There are many improvements and new features since Privoxy 3.0.8, the last stable release:
Added SOCKS5 support (with address resolution done by - the SOCKS5 server). Patch provided by Eric M. Hopper. -
The "blocked" CGI pages include a block reason that was - provided as argument to the last-applying block action. -
If enable-edit-actions is disabled (the default since 3.0.7 beta) - the show-status page hides the edit buttons and explains why. - Previously the user would get the "this feature has been disabled" - message after using the edit button. -
Forbidden CONNECT requests are treated like blocks by default. - The now-pointless treat-forbidden-connects-like-blocks action - has been removed. -
Not enabling limit-connect now allows CONNECT requests to all ports. - In previous versions it would only allow CONNECT requests to port 443. - Use +limit-connect{443} if you think you need the old default behaviour. -
The CGI editor gets turned off after three edit requests with invalid - file modification timestamps. This makes life harder for attackers - who can leverage browser bugs to send fake Referers and intend to - brute-force edit URLs. -
Action settings for multiple patterns in the same section are - shared in memory. As a result these sections take up less space - (and are loaded slightly faster). Problem reported by Franz Schwartau. -
Linear white space in HTTP headers will be normalized to single - spaces before parsing the header's content, headers split across - multiple lines get merged first. -
Host information is gathered outside the main thread so it's less - likely to delay other incoming connections if the host is misconfigured. -
New config option "hostname" to use a hostname other than - the one returned by the operating system. Useful to speed-up responses - for CGI requests on misconfigured systems. Requested by Max Khon. -
The CGI editor supports the "disable all filters of this type" - directives "-client-header-filter", "-server-header-filter", - "-client-header-tagger" and "-server-header-tagger". -
Fixed false-positives with the link-by-url filter and URLs that - contain the pattern "/jump/". -
The less-download-windows filter no longer messes - "Content-Type: application/x-shockwave-flash" headers up. -
In the show-url-info page's "Final results" section active and - inactive actions are listed separately. Patch provided by Lee. -
The GNUmakefile supports the DESTDIR variable. Patch for - the install target submitted by Radoslaw Zielinski. -
Embedding the content of configuration files in the show-status - page is significantly faster now. For a largish action file (1 MB) - a speedup of about 2450 times has been measured. This is mostly - interesting if you are using large action files or regularly use - Privoxy-Regression-Test while running Privoxy through Valgrind, - for stock configuration files it doesn't really matter. -
If zlib support is unavailable and there are content - filters active but the prevent-compression action is disabled, - the show-url-info page includes a warning that compression - might prevent filtering. -
The show-url-info page provides an OpenSearch Description that - allows to access the page through browser search plugins. -
The obsolete kill-popups action has been removed as the - PCRS-based popup filters can do the same and are slightly - less unreliable. -
The inspect-jpegs action has been removed. -
The send-wafer and send-vanilla-wafer actions have been removed. - They weren't particular useful and their behaviour could be emulated - with add-header anyway. -
Privoxy-Regression-Test has been significantly improved. -
Most sections in the default.action file contain tests for - Privoxy-Regression-Test to verify that they are working as intended. -
Parts of Privoxy have been refactored to increase maintainability. -
Building with zlib (if available) is done by default. -
For a more detailed list of changes please have a look at the ChangeLog.
A quick list of things to be aware of before upgrading from earlier - versions of Privoxy:
The recommended way to upgrade Privoxy is to backup your old - configuration files, install the new ones, verify that Privoxy - is working correctly and finally merge back your changes using - diff and maybe patch. -
There are a number of new features in each Privoxy release and - most of them have to be explicitly enabled in the configuration - files. Old configuration files obviously don't do that and due - to syntax changes using old configuration files with a new - Privoxy isn't always possible anyway. -
- Note that some installers remove earlier versions completely, - including configuration files, therefore you should really save - any important configuration files! -
- On the other hand, other installers don't overwrite existing configuration - files, thinking you will want to do that yourself. -
- standard.action now only includes the enabled actions. - Not all actions as before. -
In the default configuration only fatal errors are logged now. - You can change that in the debug section - of the configuration file. You may also want to enable more verbose - logging until you verified that the new Privoxy version is working - as expected. -
Three other config file settings are now off by default: - enable-remote-toggle, - enable-remote-http-toggle, - and enable-edit-actions. - If you use or want these, you will need to explicitly enable them, and - be aware of the security issues involved. -
The "filter-client-headers" and - "filter-server-headers" actions that were introduced with - Privoxy 3.0.5 to apply content filters to - the headers have been removed and replaced with new actions. - See the What's New section above. -
Privoxy 3.0.24 stable contains a + couple of new features but is mainly a bug-fix release. Two of the fixed + bugs are security issues and may be used to remotely trigger crashes on + platforms that carefully check memory accesses (most don't).
+ +Security fixes (denial of service):
+ +Prevent invalid reads in case of corrupt chunk-encoded + content. CVE-2016-1982. Bug discovered with afl-fuzz and + AddressSanitizer.
+Remove empty Host headers in client requests. Previously they + would result in invalid reads. CVE-2016-1983. Bug discovered with + afl-fuzz and AddressSanitizer.
+Bug fixes:
+ +When using socks5t, send the request body optimistically as + well. Previously the request body wasn't guaranteed to be sent at + all and the error message incorrectly blamed the server. Fixes + #1686 reported by Peter Müller and G4JC.
+Fixed buffer scaling in execute_external_filter() that could + lead to crashes. Submitted by Yang Xia in #892.
+Fixed crashes when executing external filters on platforms + like Mac OS X. Reported by Jonathan McKenzie on + ijbswa-users@.
+Properly parse ACL directives with ports when compiled with + HAVE_RFC2553. Previously the port wasn't removed from the host + and in case of 'permit-access 127.0.0.1 example.org:80' Privoxy + would try (and fail) to resolve "example.org:80" instead of + example.org. Reported by Pak Chan on ijbswa-users@.
+Check requests more carefully before serving them forcefully + when blocks aren't enforced. Privoxy always adds the force token + at the beginning of the path, but would previously accept it + anywhere in the request line. This could result in requests being + served that should be blocked. For example in case of pages that + were loaded with force and contained JavaScript to create + additionally requests that embed the origin URL (thus inheriting + the force prefix). The bug is not considered a security issue and + the fix does not make it harder for remote sites to intentionally + circumvent blocks if Privoxy isn't configured to enforce them. + Fixes #1695 reported by Korda.
+Normalize the request line in intercepted requests to make + rewriting the destination more convenient. Previously rewrites + for intercepted requests were expected to fail unless $hostport + was being used, but they failed "the wrong way" and would result + in an out-of-memory message (vanilla host patterns) or a crash + (extended host patterns). Reported by "Guybrush Threepwood" in + #1694.
+Enable socket lingering for the correct socket. Previously it + was repeatedly enabled for the listen socket instead of for the + accepted socket. The bug was found by code inspection and did not + cause any (reported) issues.
+Detect and reject parameters for parameter-less actions. + Previously they were silently ignored.
+Fixed invalid reads in internal and outdated pcre code. Found + with afl-fuzz and AddressSanitizer.
+Prevent invalid read when loading invalid action files. Found + with afl-fuzz and AddressSanitizer.
+Windows build: Use the correct function to close the event + handle. It's unclear if this bug had a negative impact on + Privoxy's behaviour. Reported by Jarry Xu in #891.
+In case of invalid forward-socks5(t) directives, use the + correct directive name in the error messages. Previously they + referred to forward-socks4t failures. Reported by Joel Verhagen + in #889.
+General improvements:
+ +Set NO_DELAY flag for the accepting socket. This significantly + reduces the latency if the operating system is not configured to + set the flag by default. Reported by Johan Sintorn in #894.
+Allow to build with mingw x86_64. Submitted by Rustam + Abdullaev in #135.
+Introduce the new forwarding type 'forward-webserver'. + Currently it is only supported by the forward-override{} action + and there's no config directive with the same name. The + forwarding type is similar to 'forward', but the request line + only contains the path instead of the complete URL.
+The CGI editor no longer treats 'standard.action' special. + Nowadays the official "standards" are part of default.action and + there's no obvious reason to disallow editing them through the + cgi editor anyway (if the user decided that the lack of + authentication isn't an issue in her environment).
+Improved error messages when rejecting intercepted requests + with unknown destination.
+A couple of log messages now include the number of active + threads.
+Removed non-standard Proxy-Agent headers in HTTP snipplets to + make testing more convenient.
+Include the error code for pcre errors Privoxy does not + recognize.
+Config directives with numerical arguments are checked more + carefully.
+Privoxy's malloc() wrapper has been changed to prevent + zero-size allocations which should only occur as the result of + bugs.
+Various cosmetic changes.
+Action file improvements:
+ +Unblock ".deutschlandradiokultur.de/". Reported by u302320 in + #924.
+Add two fast-redirect exceptions for "yandex.ru".
+Disable filter{banners-by-size} for ".plasmaservice.de/".
+Unblock "klikki.fi/adv/".
+Block requests for "resources.infolinks.com/". Reported by + "Black Rider" on ijbswa-users@.
+Block a bunch of criteo domains. Reported by Black Rider.
+Block "abs.proxistore.com/abe/". Reported by Black Rider.
+Disable filter{banners-by-size} for + ".black-mosquito.org/".
+Disable fast-redirects for "disqus.com/".
+Documentation improvements:
+ +FAQ: Explicitly point fingers at ASUS as an example of a + company that has been reported to force malware based on Privoxy + upon its customers.
+Correctly document the action type for a bunch of + "multi-value" actions that were incorrectly documented to be + "parameterized". Reported by Gregory Seidman on + ijbswa-users@.
+Fixed the documented type of the forward-override{} action + which is obviously 'parameterized'.
+Website improvements:
+ +Users who don't trust binaries served by SourceForge can get + them from a mirror. Migrating away from SourceForge is planned + for 2016 (TODO list item #53).
+The website is now available as onion service + (http://jvauzb4sb3bwlsnc.onion/).
+A quick list of things to be aware of before upgrading from earlier + versions of Privoxy:
+ +The recommended way to upgrade Privoxy is to backup your old configuration + files, install the new ones, verify that Privoxy is working correctly and finally merge + back your changes using diff and + maybe patch.
+ +There are a number of new features in each Privoxy release and most of them have to be + explicitly enabled in the configuration files. Old configuration + files obviously don't do that and due to syntax changes using old + configuration files with a new Privoxy isn't always possible anyway.
+Note that some installers remove earlier versions completely, + including configuration files, therefore you should really save any + important configuration files!
+On the other hand, other installers don't overwrite existing + configuration files, thinking you will want to do that + yourself.
+In the default configuration only fatal errors are logged now. + You can change that in the debug + section of the configuration file. You may also want to enable + more verbose logging until you verified that the new Privoxy version is working as expected.
+Three other config file settings are now off by default: + enable-remote-toggle, + enable-remote-http-toggle, + and enable-edit-actions. If you + use or want these, you will need to explicitly enable them, and be + aware of the security issues involved.
+