etherpad-lite/CHANGELOG.md

Next release

Note for admins

Etherpad does no longer store it's dependencies in ./src/node_modules by default. Also, Etherpad now stores installed plugins in a package.json file in the root directory and no longer requires quirks like --legacy-peer-deps or --no-save when invoking npm during plugin installation.

When you're updating, it's best to use the ./src/bin/installDeps.sh script. It will npm link the src directory, using the package.json file in ./src. This will create the well-known symlink ep_etherpad-lite in ./node_modules, that we've been using for years. However, this will also add a dependency in ./package.json.

./src/bin/installDeps.sh will fail, if you have no ./package.json or ./package-lock.json and your ./node_modules directory is not empty, as this is an indicator of installed plugins. You need to remove ./node_modules and install all your plugins in the next step.

./src/bin/installDeps.sh will remove any existing directories in ./src/node_modules.

After running ./src/bin/installDeps.sh, install your plugins with npm i ep_plugin1 ep_plugin2... or via /admin/plugins.

Note for plugin authors

You can no longer depend on core's dependencies via require('ep_etherpad-lite/node_modules/$dep'). Please run src/bin/checkPlugins.sh or manually change to require('$dep'). We don't recommend that you rely on Etherpad to include specific dependencies in the future. So it's best if you add the dependency in your package.json. For convenience we have added symlinks in ./src/node_modules for the following dependencies: async, cheerio, express, formidable, log4js and supertest. Please note that those symlinks will be removed in a future version, so we strongly recommend that you adapt your require statements.

1.9.1

Notable enhancements and fixes

• Security

  • Limit requested revisions in timeslider and export to head revision. (affects v1.9.0)

• Bugfixes

  • revisions in CHANGESET_REQ (timeslider) and export (txt, html, custom) are now checked to be numbers.
  • bump sql for audit fix

• Enhancements

  • Add keybinding meta-backspace to delete to beginning of line
  • Fix automatic Windows build via GitHub Actions
  • Enable docs to be build cross platform thanks to asciidoctor

Compatibility changes

• tests: drop windows 7 test coverage & use chrome latest for admin tests
• Require Node 16 for Etherpad and target Node 20 for testing

1.9.0

Notable enhancements and fixes

• Windows build:
  • The bundled node.exe was upgraded from v12 to v16.
  • The bundled node.exe is now a 64-bit executable. If you need the 32-bit version you must download and install Node.js yourself.
• Improvements to login session management:
  • express_sid cookies and sessionstorage:* database records are no longer created unless requireAuthentication is true (or a plugin causes them to be created).
  • Login sessions now have a finite lifetime by default (10 days after leaving).
  • sessionstorage:* database records are automatically deleted when the login session expires (with some exceptions that will be fixed in the future).
  • Requests for static content (e.g., /robots.txt) and special pages (e.g., the HTTP API, /stats) no longer create login session state.
  • The secret used to sign the express_sid cookie is now automatically regenerated every day (called key rotation) by default. If key rotation is enabled, the now-deprecated SESSIONKEY.txt file can be safely deleted after Etherpad starts up (its content is read and saved to the database and used to validate signatures from old cookies until they expire).
• The following settings from settings.json are now applied as expected (they were unintentionally ignored before):
  • padOptions.lang
  • padOptions.showChat
  • padOptions.userColor
  • padOptions.userName
• HTTP API:
  • Fixed the return value of getText when called with a specific revision.
  • Fixed a potential attribute pool corruption bug with copyPadWithoutHistory.
  • Mappings created by createGroupIfNotExistsFor are now removed from the database when the group is deleted.
  • Fixed race conditions in the setText, appendText, and restoreRevision functions.
  • Added an optional authorId parameter to appendText, copyPadWithoutHistory, createGroupPad, createPad, restoreRevision, setHTML, and setText, and bumped the latest API version to 1.3.0.
• Fixed a crash if the database is busy enough to cause a query timeout.
• New /health endpoint for getting information about Etherpad's health (see draft-inadarei-api-health-check-06).
• Docker now uses the new /health endpoint for health checks, which avoids issues when authentication is enabled. It also avoids the unnecessary creation of database records for managing browser sessions.
• When copying a pad, the pad's records are copied in batches to avoid database timeouts with large pads.
• Exporting a large pad to .etherpad format should be faster thanks to bulk database record fetches.
• When importing an .etherpad file, records are now saved to the database in batches to avoid database timeouts with large pads.

For plugin authors

• New expressPreSession server-side hook.
• Pad server-side hook changes:
  • padCheck: New hook.
  • padCopy: New srcPad and dstPad context properties.
  • padDefaultContent: New hook.
  • padRemove: New pad context property.
• The db property on Pad objects is now public.
• New getAuthorId server-side hook.
• New APIs for processing attributes: ep_etherpad-lite/static/js/attributes (low-level API) and ep_etherpad-lite/static/js/AttributeMap (high-level API).
• The import server-side hook has a new ImportError context property.
• New exportEtherpad and importEtherpad server-side hooks.
• The handleMessageSecurity and handleMessage server-side hooks have a new sessionInfo context property that includes the user's author ID, the pad ID, and whether the user only has read-only access.
• The handleMessageSecurity server-side hook can now be used to grant write access for the current message only.
• The init_<pluginName> server-side hooks have a new logger context property that plugins can use to log messages.
• Prevent infinite loop when exiting the server
• Bump dependencies

Compatibility changes

• Node.js v14.15.0 or later is now required.
• The default login session expiration (applicable if requireAuthentication is true) changed from never to 10 days after the user leaves.

For plugin authors

• The client context property for the handleMessageSecurity and handleMessage server-side hooks is deprecated; use the socket context property instead.
• Pad server-side hook changes:
  • padCopy:
    • The originalPad context property is deprecated; use srcPad instead.
    • The destinationID context property is deprecated; use dstPad.id instead.
  • padCreate: The author context property is deprecated; use the new authorId context property instead. Also, the hook now runs asynchronously.
  • padLoad: Now runs when a temporary Pad object is created during import. Also, it now runs asynchronously.
  • padRemove: The padID context property is deprecated; use pad.id instead.
  • padUpdate: The author context property is deprecated; use the new authorId context property instead. Also, the hook now runs asynchronously.
• Returning true from a handleMessageSecurity hook function is deprecated; return 'permitOnce' instead.
• Changes to the src/static/js/Changeset.js library:
  • The following attribute processing functions are deprecated (use the new attribute APIs instead):
    • attribsAttributeValue()
    • eachAttribNumber()
    • makeAttribsString()
    • opAttributeValue()
  • opIterator(): Deprecated in favor of the new deserializeOps() generator function.
  • appendATextToAssembler(): Deprecated in favor of the new opsFromAText() generator function.
  • newOp(): Deprecated in favor of the new Op class.
• The AuthorManager.getAuthor4Token() function is deprecated; use the new AuthorManager.getAuthorId() function instead.
• The exported database records covered by the exportEtherpadAdditionalContent server-side hook now include keys like ${customPrefix}:${padId}:*, not just ${customPrefix}:${padId}.
• Plugin locales should overwrite core's locales Stale
• Plugin locales overwrite core locales

1.8.18

Released: 2022-05-05

Notable enhancements and fixes

• Upgraded ueberDB to fix a regression with CouchDB.

1.8.17

Released: 2022-02-23

Security fixes

• Fixed a vunlerability in the CHANGESET_REQ message handler that allowed a user with any access to read any pad if the pad ID is known.

Notable enhancements and fixes

• Fixed a bug that caused all pad edit messages received at the server to go through a single queue. Now there is a separate queue per pad as intended, which should reduce message processing latency when many pads are active at the same time.

1.8.16

Security fixes

If you cannot upgrade to v1.8.16 for some reason, you are encouraged to try cherry-picking the fixes to the version you are running:

git cherry-pick b7065eb9a0ec..77bcb507b30e

• Maliciously crafted .etherpad files can no longer overwrite arbitrary non-pad database records when imported.
• Imported .etherpad files are now subject to numerous consistency checks before any records are written to the database. This should help avoid denial-of-service attacks via imports of malformed .etherpad files.

Notable enhancements and fixes

• Fixed several .etherpad import bugs.
• Improved support for large .etherpad imports.

1.8.15

Security fixes

• Fixed leak of the writable pad ID when exporting from the pad's read-only ID. This only matters if you treat the writeable pad IDs as secret (e.g., you are not using ep_padlist2) and you share the pad's read-only ID with untrusted users. Instead of treating writeable pad IDs as secret, you are encouraged to take advantage of Etherpad's authentication and authorization mechanisms (e.g., use ep_openid_connect with ep_readonly_guest, or write your own authentication and authorization plugins).
• Updated dependencies.

Compatibility changes

• The logconfig setting is deprecated.

For plugin authors

• Etherpad now uses jsdom instead of cheerio for processing HTML imports. There are two consequences of this change:
  • require('ep_etherpad-lite/node_modules/cheerio') no longer works. To fix, your plugin should directly depend on cheerio and do require('cheerio').
  • The collectContentImage hook's node context property is now an HTMLImageElement object rather than a Cheerio Node-like object, so the API is slightly different. See citizenos/ep_image_upload#49 for an example fix.
• The clientReady server-side hook is deprecated; use the new userJoin hook instead.
• The init_<pluginName> server-side hooks are now run every time Etherpad starts up, not just the first time after the named plugin is installed.
• The userLeave server-side hook's context properties have changed:
  • auth: Deprecated.
  • author: Deprecated; use the new authorId property instead.
  • readonly: Deprecated; use the new readOnly property instead.
  • rev: Deprecated.
• Changes to the src/static/js/Changeset.js library:
  • opIterator(): The unused start index parameter has been removed, as has the unused lastIndex() method on the returned object.
  • smartOpAssembler(): The returned object's appendOpWithText() method is deprecated without a replacement available to plugins (if you need one, let us know and we can make the private opsFromText() function public).
  • Several functions that should have never been public are no longer exported: applyZip(), assert(), clearOp(), cloneOp(), copyOp(), error(), followAttributes(), opString(), stringOp(), textLinesMutator(), toBaseTen(), toSplices().

Notable enhancements and fixes

• Accessibility fix for JAWS screen readers.
• Fixed "clear authorship" error (see issue #5128).
• Etherpad now considers square brackets to be valid URL characters.
• The server no longer crashes if an exception is thrown while processing a message from a client.
• The useMonospaceFontGlobal setting now works (thanks @Lastpixl!).
• Chat improvements:
  • The message input field is now a text area, allowing multi-line messages (use shift-enter to insert a newline).
  • Whitespace in chat messages is now preserved.
• Docker improvements:
  • New HEALTHCHECK instruction (thanks @Gared!).
  • New settings.json variables: DB_COLLECTION, DB_URL, SOCKETIO_MAX_HTTP_BUFFER_SIZE, DUMP_ON_UNCLEAN_EXIT (thanks @JustAnotherArchivist!).
  • .ep_initialized files are no longer created.
• Worked around a Firefox Content Security Policy bug that caused CSP failures when 'self' was in the CSP header. See issue #4975 for details.
• UeberDB upgraded from v1.4.10 to v1.4.18. For details, see the ueberDB changelog. Highlights:
  • The postgrespool driver was renamed to postgres, replacing the old driver of that name. If you used the old postgres driver, you may see an increase in the number of database connections.
  • For postgres, you can now set the dbSettings value in settings.json to a connection string (e.g., "postgres://user:password@host/dbname") instead of an object.
  • For mongodb, the dbName setting was renamed to database (but dbName still works for backwards compatibility) and is now optional (if unset, the database name in url is used).
• /admin/settings now honors the --settings command-line argument.
• Fixed "Author X tried to submit changes as author Y" detection.
• Error message display improvements.
• Simplified pad reload after importing an .etherpad file.

For plugin authors

• clientVars was added to the context for the postAceInit client-side hook. Plugins should use this instead of the clientVars global variable.
• New userJoin server-side hook.
• The userLeave server-side hook has a new socket context property.
• The helper.aNewPad() function (accessible to client-side tests) now accepts hook functions to inject when opening a pad. This can be used to test any new client-side hooks your plugin provides.
• Chat improvements:
  • The chatNewMessage client-side hook context has new properties:
    • message: Provides access to the raw message object so that plugins can see the original unprocessed message text and any added metadata.
    • rendered: Allows plugins to completely override how the message is rendered in the UI.
  • New chatSendMessage client-side hook that enables plugins to process the text before sending it to the server or augment the message object with custom metadata.
  • New chatNewMessage server-side hook to process new chat messages before they are saved to the database and relayed to users.
• Readability improvements to browser-side error stack traces.
• Added support for socket.io message acknowledgments.

1.8.14

Security fixes

• Fixed a persistent XSS vulnerability in the Chat component. In case you can't update to 1.8.14 directly, we strongly recommend to cherry-pick a796811558. Thanks to sonarsource for the professional disclosure.

Compatibility changes

• Node.js v12.13.0 or later is now required.
• The favicon setting is now interpreted as a pathname to a favicon file, not a URL. Please see the documentation comment in settings.json.template.
• The undocumented faviconPad and faviconTimeslider settings have been removed.
• MySQL/MariaDB now uses connection pooling, which means you will see up to 10 connections to the MySQL/MariaDB server (by default) instead of 1. This might cause Etherpad to crash with a "ER_CON_COUNT_ERROR: Too many connections" error if your server is configured with a low connection limit.
• Changes to environment variable substitution in settings.json (see the documentation comments in settings.json.template for details):
  • An environment variable set to the string "null" now becomes null instead of the string "null". Similarly, if the environment variable is unset and the default value is "null" (e.g., "${UNSET_VAR:null}"), the value now becomes null instead of the string "null". It is no longer possible to produce the string "null" via environment variable substitution.
  • An environment variable set to the string "undefined" now causes the setting to be removed instead of set to the string "undefined". Similarly, if the environment variable is unset and the default value is "undefined" (e.g., "${UNSET_VAR:undefined}"), the setting is now removed instead of set to the string "undefined". It is no longer possible to produce the string "undefined" via environment variable substitution.
  • Support for unset variables without a default value is now deprecated. Please change all instances of "${FOO}" in your settings.json to ${FOO:null} to keep the current behavior.
  • The DB_* variable substitutions in settings.json.docker that previously defaulted to null now default to "undefined".
• Calling next without argument when using Changeset.opIterator does always return a new Op. See b9753dcc71 for details.

Notable enhancements and fixes

• MySQL/MariaDB now uses connection pooling, which should improve stability and reduce latency.
• Bulk database writes are now retried individually on write failure.
• Minify: Avoid crash due to unhandled Promise rejection if stat fails.
• padIds are now included in /socket.io query string, e.g. https://video.etherpad.com/socket.io/?padId=AWESOME&EIO=3&transport=websocket&t=...&sid=.... This is useful for directing pads to separate socket.io nodes.