X-Git-Url: http://www.privoxy.org/gitweb/?a=blobdiff_plain;f=doc%2Fsource%2Fchangelog.sgml;h=7025d15588220c41d38e244551ed96bd0b20fc75;hb=3f9f7065e662a7c78f93d3f97ebe40452605976a;hp=047517c203159c34caeaa55c6c9704851222ae38;hpb=1ced0af6010e7bec3b2594046a6b9b27f7b0559e;p=privoxy.git diff --git a/doc/source/changelog.sgml b/doc/source/changelog.sgml index 047517c2..7025d155 100644 --- a/doc/source/changelog.sgml +++ b/doc/source/changelog.sgml @@ -1,11 +1,9 @@ - - Privoxy 3.0.23 stable is a bug-fix release, - some of the fixed bugs are security issues (CVE requests pending): - - + + Privoxy 3.0.34 fixes a few + minor bugs and comes with a couple of general improvements + and new features. + + + Changes in Privoxy 3.0.34 stable: + @@ -38,38 +39,68 @@ - Fixed a DoS issue in case of client requests with incorrect - chunk-encoded body. When compiled with assertions enabled - (the default) they could previously cause Privoxy to abort(). - Reported by Matthew Daley. + Improve the handling of chunk-encoded responses by buffering the data + even if filters are disabled and properly keeping track of where the + various chunks are supposed to start and end. Previously Privoxy would + merely check the last bytes received to see if they looked like the + last-chunk. This failed to work if the last-chunk wasn't received in one + read and could also result in actual data being misdetected + as last-chunk. + Should fix: SF support request #1739. + Reported by: withoutname. + + + + + remove_chunked_transfer_coding(): Refuse to de-chunk invalid data + Previously the data could get corrupted even further. + Now we simply pass the unmodified data to the client. - Fixed multiple segmentation faults and memory leaks in the - pcrs code. This fix also increases the chances that an invalid - pcrs command is rejected as such. Previously some invalid commands - would be loaded without error. Note that Privoxy's pcrs sources - (action and filter files) are considered trustworthy input and - should not be writable by untrusted third-parties. + gif_deanimate(): Tolerate multiple image extensions in a row. + This allows to deanimate all the gifs on: + https://commons.wikimedia.org/wiki/Category:Animated_smilies + Fixes SF bug #795 reported by Celejar. - Fixed an 'invalid read' bug which could at least theoretically - cause Privoxy to crash. So far, no crashes have been observed. + OpenSSL generate_host_certificate(): Use X509_get_subject_name() + instead of X509_get_issuer_name() to get the issuer for generated + website certificates so there are no warnings in the browser when using + an intermediate CA certificate instead of a self-signed root certificate. + Problem reported and patch submitted by Chakib Benziane. - Compiles with --disable-force again. Reported by Kai Raven. + can_filter_request_body(): Fix a log message that contained a spurious u. - Client requests with body that can't be delivered no longer - cause pipelined requests behind them to be rejected as invalid. - Reported by Basil Hussain. + handle_established_connection(): Check for pending TLS data from the client + before checking if data is available on the connection. + The TLS library may have already consumed all the data from the client + response in which case poll() and select() will not detect that data is + available to be read. + Sponsored by: Robert Klemme. + + + + + ssl_send_certificate_error(): Don't crash if there's no certificate + information available. This is only relevant when Privoxy is built with + wolfSSL 5.0.0 or later (code not yet published). Earlier wolfSSL versions + or the other TLS backends don't seem to trigger the crash. + + + + + socks5_connect(): Add support for target hosts specified as IPv4 address + Previously the IP address was sent as domain. @@ -81,14 +112,74 @@ - If a pcrs command is rejected as invalid, Privoxy now logs - the cause of the problem as text. Previously the pcrs error - code was logged. + Add a client-body-tagger action which creates tags based on + the content of the request body. + Sponsored by: Robert Klemme. + + + + + When client-body filters are enabled, buffer the whole request + before opening a connection to the server. + Makes it less likely that the server connection times out + and we don't open a connection if the buffering fails anyway. + Sponsored by: Robert Klemme. + + + + + Add periods to a couple of log messages. + + + + + accept_connection(): Add missing space to a log message. + + + + + Initialize ca-related defaults with strdup_or_die() so errors + aren't silently ignored. + + + + + make_path: Use malloc_or_die() in cases where allocation errors + were already fatal anyway. + + + + + handle_established_connection(): Improve an error message slightly. + + + + + receive_client_request(): Reject https URLs without CONNECT request. + + + + + Include all requests in the statistics if mutexes are available. + Previously in case of reused connections only the last request got + counted. The statistics still aren't perfect but it's an improvement. + + + + + Add read_socks_reply() and start using it in socks5_connect() + to apply the socket timeout more consistently. - The tests are less likely to cause false positives. + socks5_connect(): Deal with domain names in the socks reply + + + + + Add a filter for bundeswehr.de that hides the cookie and + privacy info banner. @@ -100,13 +191,164 @@ - '.sify.com/' is no longer blocked. Apparently it is not actually - a pure tracking site (anymore?). Reported by Andrew on ijbswa-users@. + Disable filter{banners-by-size} for .freiheitsfoo.de/. + + + + + Disable filter{banners-by-size} for freebsdfoundation.org/. + + + + + Disable fast-redirects for consent.youtube.com/. + + + + + Block requests to ups.xplosion.de/. + + + + + Block requests for elsa.memoinsights.com/t. + + + + + Fix a typo in a test. + + + + + Disable fast-redirects for launchpad.net/. + + + + + Unblock .eff.org/. + + + + + Stop unblocking .org/.*(image|banner) which appears to be too generous + The example URL http://www.gnu.org/graphics/gnu-head-banner.png is + already unblocked due to .gnu.org being unblocked. + + + + + Unblock adfd.org/. + + + + + Disable filter{banners-by-link} for .eff.org/. + + + + + Block requests to odb.outbrain.com/. + + + + + Disable fast-redirects for .gandi.net/. + + + + + Disable fast-redirects{} for .onion/.*/status/. + + + + + Disable fast-redirects{} for twitter.com/.*/status/. + + + + + Unblock pinkstinks.de/. + + + + + Disable fast-redirects for .hagalil.com/. + + + + + + + + Privoxy-Log-Parser: + + + + Bump version to 0.9.5. + + + + + Highlight more log messages. + + + + + Highlight the Crunch reason only once. Previously the "crunch reason" + could also be highlighted when the URL contained a matching string. + The real crunch reason only occurs once per line, so there's no need + to continue looking for it after it has been found once. + While at it, add a comment with an example log line. + + + + + + + + uagen: + + + + Bump version to 1.2.4. + + + + + Update BROWSER_VERSION and BROWSER_REVISION to 102.0 + to match the User-Agent of the current Firefox ESR. + + + + + Explicitly document that changing the 'Gecko token' is suspicious. + + + + + Consistently use a lower-case 'c' as copyright symbol. + + + + + Bump copyright. + + + + + Add 'aarch64' as Linux architecture. - Unblock banners on .amnesty.de/ which aren't ads. + Add OpenBSD architecture 'arm64'. + + + + + Stop using sparc64 as FreeBSD architecture. + It hasn't been supported for a while now. @@ -114,36 +356,62 @@ - Documentation improvements: + Build system: - The 'Would you like to donate?' section now also contains - a "Paypal" address. + Makefile: Add a 'dok' target that depends on the 'error' target + to show the "You are not using GNU make or did nor run configure" + message. - The list of supported operating systems has been updated. + configure: Fix --with-msan option. + Also (probably) reported by Andrew Savchenko. + + + + + + + + macOS build system: + + + + Enable HTTPS inspection when building the macOS binary + (using OpenSSL as TLS library). + + + + + + + + Documentation: + + + + Add OpenSSL to the list of libraries that may be licensed under the + Apache 2.0 license in which case the linked Privoxy binary has to be + distributed under the GPLv3 or later. - The existence of the SF support and feature trackers has been - deemphasized because they have been broken for months. - Most of the time the mailing lists still work. + config: Fix the documented ca-directory default value. + Reported by avoidr. - The claim that default.action updates are sometimes released - on their own has been removed. It hasn't happened in years. + Rebuild developer-manual and tidy with 'HTML Tidy for FreeBSD version 5.8.0'. - Explicitly mention that Tor's port may deviate from the default - when using a bundle. Requested by Andrew on ijbswa-users@. + Update developer manual with new macOS packaging instructions.