news.xhtml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   3     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   4 <html xmlns="http://www.w3.org/1999/xhtml"
   5       xmlns:xi="http://www.w3.org/2001/XInclude"
   6       xmlns:xc="urn:xhtml-compiler"
   7       xmlns:rss="urn:xhtml-compiler:RSSGenerator"
   8       xml:lang="en">
   9 <head>
  10 <title>News - HTML Purifier</title>
  11 <xi:include href="common-meta.xml" xpointer="xpointer(/*/node())" />
  12 <meta name="description"
  13       content="Recent news related to HTML Purifier." />
  14 <meta name="keywords"
  15       content="HTMLPurifier, HTML Purifier, HTML, filter, filtering, standards, compliant, w3c, news, blog, releases, rss" />
  16 <link rel="alternate" type="application/rss+xml"
  17       title="News - HTML Purifier" href="news.rss"
  18       rss:for="news-container"
  19       rss:description="Recent news and updates on HTML Purifier" />
  20 </head>
  21 <body>
  22
  23 <xi:include href="common-header.xml" xpointer="xpointer(/*/node())" />
  24 <h1 id="title">News</h1>
  25
  26 <div id="content">
  27
  28 <xi:include href="download-box.xml" xpointer="xpointer(/*/node())" />
  29
  30 <div id="news-container" class="news">
  31
  32 <div class="item" id="git">
  33   <h3 class="title">Switching to Git</h3>
  34   <div class="date">Mon, 23 June 2008 22:42:00 EST</div>
  35
  36   <div class="body">
  37     <p>
  38       After several weeks of testing, HTML Purifier is proud to announce that
  39       it will be switching to Git as its source control management system.
  40       Git offers a number of advantages over Subversion:
  41     </p>
  42     <ul>
  43       <li>
  44         <em>Superior support for branchy development.</em> Subversion 1.5 introduces
  45         merge-tracking which somewhat diminishes this benefit, but implementing
  46         that is entirely at the whimsy of Dreamhost, which I am not going to
  47         bother with.
  48       </li>
  49       <li>
  50         <em>Increased possibility for user participation.</em> Git makes it extremely
  51         easy to do local development and submit patches.
  52       </li>
  53       <li>
  54         <em>Data redundancy.</em> Every user has a complete copy of HTML Purifier's
  55         history, making it extremely difficult to lose data. This is opposed
  56         to our current setup, where htmlpurifier.org is a central point of failure,
  57         and backups are sent to only one other machine.
  58       </li>
  59       <li>
  60         <em>Performance.</em> Git is fast, both in terms of disk operations
  61         and network operations. Gone are the days of waiting several minutes
  62         for Subversion to finish committing.
  63       </li>
  64     </ul>
  65     <p>
  66       Currently, only <code>htmlpurifier</code> has been migrated to Git;
  67       <code>htmlpurifier-web</code> will be migrated after any kinks are
  68       worked out. There are number of features such as nightly snapshot
  69       generation and contributor documentation that needs to be written.
  70     </p>
  71     <p>
  72       We will be using <a href="http://repo.or.cz/w/htmlpurifier.git">repo.or.cz</a>
  73       as our primary remote repository; push access will be administered there,
  74       and changes will be mirrored (courtesy of a script by aeruder at #git)
  75       to a repository hosted at <a href="http://git.htmlpurifier.org">git.htmlpurifier.org</a>
  76       as well as <a href="http://github.com/ezyang/htmlpurifier/tree/master">GitHub</a>.
  77       If you want to grab a development copy, use this command:
  78     </p>
  79     <pre>git clone git://repo.or.cz/htmlpurifier.git</pre>
  80     <p>
  81       Feel free to play around, and register comments and complaints at
  82       <a href="phorum">the forum</a>.
  83     </p>
  84   </div>
  85 </div>
  86
  87 <div class="item" id="news-3.1.1-released">
  88   <h3 class="title">HTML Purifier 3.1.1 released</h3>
  89   <div class="date">Thu, 19 June 2008 17:57:00 EST</div>
  90
  91   <div class="body">
  92     <p>
  93       HTML Purifier 3.1.1 is a security and bugfix release. This release addresses
  94       two security vulnerabilities, both related to <abbr>CSS</abbr>, and one of which only
  95       applies to users using Shift_JIS as their output encoding. There is also
  96       a security improvement regarding the imagecrash attack. There is a backwards
  97       incompatible change with %URI.Munge, in which resources are no longer munged
  98       by default; please enable using %URI.MungeResources. Besides this, there
  99       are numerous improvements to <abbr>URI</abbr> munging, esp. with the addition of
 100       %URI.MungeSecretKey, as well as an experimental implementation of
 101       %HTML.SafeObject and %HTML.SafeEmbed. There are also some memory optimizations.
 102     </p>
 103     <p>
 104       As a security release, please update as quickly as possible. Care has been
 105       taken to prevent backwards-compatibiilty breakage this time (something that
 106       plagued users who tried to upgrade to 3.1.0), there is only one slight break
 107       related to a bugfix that can be easily undone with %URI.MungeResources.
 108     </p>
 109     <p>
 110       See <a href="http://htmlpurifier.org/svnroot/htmlpurifier/tags/3.1.1/NEWS">NEWS</a>
 111       for a complete changelog. There were numerous added configuration directives
 112       not mentioned above.
 113     </p>
 114     <p>
 115       Along with this release, we would like to announce full disclosure on
 116       the security vulnerability patched in 3.1.0. Please see
 117       <a href="security/2008/http-protocol-removal.html"><abbr>HTTP</abbr> Protocol Removal</a>
 118       for more information about the vulnerability affecting versions prior
 119       to 3.1.0 and 2.1.4.
 120     </p>
 121     <p>
 122       Finally, the security fixes and bug fixes were backported to our PHP4
 123       branch with the release of HTML Purifier 2.1.5. See
 124       <a href="http://htmlpurifier.org/svnroot/htmlpurifier/tags/2.1.5/NEWS">NEWS (PHP4)</a>
 125       for a complete changelog.
 126     </p>
 127   </div>
 128 </div>
 129
 130 <div class="item" id="news-2.1.4-released">
 131   <h3 class="title">HTML Purifier 2.1.4 released</h3>
 132   <div class="date">Sun, 18 May 2008 15:27:00 EST</div>
 133
 134   <div class="body">
 135     <p>
 136       This is a security and bugfix release for the HTML Purifier 2.1
 137       series, and should only be downloaded by developers stuck on
 138       <abbr>PHP</abbr> 4. <strong>Important:</strong> Please upgrade your
 139       libraries as quickly as
 140       possible. The vulnerability was discovered internally, and no known
 141       exploits have been found in the wild. This is the same vulnerability
 142       as was fixed in HTML Purifier 3.1.0.
 143     </p>
 144     <p>
 145       See <a href="http://htmlpurifier.org/svnroot/htmlpurifier/tags/2.1.4/NEWS">NEWS</a>
 146       for a complete changelog.
 147     </p>
 148   </div>
 149 </div>
 150
 151 <div class="item" id="news-3.1.0-released">
 152   <h3 class="title">HTML Purifier 3.1.0 released</h3>
 153   <div class="date">Sun, 08 May 2008 14:04:00 EST</div>
 154
 155   <div class="body">
 156     <p>
 157       HTML Purifier 3.1.0 is the first offical stable release for 3.1 series.
 158       It improves HTML Purifier's integration with <abbr>PHP</abbr> 5, mainly
 159       through the new use of autoloading.
 160       It also includes support for the !important CSS modifier,
 161       display and visibility CSS properties with %CSS.AllowTricky, marquee with
 162       %HTML.Proprietary (had you scared for a moment, hmm?), a kses() wrapper,
 163       %CSS.AllowedProperties, %HTML.ForbiddenAttributes and
 164       %HTML.ForbiddenElements and a totally revamped ConfigDoc system. Since the
 165       release candidate, there have also been a number of stability fixes such as
 166       improved URI escaping, a change in serializer ID format, and a relaxed
 167       format for %HTML.Allowed. And as always, numerous bugfixes.
 168     </p>
 169     <p>
 170       <strong>Important:</strong> HTML Purifier 3.1.0 also fixes a
 171       security vulnerability. Please upgrade your libraries as quickly as
 172       possible. The vulnerability was discovered internally, and no known
 173       exploits have been found in the wild.
 174     </p>
 175     <p>
 176       For a detailed migration guide, please see the
 177       <a href="news/2008/3.1.0-released.html">3.1.0 release page</a>. If
 178       you had been using the release candidate, you do not need to worry
 179       about this.
 180     </p>
 181   </div>
 182 </div>
 183
 184 <div class="item" id="news-3.1.0rc1-released">
 185   <h3 class="title">HTML Purifier 3.1.0 release candidate</h3>
 186   <div class="date">Tue, 22 Apr 2008 02:51:00 EST</div>
 187
 188   <div class="body">
 189     <p>
 190       I assure you, this has <em>never</em> happened before to HTML Purifier;
 191       never before have we had a release candidate. I assure you, there is
 192       something big with this release, and that's why I am painstakingly
 193       doing a release candidate before the official 3.1 series begins.
 194     </p>
 195     <p>
 196       To read more about it, please check out the
 197       <a href="news/2008/3.1.0rc1-released.html">3.1.0rc1 release candidate page</a>.
 198     </p>
 199   </div>
 200 </div>
 201
 202
 203 </div> <!-- end news-container -->
 204
 205 </div>
 206
 207 </body>
 208 </html>