The Discord bot moves to version 0.2.2: the forum messages it relays lose all their HTML tags, even nested ones (see its own changelog). Version 0.2.1 keeps working.
Fixed
- The marketplace window also offers the widgets that no module provides (About, Game server, Feed reader, Seasonal effect, Steam group, TeamSpeak 3 server, Live status): it only showed modules and themes, and these seven widgets could only be installed through "Add", with the archive in hand. A widget already provided by a module (the Forum's, for example) does not appear there twice.
- The administration guide names the button that saves a new site address by its label,
Use, followed by the address — and no longer by a fake
https://…address that a reader mistook for a link.
Security
- The repository's verification workflows only receive a read-only token (
permissions: contents: read): they have nothing to write, so a compromised step could not change anything. Flagged by GitHub's code analysis when the repositories were opened to the public. - The Video widget only accepts, for an item in its playlist, an
http(s)address or a site path: ajavascript:ordata:address is ignored on click. The player did not execute anything, but such an address had no business being there. Flagged by the same analysis.
Added
- Three more tests in the
installation.ymlworkflow:check-extensionsinstalls each of the addons in the published marketplace on a site that has only the core, through the marketplace window, and through "Add" whatever it does not offer;check-prerequis-absentsremoves each required PHP extension in turn, and checks that the wizard and the command-line installer say which one is missing; the published package is installed through the wizard on a simulated shared host (Apache without functions that launch a program,open_basedir, 128 MB). And the links in all documents are checked (lychee).