Releases: mikitex70/redmine_drawio
Potential XSS security vulnerability
Fixed a potential XSS security vulnerability on macro dialogs.
The vulnerability is really minimal as the form is never submitted, but can made happy automatic scanning tools.
Other German translations have also been added in this version.
Fixed working on Redmine 5
Thanks to the contribution from @sk-ys the plugin now works fine on Redmine 5.
Fixed viewer for diagrams in XML format
A recent change to the Drawio script for viewing diagrams in XML format broke the plug-in.
With this release it should be more resilient to change.
Administrator can now completely disable SVG diagram support
For security reasons now if the administrator disable SVG diagrams, they are fully disabled: existing SVG diagrams are no longer displayed and must be converted to another format.
Fixed rendering of diagrams in XML format
This is a minor fix, to track changes of an external Javascript from embed.diagrams.net
(see #105).
The error is independent from the redmine_drawio
plugin version, it also affects past versions, starting from when that file was modified.
Fixed XSS security with svg diagrams
Diagrams in SVG format can introduce XSS security issues, as they can have Javascript inside.
In this version a plugin setting has been added to allow to choose how svg images are displayed:
- if svg is disabled, they are rendered as a base64 svg (hyperlinks not working)
- if svg is enabled, they are rendered as inline svg, but they are vulnerable to XSS issues (mitigated, but not eliminated)
See the README.md
for more details.
Many thanks to @maudov for pointing me to this important issue.
Fixed XSS security with svg diagrams
Changes in this release:
- fixed a XSS security problem with SVG diagrams, which could be used to execute arbitrary Javascript in the browser
- added comment in wiki page when editing an attached diagram.
Fixed saving in wiki pages with single quotes
Fixed saving diagrams as attachments in wiki pages with single quotes in the page name (fixes #98).
Fixed view of XML diagrams
The dynamic patch of the viewer-static.min.js
was broken due to an
update of the library.
Now the dynamic patch should be more robust.
Enabled use of custom libraries in the diagram editor
Only a minor change.
Now is in the diagram editor is possible to create and use custom libraries of shapes.