This is a quality-focussed release for the 1.24.xseries meant to provide a good product to people blocked on PHP 7.4, while we will increase the requirements to PHP 8.1+ from the next 1.25.x series.
A few highlights ✨:
New global option to automatically add articles to favourites
New option to share articles from the article title line
Add core extensions, shipped by default: UserCSS and UserJS
Security: Force log out of users when they are disabled
BookStack v24.05.1 has been released.
This is a security release that adds extra rate-limiting to some forms that are accessible without authentication, while also implementing changes to prevent methods that could be used to indicate if specific user emails exist in the system.
Upgrade is advised for instances accessible on the public web.
Full List of Changes
Updated PHP dependencies.
Updated routes with IP-based rate limiting. (#4993)
Updated email confirmation flow to not require email submission form.
Updated translations with latest Crowdin changes. (#4994)
Updated WYSIWYG alignment handling to also consider table align attributes. (#5011)
Fixed attachment upload validation errors appearing as JSON. (#4996)
Fixed incorrect notification preferences URL in email. Thanks to @KiDxS. (#5008, #5005)
Fixed non-visible MFA setup titles in dark mode. (#5018)
Fixed outdated path in visual theme system guidance. (#4998)
Fixed potential cache permission issues by reverting cache location. (#4999)
PHP Version Requirement Change - The minimum supported PHP version has changed from PHP 8.0.2 to PHP 8.1 in this release. Please see our "Updating PHP & Composer" documentation page for guidance on updating PHP.
Composer Version Requirement Change - The minimum supported composer version has changed from v2.0 to v2.2 in this release. Please see our "Updating PHP & Composer" documentation page for guidance on updating Composer.
Page Content - Text links in page content will now be underlined by default for accessibility. Refer to the release blogpost for an simple customization to override & revert this if desired.
PDF Exports - The WKHTMLTOPDF option is now considered deprecated, with the alternative being the newly added EXPORT_PDF_COMMAND which is detailed in our documentation here. The WKHTMLTOPDF option will though remain supported for a number of feature releases though to avoid unexpected breaking changes.
OIDC Authentication - The OIDC "userinfo" endpoint may now be called in very rare scenarios where not all expected claims were being properly provided in the user ID Token, which could alter the details used for new users on access, and the groups obtained for user group/role sync, but only in edge case scenarios where functionality was not matching configuration before the update.
LDAP Authentication - The LDAP_USER_FILTER BookStack option now uses {user} as a placeholder instead of ${user} by default. The older ${user} placeholder format is still supported but you may want to use the new format instead. This should not cause any issues on existing instances, unless {user} was used as a literal part of your user filter which would be very unlikely.
Full List of Changes
Added new command-based PDF export option. (#4969, #4732)
Security - The v23.12 branch of BookStack recently had a security release, which you can find details of in our v23.12.3 blogpost.
Comments - The ability to use markdown content in comments has been removed in this release, replaced by a WYSIWYG editor. Markdown in comments was a fairly hidden feature though so was not commonly utilised. Existing markdown comments will remain although formatting may be lost if old markdown comments are edited.
Commands - The "Regenerate Comment Content" command has been removed in this release since this action is now redundant.
OIDC Authentication - Proof Key for Code Exchange (PKCE) support has been added to BookStack OIDC authentication. This should not affect existing OIDC use but you may want to enforce PKCE to be required for BookStack on your authentication system, if supported, for extra security.
BookStack v23.12.3 has been released.
This is a security release that addresses a vulnerability in PDF generation that could be exploited to perform blind server-side-request forgery.
Upgrade is advised where untrusted users have permission to create/edit/update page content in your instance.
Full List of Changes
Updated PHP dependencies, primarily to update php-svg-lib package.
In this release, besides adding some initial support for OpenID Connect, the focus has been on increasing the quality rather than adding new features (which will have more focus again in the next release).
This version 1.22.x is also the last to support PHP 7.2 before requiring PHP 7.4+.
Log in
