HedgeDoc 1.11.1

Security fixes

• GHSA-93w7-49m2-cqwg reports possible corruption of permission values due to missing validation. This should not impact permission checks, except when the note owner intentionally set their note permission to something invalid.

Enhancements

• Added external link warning setting (externalLinkWarning in config.json or CMD_EXTERNAL_LINK_WARNING) to disable the external link warning page entirely
• Added external link whitelist setting (externalLinkWhitelist in config.json or CMD_EXTERNAL_LINK_WHITELIST) to skip warning page for certain domains
• Added support for webp file uploads (for all backends except imgur, since that does not support these)

Bugfixes

• Fixed external link warning for subpath instances
• Restore native browser zoom-in keyboard shortcuts in the editor
• Nested list items render properly again in the preview pane for slides

Refactoring / Clean-up

• Removed the old Temp database object and related API endpoints. This was used by a very old way of migrating the history and is no longer needed.
• Removed unused allowOrigin (environment variable CMD_ALLOW_ORIGIN) config option.
• Removed unnecessary/duplicate entries in the XSS filtering whitelist

Contributors

• Shivam Shukla
• Tobi