Skip to content

@mvz mvz released this Apr 19, 2018 · 275 commits to master since this release

This minor release updates Publify to use Rails 5.1

  • Upgrade to Rails 5.1 (#814)
  • Update Danish translations (#831)
  • Extend Polish translations (#829)
  • Fix a bunch of issues (#840)
  • Remove outdated converters
  • Fix google analytics tag rendering (#849)
Assets 2

@mvz mvz released this Aug 31, 2017 · 425 commits to master since this release

This is a bug fix release. It provides the following updates:

  • Enforce use of at least Rails 5.0.4.
  • The email field is handled correctly when users sign up (#819)
  • The sign-up and login forms use the correct layout (#819)
  • Theme-related JavaScript files are served correctly (#823)
  • Russian translations have been updated (#820)
  • The link_to_author setting that no longer had an interface has been removed (#816)
  • Dependencies were updated (#815)
Assets 2

@mvz mvz released this Jul 29, 2017 · 456 commits to master since this release

This is a major release and brings big changes to Publify. First of all, Publify now uses Rails 5.0. Moving ahead to Rails 5.1 will come in Publify 9.1, but for now this smaller step should make it easier to migrate any customizations.

Second, Publify has been split up into several Rails engines (publify_core, publify_amazon_sidebar and publify_textfilter_code). This should allow easier re-use and customization. For now, the core engine still contains many parts that can be considerd optional. These may be extracted into their own gems at a later stage.

Apart from those two large changes, there are some smaller potentially breaking changes:

  • Publify now uses Rails' default method of setting secret_key_base in production: Through an environment variable. This means you will have to update your production environment so this variable is actually set.
  • Support for Ruby 2.1 is dropped.
  • Automigration is dropped. You will need to run db:migrate yourself.
  • Support for using feedburner is dropped.
  • Trackbacks and pingbacks are no longer sent. Trackbacks are no longer accepted.
  • Full-page caching is dropped in favor of default Rails' Russian-doll partial caching.

All the little details can be read in the change logs:

As always, ensure you have your database backed up before upgrading!

Assets 2

@mvz mvz released this Nov 3, 2016 · 1101 commits to master since this release

Alvaro Folgado identified several security issues in Publify that are fixed in this release:

  • Rails' protection from CSRF was not active for all actions. This was fixed.
  • Devise' password recovery feature was configured to behave differently for existing and non-existing email addresses. This has been changed to use Devise' 'paranoid' mode.
  • Publify was vulnerable to CVE-2016–3714, a vulnerability in ImageMagick, on servers that have affected versions of ImageMagick installed. It now checks the mime type of uploaded files based on their content before processing with ImageMagick.
  • Publify used Rails' cookie session store, making it possible to effectively log back in by using an older value of the session cookie. Publify now stores the session data in the database.
  • The blog name was not properly escaped in the views used for Devise.

Additionally, the following small bugs were fixed:

  • There was an error on the sign-in due to the use of a deprecated method in Devise.
  • Failed resource uploads were reported as succesful.

It is recommended you update to this release as soon as possible.

Assets 2
You can’t perform that action at this time.