Security Update
This release addresses a critical security vulnerability. We strongly recommend updating to this version as soon as possible. User-supplied revision parameters were passed to git without validation, allowing a revision beginning with - to be interpreted as a git command-line option. This could be abused to overwrite pages or disclose files at the repository root (CWE-88).
Thanks to @tonghuaroot for responsibly disclosing this issue and bringing it to our attention.
Security Fixes
- Reject invalid git revisions to prevent argument injection (799aff4).
Features
- Add the possibility to override the roles for the read/write/upload/admin permissions, see #525 (e4a59e8 by @Getslow6, e132d52 by @Getslow6).
- Rework the page index: display the full page path for the list-style index, extend the page index title and align the heading toggle, see #534 #538 (6e52a89 by @ribbal, 1c71047 by @ribbal, 7b26aeb by @ribbal, 3dfb593 by @ribbal, ca36eff, d131be2).
- Enhance the referencing pages plugin, see #527 (cad752b by @ribbal).
Bug Fixes
Dependencies
- Bump pillow from 12.2.0 to 12.3.0, see #536 (d7e26aa by @dependabot).
New Contributors
Contributors
tonghuaroot, dependabot, and 2 other contributors