X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=doc%2Fwebserver%2Fannounce.txt;h=549b12c18a221edf6265244415a3d2db8f9ffdc1;hp=3c61690873cd0feddb124c54a34ded49a5bdaaec;hb=871d2748df537ed2d2dc21dc45836a754aaa264e;hpb=0a3b17226e59b8e9c94fb5bbfa2ad1290e53e101 diff --git a/doc/webserver/announce.txt b/doc/webserver/announce.txt index 3c616908..549b12c1 100644 --- a/doc/webserver/announce.txt +++ b/doc/webserver/announce.txt @@ -1,140 +1,127 @@ - Announcing Privoxy v.3.0.11 ------------------------------------------------------------------ - -3.0.11 is a stable release which includes many enhancements but no major -new features. The most prominent new feature is support for "keep-alive" -connection. There are many small improvements. + Announcing Privoxy 3.0.23 stable +-------------------------------------------------------------------- -See http://www.privoxy.org/3.0.11/user-manual/whatsnew.html for details. +Privoxy 3.0.23 stable is a bug-fix release, some of the fixed bugs +are security issues (CVE requests pending): -------------------------------------------------------------------- ChangeLog for Privoxy -------------------------------------------------------------------- - -*** Version 3.0.11 *** - -- On most platforms, outgoing connections can be kept alive and - reused if the server supports it. Whether or not this improves - things depends on the connection. -- When dropping privileges, membership in supplementary groups - is given up as well. Not doing that can lead to Privoxy running - with more rights than necessary and violates the principle of - least privilege. Users of the --user option are advised to update. - Thanks to Matthias Drochner for reporting the problem, - providing the initial patch and testing the final version. -- Passing invalid users or groups with the --user option - didn't lead to program exit. Regression introduced in 3.0.7. -- The match all section has been moved from default.action - to a new file called match-all.action. As a result the - default.action no longer needs to be touched by the user - and can be safely overwritten by updates. -- The standard.action file has been removed. Its content - is now part of the default.action file. -- In some situations the logged content length was slightly too low. -- Crunched requests are logged with their own log level. - If you used "debug 1" in the past, you'll probably want - to additionally enable "debug 1024", otherwise only passed - requests will be logged. If you only care about crunched - requests, simply replace "debug 1" with "debug 1024". -- The crunch reason has been moved to the beginning of the - crunch message. For HTTP URLs, the protocol is logged as well. -- Log messages are shortened by not printing the thread id - on its own (as opposed to putting it inside "Privoxy()". -- The config option socket-timeout has been added to control - the time Privoxy waits for data to arrive on a socket. -- Support for remote toggling is controlled by the configure - option --disable-toggle only. In previous versions it also - depended on the action editor and thus configuring with the - --disable-editor option would disable remote toggling support - as well. -- Requests with invalid HTTP versions are rejected. -- The template symbol @date@ can be used to include a date(1)-like - time string. Initial patch submitted by Endre Szabo. -- Responses from shoutcast servers are accepted again. - Problem reported and fix suggested by Stefan. -- The hide-forwarded-for-headers action has been replaced with - the change-x-forwarded-for{} action which can also be used to - add X-Forwarded-For headers. The latter functionality already - existed in Privoxy versions prior to 3.0.7 but has been removed - as it was often used unintentionally (by not using the - hide-forwarded-for-headers action). -- A "clear log" view option was added to the mingw32 version - to clear out all of the lines in the Privoxy log window. - Based on a patch submitted by T Ford. -- The mingw32 version uses "critical sections" now, which prevents - log message corruption under load. As a side effect, the - "no thread-safe PRNG" warning could be removed as well. -- The mingw32 version's task bar icon is crossed out and - the color changed to gray if Privoxy is toggled off. +*** Version 3.0.23 stable *** + +- Bug fixes: + - Fixed a DoS issue in case of client requests with incorrect + chunk-encoded body. When compiled with assertions enabled + (the default) they could previously cause Privoxy to abort(). + Reported by Matthew Daley. + - Fixed multiple segmentation faults and memory leaks in the + pcrs code. This fix also increases the chances that an invalid + pcrs command is rejected as such. Previously some invalid commands + would be loaded without error. Note that Privoxy's pcrs sources + (action and filter files) are considered trustworthy input and + should not be writable by untrusted third-parties. + - Fixed an 'invalid read' bug which could at least theoretically + cause Privoxy to crash. So far, no crashes have been observed. + - Compiles with --disable-force again. Reported by Kay Raven. + - Client requests with body that can't be delivered no longer + cause pipelined requests behind them to be rejected as invalid. + Reported by Basil Hussain. + +- General improvements: + - If a pcrs command is rejected as invalid, Privoxy now logs + the cause of the problem as text. Previously the pcrs error + code was logged. + - The tests are less likely to cause false positives. + +- Action file improvements: + - '.sify.com/' is no longer blocked. Apparently it is not actually + a pure tracking site (anymore?). Reported by Andrew on ijbswa-users@. + - Unblock banners on .amnesty.de/ which aren't ads. + +- Documentation improvements: + - The 'Would you like to donate?' section now also contains + a "Paypal" address. + - The list of supported operating systems has been updated. + - The existence of the SF support and feature trackers has been + deemphasized because they have been broken for months. + Most of the time the mailing lists still work. + - The claim that default.action updates are sometimes released + on their own has been removed. It hasn't happened in years. + - Explicitly mention that Tor's port may deviate from the default + when using a bundle. Requested by Andrew on ijbswa-users@. ----------------------------------------------------------------- About Privoxy: ----------------------------------------------------------------- -Privoxy is a web proxy with advanced filtering capabilities for -protecting privacy, modifying web page data, managing cookies, -controlling access, and removing ads, banners, pop-ups and other -obnoxious Internet junk. Privoxy has a very flexible -configuration and can be customized to suit individual needs -and tastes. Privoxy has application for both stand-alone systems -and multi-user networks. +Privoxy is a non-caching web proxy with advanced filtering capabilities for +enhancing privacy, modifying web page data and HTTP headers, controlling +access, and removing ads and other obnoxious Internet junk. Privoxy has a +flexible configuration and can be customized to suit individual needs and +tastes. It has application for both stand-alone systems and multi-user +networks. -Privoxy is based on Internet Junkbuster (tm). +Privoxy is Free Software and licensed under the GNU GPLv2. -At present, Privoxy is known to run on Windows(95, 98, ME, 2000, -XP, Vista), Linux (Ubuntu, RedHat, SuSE, Debian, Fedora, Gentoo and -others), Mac OSX, OS/2, AmigaOS, FreeBSD, NetBSD, OpenBSD, Solaris, and -various other flavors of Unix. +Our TODO list is rather long. Helping hands and donations are welcome: -In addition to the core features of ad blocking and cookie management, Privoxy provides many supplemental features, that give the end-user more control, more privacy and more freedom: + * http://www.privoxy.org/faq/general.html#PARTICIPATE + * http://www.privoxy.org/faq/general.html#DONATE - * Can keep outgoing connections alive and reuse them later on. +At present, Privoxy is known to run on Windows 95 and later versions +(98, ME, 2000, XP, Vista, Windows 7 etc.), GNU/Linux (RedHat, SuSE, +Debian, Fedora, Gentoo, Slackware and others), Mac OS X (10.4 and +upwards on PPC and Intel processors), OS/2, Haiku, DragonFly, +FreeBSD, NetBSD, OpenBSD, Solaris, and various other flavors of Unix. - * Supports tagging which allows to change the behaviour based on client - and server headers. +In addition to the core features of ad blocking and cookie management, +Privoxy provides many supplemental features, that give the end-user +more control, more privacy and more freedom: - * Can be run as an "intercepting" proxy, which obviates the need to - configure browsers individually. + * Supports "Connection: keep-alive". Outgoing connections can be kept + alive independently from the client. Currently not available on all + platforms. - * Sophisticated actions and filters for manipulating both server and - client headers. + * Supports IPv6, provided the operating system does so too, + and the configure script detects it. - * Can be chained with other proxies. + * Supports tagging which allows to change the behaviour based on client + and server headers. - * Integrated browser based configuration and control utility at - http://config.privoxy.org/ (shortcut: http://p.p/). Browser-based - tracing of rule and filter effects. Remote toggling. + * Can be run as an "intercepting" proxy, which obviates the need to + configure browsers individually. - * Web page filtering (text replacements, removes banners based on size, - invisible "web-bugs", JavaScript and HTML annoyances, pop-up windows, - etc.) + * Sophisticated actions and filters for manipulating both server and + client headers. - * Modularized configuration that allows for standard settings and user - settings to reside in separate files, so that installing updated actions - files won't overwrite individual user settings. + * Can be chained with other proxies. - * Support for Perl Compatible Regular Expressions in the configuration - files, and a more sophisticated and flexible configuration syntax. + * Integrated browser based configuration and control utility at + http://config.privoxy.org/ (shortcut: http://p.p/). Browser-based + tracing of rule and filter effects. Remote toggling. - * Improved cookie management features (e.g. session based cookies). + * Web page filtering (text replacements, removes banners based on size, + invisible web-bugs and HTML annoyances, etc.) - * GIF de-animation. + * Modularized configuration that allows for standard settings and user + settings to reside in separate files, so that installing updated actions + files won't overwrite individual user settings. - * Bypass many click-tracking scripts (avoids script redirection). + * Support for Perl Compatible Regular Expressions in the configuration + files, and a more sophisticated and flexible configuration syntax. - * Multi-threaded (POSIX and native threads). + * GIF de-animation. - * User-customizable HTML templates for most proxy-generated pages (e.g. - "blocked" page). + * Bypass many click-tracking scripts (avoids script redirection). - * Auto-detection and re-reading of config file changes. + * User-customizable HTML templates for most proxy-generated pages (e.g. + "blocked" page). - * Improved signal handling, and a true daemon mode (Unix). - - * Every feature now controllable on a per-site or per-location basis, - configuration more powerful and versatile over-all. + * Auto-detection and re-reading of config file changes. + * Most features are controllable on a per-site or per-location basis. + Download location: http://sourceforge.net/project/showfiles.php?group_id=11118 @@ -142,5 +129,4 @@ Download location: Home Page: http://www.privoxy.org/ - - Privoxy Developers