[Summary view] [Print] [Text view]

   1  YOURLS Changelog
   2  ================
   3  
   4  _This file lists the main changes through all versions of YOURLS.  
   5  For a much more detailed list, simply refer to [commit messages](https://github.com/YOURLS/YOURLS/commits/master)._
   6  
   7  1.10.6
   8  ---
   9  - fixed: the version number. It's just `1.10.5`, without the `-dev`, as `1.10.5` should have been. Sorry :)
  10  
  11  
  12  1.10.5
  13  ---
  14  
  15  - fixed and improved: numerous misc security hardenings (#4111, #4122, #4119, #4139, #4141, #4145, #4147, #4142)
  16    - `md5` now phased out
  17    - extensive use of `hash_equals()` to beat time based attacks
  18    - implementation of cookie prefixes
  19    - `YOURLS_COOKIEKEY` now unpredictable when not user defined
  20    - remote title fetching restricted on a public install when shortening private IP
  21    - prevent unauthenticated file inclusion in Pages under very unlikely conditions
  22    - better support for proxies  
  23  - improved: unit tests, to handle more scenarios and make tests independent of constants, to eventually deprecate some constants (#4124)
  24  - changed: Return `HTTP 409 Conflict` instead of `400` when a duplicate long URL is rejected (#4133)
  25  
  26  
  27  1.10.4
  28  ---
  29  - fixed: Prevent [XSS](https://github.com/YOURLS/YOURLS/security/advisories/GHSA-5h77-88j3-r659) in stat pages through referrers (#4107)
  30  - added: Localization support for date and time display (#4054)
  31  - improved: Improve shunt filters (#4058)
  32  - fixed: Notice overlapping logo in admin panel (#4069)
  33  - fixed: Flag password file as user auth from environment variables (#4066)
  34  - added: Filter SQL queries (#4064)
  35  - improved: Improve debug functions and logic (#4089)
  36  - improved: Make tests debugging easier (#4104)
  37  
  38  1.10.3
  39  ---
  40  - added: testing on PHP 8.5 & 8.6 (#4036)
  41  - added: function to get reserved URLs from global variable (#3999)
  42  - added: database index on long URLs, for faster searches (#4013)
  43  - added: `$context` parameter of `yourls_get_db()` (#4020)
  44  - changed: hide referrers on public statistics page by default (#4005)
  45  - changed: set the infos cache of the keyword after a url is added/updated/deleted (#4008)
  46  - changed: fix hover-actions in tables for screen reader users (#4025)
  47  - changed: confirm link deletion with a modal dialog (#3932)
  48  - fixed: upgrade spatie/array-to-xml to address deprecation warnings in newer PHP version (#4037)
  49  - fixed: filtering for links with more than 0 clicks (#3977)
  50  - fixed: case-sensitivity in admin search (#3997)
  51  - fixed: missing or invalid reserved URL configuration causing crash (#3999)
  52  - fixed: handling of invalid charsets on remote sites (#4007)
  53  - fixed: preserve backslashes in URLs (#4000)
  54  - fixed: validate JSONP callback names (#4030)
  55  - fixed: enhance configuration template formatting (#3994)
  56  - fixed: minor cleanup (#3979, #3984, #3988)
  57  
  58  1.10.2
  59  ---
  60  - fixed: `admin/tools.php` now uses `yourls_get_nonce_life()` (#3906)
  61  - fixed: "Display 1 to 0 of 0 URLs" on admin list page (#3910)
  62  - fixed: replace deprecated `get_all_options` filter with an action (#3683)
  63  - fixed: defer loading text domain after plugins (#3679)
  64  - removed: Gandi references (#3929)
  65  
  66  1.10.1
  67  ---
  68  - fixed: sandbox exceptions when disabling plugins (#3893)
  69  - fixed: stats date calculation are now correct (#3895)
  70  - fixed: unexpected warning raised on login page
  71  - removed: unsupported installation cases with Composer
  72  
  73  1.10.0
  74  ---
  75  - added: Support PHP 8.3 & 8.4
  76  - removed: Support for PHP prior to 8.1 which is now minimal requirement
  77  - changed: Ensure all `statusCode`/`errorCode` API values are strings (#3756)
  78  - fixed: Results with 0 clicks on search (#3589)
  79  - fixed: Upgrade Aura.SQL to fix PHP 8.4 compatibility (#3852)
  80  - fixed: login page accessibility (#3660)
  81  - fixed: MySQL 8+ compatibility (#3828)
  82  - changed: Upgrade dependencies
  83  - changed: Update GeoIP DB
  84  - changed: Update certificates
  85  
  86  1.9.2
  87  ---
  88  - added: Support PHP 8.2 (#3474)
  89  - improved: Googlebot indexing now filterable for plugins, for your SEO needs (#3517)
  90  - improved: Use safe sandbox for all included files (#3478)
  91  - fixed: bookmarklets with URL containing special chars (#3527)
  92  - fixed: unwanted cookies could interfere with YOURLS (#3516)
  93  - fixed: cosmetic bugs in the admin interface (#3485, #3431, #3518)
  94  - fixed: support usernames containing brackets (#3365)
  95  - updated: third party libs and binaries
  96  
  97  1.9.1
  98  ---
  99  - fixed: error `Undefined constant "intval"` when upgrading (#3332)
 100  - fixed: warnings on PHP 8.1 (#3317)
 101  - fixed: incorrect HTTP status header with the API when shortening a duplicate (#3355)
 102  - fixed: no hyphen in random keywords (#3353)
 103  - added: required/suggested PHP extensions in composer.json (#3339)
 104  - updated: third party libs and binaries
 105  
 106  1.9
 107  ---
 108  - removed : support for PHP prior to 7.4
 109  - improved: the API plugin with more plugin functions (#3281), a sandbox and a plugin uninstall procedure (#3282)
 110  - improved: inline documentation, [online documentation](https://docs.yourls.org/) and unit tests
 111  - improved: concurrency during mass shortening (#3233)
 112  - improved: minor security fixes - sanitize step name during upgrade (#3055),
 113      nonce on the logout link (#3264), salt cookie with newer hash (#3278)
 114  - improved: Remove ozh/phpass library and use native PHP password_* functions (#3232)
 115  - added: more hooks in the admin view & search (#3265)
 116  - fixed: incorrect notice when "prefix and shorten" while not logged in (#3189)
 117  - fixed: UI sometimes not responsive after editing a URL (#3244)
 118  
 119  1.8.2
 120  ---
 121  - fixed: display SVG logo for IE 11 (#2864)
 122  - fixed (again) : DB upgrade procedure (#2933)
 123  - fixed: cosmetic issue with Docker falsely warning about unencrypted password (#3040)
 124  - improved: minor security improvements - iframes clickjacking and login nonce (#3034), potential XSS (#3041)
 125  - improved: SSL support for proxies (#3044)
 126  - improved: inline documentation and unit tests
 127  - added: more filters in admin pages (#2912), HTTP requests (#2951), to deal with user defined consts (#3048)
 128  - added: documentation for API action "version" (#2957)
 129  
 130  1.8.1
 131  ---
 132  - fixed: upgrade procedure with MySQL 8 & table names containing dashes (#2844, #2846) 
 133  - fixed: function to make public some pages on private installs (#2859)
 134  - added: `all` hook to debug YOURLS and plugins (#2860)
 135  - improved: plugin inline documentation
 136  
 137  1.8
 138  ---
 139  - fixed: support for PHP 8
 140  - removed : support for PHP prior to 7.2
 141  - improved: IDN domain, and UTF8 URLs and titles (aka Number One Issue Since Day One)
 142  - improved: timezone management
 143  - improved: YOURLS UI and logo, now in SVG
 144  - improved: several little things
 145  - fixed: several little bugs
 146  
 147  1.7.9
 148  ---
 149  - improved: compatibility of YOURLS with proxies and reversed proxies
 150  - improved: accept timestamped signature in API requests with [arbitrary hash](https://docs.yourls.org/guide/advanced/passwordless-api.html#use-other-hash-algorithms-than-md5)
 151  - improved: YOURLS pages are now located in `user/` and [documented](https://docs.yourls.org/guide/extend/pages.html)
 152  - improved: accessibility, with labels and aria tags in the main admin screen
 153  - fixed: various little things here and also there
 154  
 155  1.7.6
 156  ---
 157  - improved: due to popular demand, "Random Keywords" is now a core plugin bundled with YOURLS
 158  - fixed: JSONP parameters now match the documentation, duh
 159  - fixed: various little things here and also there
 160  
 161  1.7.5
 162  ---
 163  - fixed: long referrers or client name won't trigger errors
 164  - fixed: some little bugs
 165  
 166  1.7.4
 167  ---
 168  - fixed: type juggling vulnerability in the API
 169  - improved: several little things and several little updates
 170  - dropped: PHP <= 5.5 support
 171  
 172  1.7.3
 173  ---
 174  - improved: some little things
 175  - added: some hooks here and there to allow more pluginness
 176  - fixed: some little bugs
 177  - updated: jquery and some javascript stuff
 178  
 179  1.7.2
 180  ---
 181  - improved: stat graphs, regarding accuracy and time zones
 182  - improved: navigation in the admin interface
 183  - improved: several little things
 184  - fixed: several little bugs
 185  - updated: all third party libs
 186  - dropped: PHP 5.2 support
 187  
 188  1.7.1
 189  ---
 190  - added: compatibility with PHP 7
 191  - added: allow hooks with closures (see [Advanced Hook Syntax](https://docs.yourls.org/development/hooks.html))
 192  - improved: you can now search across all fields at once in the admin interface
 193  - improved: bookmarklets are now human readable in the PHP source, and minified on the fly
 194  - improved, still not perfect: support for URLs and page titles with encoded chars
 195  - fixed: timezone warnings
 196  - fixed: cookie mismatch preventing login when multiple YOURLS installs on subdomains of the same domain
 197  - fixed: lotsa bugs
 198  - improved: lotsa things
 199  
 200  1.7
 201  ---
 202  - added: support for PDO and MySQLi
 203  - added: social bookmarklets - share on Twitter, Facebook or Tumblr in a click
 204  - added: check api.yourls.org if a new version of YOURLS is available
 205  - added: proxy support - install YOURLS behind a firewall!
 206  - improved: security regarding SQL injections
 207  - improved: security regarding your credentials - now auto-encrypted
 208  - improved: external HTTP request handling
 209  - improved: ƒυηкƴ UTF-8 titles handling
 210  - fixed: compatibility with Apache mod_security blocking bookmarklets
 211  - fixed: lots of bugs
 212  
 213  1.6
 214  ---
 215  - added: مرحبا العالم! Hej verden! 你好世界! Kumusta mundo! Ciao mondo! Hello world! Translation API.
 216  - added: custom API actions
 217  - added: support for URLs with common protocols
 218  - fixed: search and pagination in the admin interface
 219  - updated: third party libs jQuery, ezSQL, GeoIP
 220  - improved: sanitizing and escaping functions
 221  
 222  1.5.1
 223  -----
 224  - added: full jsonp support
 225  - added: ability to use encrypted passwords in the config file
 226  - fixed: support for http://www.sho.rt/bleh and http://sho.rt/bleh
 227  - added: support for any favicon dropped in the /user directory
 228  - updated: Google Visualization API instead of deprecated Google Charts
 229  - fixed: bugs, bugs, bugs
 230  - added: hooks, hooks, hooks
 231  - improved: things, things, things
 232  
 233  1.5
 234  ---
 235  - added: plugin architecture! OMG plugins!!1!!1!
 236  - added: directory /user, config.php can be moved there
 237  - added: new "instant bookmarklets"
 238  - added: 1 click copy-to-clipboard a la bitly
 239  - change in logic: now all request are handled by PHP and don't rely on .htaccess
 240  - added: saving URL titles
 241  - added: support for prefix-n-shorten: sho.rt/http://example.com/
 242  - added: core plugin to allow hyphens in URLs
 243  - added: core sample plugin to wrap redirected URLs in a social toolbar
 244  - added: core sample plugin to show how to create administration page in plugins
 245  - added: core plugin to display a random pretty background
 246  - changed: layout now using a more consistent palette, see http://yourls.org/palette
 247  - added: anti XSS and anti CSRF measures
 248  - added: interactive map if possible in stat traffic by countries
 249  - fixed: lots of bugs
 250  
 251  1.4.3
 252  -----
 253  - fixed bug no-stats-showing-ffs due to inconsistency in DB schema
 254  - improve error reporting with API method url-stat
 255  
 256  1.4.2
 257  -----
 258  - fixed: bug in auth function
 259  - added: sample public API file
 260  - added: check in API requests for WordPress plugin when adding a new short URL
 261  - prettier sample public interface
 262  
 263  1.4.1
 264  -----
 265  - fixed: base 62 URLs (keywords with MiXeD CaSe)
 266  - new & secure auth method for API calls, with no need to use login & password combo
 267  - allow SSL enforcement for admin pages
 268  - new API method: stats for individual URL.
 269  - prevent internal redirection loops
 270  - filter and search URLs & short URLs by date
 271  
 272  1.4
 273  ---
 274  - added: an upgrader from 1.3 to 1.4
 275  - change in logic: now using a global object $ydb for everything related to DB and other globally needed stuff
 276  - change in logic: include "load-yourls.php" instead of "config.php" to start engine
 277  - change in DB schema: now storing URLs with their keyword as used in shorturl, allowing for any keyword length
 278  - change in DB schema: new table for storing various options including next_id, dropping table of the same name
 279  - change in DB schema: new table for storing hits (for stats)
 280  - improved the installer, with .htaccess file creation
 281  - layout tweak: now prettier, isn't it?
 282  - stats! OMG stats!
 283  
 284  1.3-RC1
 285  -------
 286  - added bookmarklet and tools page
 287  - improved XSS filter when adding new URL
 288  - code cleanup in admin/index.php to separate code and display
 289  - added favicon
 290  - stricter coding to prevent notices with undefined indexes
 291  - hide PHP notices & SQL errors & warnings, unless YOURLS_DEBUG constant set to true
 292  
 293  1.2
 294  ---
 295  - don't remember. A few tiny stuff for sure.
 296  
 297  1.1
 298  ---
 299  - don't remember. Some little bugs I guess.
 300  
 301  1.0.1
 302  -----
 303  - don't remember. Trivial stuff probably.
 304  
 305  1.0
 306  ---
 307  - initial release