of internal users by default for
security purposes
Update documentation
Publish tentative 2021-2023 roadmap
Remove incorrect import of D3 library not used anymore
Bump npm dependencies to latest version
Add Uyghur translations in latin and cyrillic alphabets
Add revised Tibetan translation
Update translations
Changes in version 4.2.10
Implement possibility to export all reports at once (#2824)
Refactor Token implementation and separate it from Submission state
Assign access_report audit log to secondary tenants
Revise colors of the application in relation to style guidelines
Change logo version and optimize size
Update Tibetan translation (ongoing trranslation updated for revision purposes)
Fix native language name for Swahili (Kiswahili)
Update translations
Changes in version 4.2.9
Fix issue #3007 preventing new setups of globaleaks 4.2.8
Fix password reset functionality in relation to pyotp dependency removal
Revise min_len and max_len input validations in relation to IE 11
Add Tibetan translation (ongoin translation added for revision purposes)
Update translations
Changes in version 4.2.8
Update translations for revision purposes
Changes in version 4.2.7
Fix functionality of import of questionnaires
Fix loading of intermediate chain composed by more than one certificate
Bump npm dependencies to latest versions
Add Kramer translation (ongoing translation added for revision purposes)
Add Uyghur translation (ongoing translation added for revision purposes)
Update translations
Changes in version 4.2.6
Add Bengali translation
Add Lao translation
Add Malayan translation
Improve usability of drop down with >=10 choices
Update translations
Bump npm dependencies to latest versions
Changes in version 4.2.5
Fix bug on file delivery in mixed PGP / non PGP configurations
Add Burmese translation
Add Chinese (Hong Kong) translation
Update translations
Bump npm dependencies to latest versions
Changes in version 4.2.4
Fix issue #2998 affecting migration 54i, impacting releases 4.2.0-3
and causing corruption of files attached by administrators for
platform customization.
Fix issue #2995
Fix bug on notification to recipients of their own messages
Changes in version 4.2.3
Improve readability of home page revisiting font-sites and margins
Getting sure to filter white spaces when using ip addresses filters
Fix issue #2993
Changes in version 4.2.2
Ignore browser language and prefer platform default
Set Log job timing to 30 seconds
Fix lint error affecting Log job shutdown
Make update notifications subject to admin notifications enablers
Fix issue #2991
Changes in version 4.2.1
Fix regression on removal on reset of anomaly counter
Revise files handlers for proper management of contexts and users images
Changes in version 4.2.0
Improve set of audit log events traking main events related to
authentication, password reset, reports access and deletion (#2579)
Optimize database removing redundant previous overengineering
Prevent that the submission status could be reverted to new
Improve resiliency adding limits to the numer of emails and files
processed in a single job cycle
Improve resiliency on possible failures on mail schedule due to
single errors in mail generations
Make it possible to disable new submissions without preventing
whistleblowers access
Revise implementation of Permission-Policy header
Fix issues #2970, #2978, #2979, #2981
Backport Twisted #9410 from 19.7.0
Update npm dependencies to latest versions
Add Macedonian translation
Update Translations
Changes in version 4.1.17
Fix issue #2970
Revise access log format to keep it standard
Fix auto-epiration of new sites if not activated within 1 day
Revise cleaning sched in relation to activation tokens expiration
Add message-id header to emails to mitigate spam
Make it possible for field templates to be defined by using field templates
Downgrade D3 version to preserve compatibility with IE 11
Update npm dependencies to latest versions
Changes in version 4.1.16
Fix mail notifications on ubuntu focal / python 3.8
Bump npm dependencies to latest version
Changes in version 4.1.15
Fix issue #2967
Changes in version 4.1.14
Fix generation of email notifications for labeled submissions
Changes in version 4.1.13
Add Covenant Contributor Code of Conduct
Update Tor download link
Archive testing code related to CORS embedding (#1270)
Fix regression on report's postpone and delete interfaces
Fix loading of minified version of CSS and JS
Generate onion service only when platform mode is 'default'
Fix issue on visualization of answers for conditional steps
Changes in version 4.1.12
Compact database during cleaning schedule using sqlite VACCUM command
Revise application packaging moving PID file inside /var/globaleaks
Fix packaging adding explicit dependency on python3-cryptography
Bump npm dependencies to latest version
Changes in version 4.1.11
Fix possibility of resetting onion address
Changes in version 4.1.10
Make it possible to download https encryption key for backup purposes
Implement possibility to download access and debug log via the audit log
Fix statistics tracking of logins and submissions
Use cssmin and terser instead of using already minified libraries
Rework http gzip doing it in streaming to every resource served
Avoid caching of admin resources
Add Swahili language
Update translations
Bump npm dependencies to latest version
Changes in version 4.1.9
Fix issue #2904
Update translations
Changes in version 4.1.8
Fix serialization of tip preview for platforms with encryption OFF
Move experimentaal docker scripts to dedicated repository:
https://github.com/globaleaks/globaleaks-docker-scripts
Bump travis testing environment to Focal
Bump npm dependencies to latest version
Changes in version 4.1.7
Deprecate code related to onion service v2 generation
Add list of italian public agencies that use the software to
Developers Italia: https://developers.italia.it/it/software/globaleaks-globaleaks-f22648
Pre-generate Onion Service key as soon that the database is initiaized
Reset Authentication session when navigating public interface
Add Amharic translation
Fix issue #2945
Bump npm dependencies to latest version
Update translations
Changes in version 4.1.6
Fix regression on migration 52 (#2936)
(bug introduced in version 4.1.0)
Changes in version 4.1.5
Fix bug on PGP encryption of files resulting on using always the same recipient key for every user
(bug introduced in version 4.1.0)
Changes in version 4.1.4
Revise header implementation adding css ID ProjectName, TitleSeparator and PageTitle
Revise feature for enabling recipients to upload files to whistleblowers
Update translations
Changes in version 4.1.3
Revise logic of Tor network sandboxing
Update translations
Changes in version 4.1.2 - 2020-11-23
Revise notifications for custodian replies
Fix visualization of recipient selection cards
Changes in version 4.1.1 - 2020-11-22
Fix creation of new users for platforms where english is not enabled
Fix gl-admin utility in relation to import error
Add notifications for custodians replies
Bump npm dependencies to latest versions
Update translations
Changes in version 4.1.0 - 2020-11-18
Revise the application UI following the official an new brand guidelines
- https://github.com/globaleaks/GlobaLeaks/blob/main/brand/globaleaks-brand-guidelines.pdf
Reduce colors of the application removing the usage of Green, preferring to use the Blue
color of the brand to communicate the values of the project along security and transparency.
Add compound favicon with resolution 16x16 32x32 48x48
Adopt Metropolis as application Font as defined by the brand guidelines
Optimize the application for better accessibility and responsiveness
Improve usability in relation to key escrow mechanism adding user hints about the
necessity of saving the key esrow.
Add receipt to the tip page to support users to annotate it (#2915)
Bump npm dependencies to latest version
Revise and improve network sandboxing enabling traffic to used ports
Implement restricted indexing policiy by means of X-Robots-Tag: noarchive when
indexing is enabled
Revise Cache-Control headers and update related security documentation
Implement automatic screenshot collection during tests and documentation update
Fix issue https://github.com/globaleaks/GlobaLeaks/issues/2911
Fix password reset malfunction in relation to users using 2FA
Revise email spooling setting interval to 10 seconds and retry to 7 days
Replace Feature-Policy Header with the renamed new standard Permission-Policy header
Complete documentation of securit features currently implemented
- https://docs.globaleaks.org/en/main/security/index.html
Add preliminar documentation for more important user features:
- https://docs.globaleaks.org/en/main/user/index.html
Revise project documentation added to Developers Italia via publiccode.yml
- https://developers.italia.it/it/software/globaleaks-globaleaks-f22648
Make is possible to use markdown when configuring a custom privacy badge
Remove possibility to filter ip access for whistleblowers; the feature was never actually
implemented and the interface shown was just added by mistake. We consider that
Whistleblowers access shall never be prevented and that any restriction on this
topic should be considered against the best practice.
Pospone notification of Letsencrypt failures after a week of the initial failure
Implement scheduler to notify users after 7 days of unread or updated reports
Implement automatic update to onion services version 3 and
plan OnionServices V2 deprecation in compatibility with Tor timeline (#2894)
Update default smtp configuration
Implement admin assisted password reset (applicable when escrow keys are enabled)
Revise CSS of the application removing redundant or unused classes
Bump database schema to version 53
Update ER schema of the application:
- https://github.com/globaleaks/GlobaLeaks/blob/main/documentation/data/er.pdf
Reimplemt periodic file cleaning postponing deletion of files to 1 day since deletion and
ensuring that files that are not linked to the database are properly deleted
Bump test code coverage from 81% to 84%
Remove possibility to include the application by means of an iframe making it possible to
load the application via proper CORS requests
Add subscriber table and subscribed document table for tracking GDPR and other contracts
for demo and professional uses in preparation to furter planned development
Replace GL-Language header making use of the standard Accept-Language header
Implement HTTP OPTIONS method
Add Estonian translation
Update translations
Changes in version 4.0.58 - 2020-09-28
Fix issue #2899
Fix possibility to reset password for platforms that are admin-only
Remove HTTP Basic Authentication feature; this feature was
been developed in order to be used in pre-production but many users
seems to continue to abuse of its presence to create private
whistleblowing portals not really accessible to the end users;
from this the decision to remove completely the feature from the software.
Changes in version 4.0.57 - 2020-09-27
Fix serialization for questions of type date (#2896)
Implement serialization for questions of type date range
Changes in version 4.0.56 - 2020-09-25
Fix additional question answers functionality
Changes in version 4.0.55 - 2020-09-21
Fix issue #2892
Changes in version 4.0.54 - 2020-09-03
Fix recipient feature to load files to whistleblowers
Changes in version 4.0.53 - 2020-08-31
Fix functionality for re-generating Onion addresses
Changes in version 4.0.52 - 2020-08-30
Revise IPv6 support in relation to IP filtering and logging
Changes in version 4.0.51 - 2020-08-09
Do not show multitenancy menu if multisite feature is disabled
Add support for IPv6
Changes in version 4.0.50 - 2020-08-04
Add 1 second delay between mailung attempts
Fix issue #2882
Fix regression on issue #2720
When encryption is not enabled preserve statistic data
Fix visualization of admin interface for disabling user notifications
Update npm dependencies to latest versions
Update translations
Changes in version 4.0.49 - 2020-07-27
Fix exception error on recipients selection
Fix visualization of icons in questions messaging
Changes in version 4.0.48 - 2020-07-26
Fix check on maximum selectable recipients
Changes in version 4.0.47 - 2020-07-25
Fix issue #2878
Improve markdown avoiding privacy leaks on external links (#2879)
Update translations
Changes in version 4.0.47 - 2020-07-21
Fix disclaimer modal in relation to addition of Showdown Markdown (#1101)
Changes in version 4.0.46 - 2020-07-21
Fix visualization of admin advanced settings on root tenant while in demo mode
Changes in version 4.0.45 - 2020-07-21
Fix link for accessing reports in emails sent to recipients
Changes in version 4.0.44 - 2020-07-20
Revise fix for HTTPS redirects in relation to letsencrypt and renewal
Changes in version 4.0.43 - 2020-07-10