Skip to content

Releases: mikitex70/redmine_drawio

Potential XSS security vulnerability

18 Jun 08:52
Compare
Choose a tag to compare

Fixed a potential XSS security vulnerability on macro dialogs.
The vulnerability is really minimal as the form is never submitted, but can made happy automatic scanning tools.

Other German translations have also been added in this version.

Fixed working on Redmine 5

20 May 16:39
Compare
Choose a tag to compare

Thanks to the contribution from @sk-ys the plugin now works fine on Redmine 5.

Fixed viewer for diagrams in XML format

14 May 15:37
Compare
Choose a tag to compare

A recent change to the Drawio script for viewing diagrams in XML format broke the plug-in.
With this release it should be more resilient to change.

Administrator can now completely disable SVG diagram support

19 Feb 17:23
Compare
Choose a tag to compare

For security reasons now if the administrator disable SVG diagrams, they are fully disabled: existing SVG diagrams are no longer displayed and must be converted to another format.

Fixed rendering of diagrams in XML format

05 Jan 14:55
Compare
Choose a tag to compare

This is a minor fix, to track changes of an external Javascript from embed.diagrams.net (see #105).
The error is independent from the redmine_drawio plugin version, it also affects past versions, starting from when that file was modified.

Fixed XSS security with svg diagrams

24 Nov 17:43
Compare
Choose a tag to compare

Diagrams in SVG format can introduce XSS security issues, as they can have Javascript inside.

In this version a plugin setting has been added to allow to choose how svg images are displayed:

  • if svg is disabled, they are rendered as a base64 svg (hyperlinks not working)
  • if svg is enabled, they are rendered as inline svg, but they are vulnerable to XSS issues (mitigated, but not eliminated)

See the README.md for more details.
Many thanks to @maudov for pointing me to this important issue.

Fixed XSS security with svg diagrams

26 Sep 18:38
Compare
Choose a tag to compare

Changes in this release:

  • fixed a XSS security problem with SVG diagrams, which could be used to execute arbitrary Javascript in the browser
  • added comment in wiki page when editing an attached diagram.

Fixed saving in wiki pages with single quotes

19 Aug 06:03
Compare
Choose a tag to compare

Fixed saving diagrams as attachments in wiki pages with single quotes in the page name (fixes #98).

Fixed view of XML diagrams

16 Jul 16:21
Compare
Choose a tag to compare

The dynamic patch of the viewer-static.min.js was broken due to an
update of the library.
Now the dynamic patch should be more robust.

Enabled use of custom libraries in the diagram editor

18 Jun 05:58
Compare
Choose a tag to compare

Only a minor change.
Now is in the diagram editor is possible to create and use custom libraries of shapes.