HedgeDoc

This release fixes a security issue. We recommend upgrading as soon as possible.

⚠️ Warning: If you deploy HedgeDoc and MariaDB with docker-compose using a checkout of our container repo, you will need to manually convert the character set of the database to utf8mb4 when updating. See the corresponding PR for more information.

Security Fixes

• CVE-2022-24837: Enumerable upload file names

Enhancements

• Libravatar avatars render as ident-icons when no avatar image was uploaded to Libravatar or Gravatar
• Add database connection error message to log output
• Allow SAML authentication provider to be named
• Suppress error message when git binary is not found

Bugfixes

• Fix error that Libravatar user avatars were not shown when using OAuth2 login
• Fix bin/manage_users not accepting numeric passwords (thanks to @carr0t2 for reporting)
• Fix visibility of modals for screen readers
• Fix GitLab snippet export (thanks to @semjongeist for reporting)
• Fix missing inline authorship colors (thanks to @EBendinelli for reporting)

Contributors

• ced (translator)
• deluxghost (translator)
• Dennis Gaida
• Michael Hauer (translator)
• Moritz Schlarb
• Mostafa Ahangarha (translator)
• Sandro
• Sergio Varela (translator)
• Tạ Quang Khôi (translator)
• Tiago Triques (translator)
• tmpod (translator)
• Uchiha Kakashi