Security Fixes
- Escape user-controlled URLs in the ImageFrame and Video embeddings, which allowed stored XSS via attribute breakout. Thanks to @Jellexer for responsibly disclosing this issue (c8eb5cc).
- Escape user-controlled input in renderer plugins and embeddings to prevent stored XSS in FancyBlocks, Fold, Math, Frontmatter and InfoBox (84b911e).
Features
- Update backlinks when a page is renamed, covering WikiLinks, Markdown links and links to attachments. Controlled by a new Update backlinks checkbox on the rename page. Implemented by @ribbal, picking up the example plugin @skirmess contributed in #508, see #228 #530 (by @ribbal: e4e2a31, 0be30e8, 3027e8d, a964573; follow-ups: 7203218, 4c8bf54, 5b347bd, edd146e, 6290ec9, d35edc3).
Bug Fixes
- Isolate DataTable initialization so one broken table does not break the others on the page (a758b3e).
Dependencies
- Bump gitpython from 3.1.55 to 3.1.57, see #548 (b83138c by @dependabot).
Contributors
skirmess, dependabot, and 2 other contributors