Be notified of new releases
Create your free GitHub account today to subscribe to this repository for new releases and build software alongside 31 million developers.Sign up
This minor release updates Publify to use Rails 5.1
This is a bug fix release. It provides the following updates:
- Enforce use of at least Rails 5.0.4.
- The email field is handled correctly when users sign up (#819)
- The sign-up and login forms use the correct layout (#819)
- Russian translations have been updated (#820)
- The link_to_author setting that no longer had an interface has been removed (#816)
- Dependencies were updated (#815)
This is a major release and brings big changes to Publify. First of all, Publify now uses Rails 5.0. Moving ahead to Rails 5.1 will come in Publify 9.1, but for now this smaller step should make it easier to migrate any customizations.
Second, Publify has been split up into several Rails engines (
publify_textfilter_code). This should allow easier re-use and customization. For now, the core engine still contains many parts that can be considerd optional. These may be extracted into their own gems at a later stage.
Apart from those two large changes, there are some smaller potentially breaking changes:
- Publify now uses Rails' default method of setting
secret_key_basein production: Through an environment variable. This means you will have to update your production environment so this variable is actually set.
- Support for Ruby 2.1 is dropped.
- Automigration is dropped. You will need to run
- Support for using feedburner is dropped.
- Trackbacks and pingbacks are no longer sent. Trackbacks are no longer accepted.
- Full-page caching is dropped in favor of default Rails' Russian-doll partial caching.
All the little details can be read in the change logs:
- The main Publify change log
- The Publify Core change log
- The Publify Textfilter Code change log
- The Publify Amazon Sidebar change log
As always, ensure you have your database backed up before upgrading!
Alvaro Folgado identified several security issues in Publify that are fixed in this release:
- Rails' protection from CSRF was not active for all actions. This was fixed.
- Devise' password recovery feature was configured to behave differently for existing and non-existing email addresses. This has been changed to use Devise' 'paranoid' mode.
- Publify was vulnerable to CVE-2016–3714, a vulnerability in ImageMagick, on servers that have affected versions of ImageMagick installed. It now checks the mime type of uploaded files based on their content before processing with ImageMagick.
- Publify used Rails' cookie session store, making it possible to effectively log back in by using an older value of the session cookie. Publify now stores the session data in the database.
- The blog name was not properly escaped in the views used for Devise.
Additionally, the following small bugs were fixed:
- There was an error on the sign-in due to the use of a deprecated method in Devise.
- Failed resource uploads were reported as succesful.
It is recommended you update to this release as soon as possible.