ECMAScript: evaluating onclick, onsubmit etc. done in the right way.

[elinks/kon.git] / NEWS

Release info
============

You can see the complete list of recent changes, bugfixes and new features
in the http://pasky.or.cz/gitweb.cgi[gitweb interface]. See the ChangeLog
file for details.

ELinks 0.12.GIT now:
--------------------

To be released as ELinks 0.12.0.

//////////////////////////////////////////////////////////////////////
This list now contains all the important changes from ELinks 0.11.0 to
ELinks 0.12.GIT (3f93148c9b131069aa5ee8b655652da40e1a4b70) and related
bug numbers.  Each section is sorted by severity and grouped by topic.

The list no doubt includes several changes that are not really
important enough.  Please move them to the separate "should be removed
from NEWS" list below, or coalesce several changes into one entry (but
do list all bug numbers).
//////////////////////////////////////////////////////////////////////

Notable new features:

* enhancement 822: UTF-8 as terminal charset, not merely UTF-8 I/O
  of a unibyte codepage as in previous versions.  Double-cell (aka
  fullwidth) and non-BMP characters work too, but combining characters
  and right-to-left text do not.  The only multibyte charset ELinks
  can decode is still UTF-8, so if the server outputs e.g. Shift-JIS,
  you'd better recode with a proxy.  See more notes in features.conf.
* enhancement 844: SMB protocol using libsmbclient.  This replaces
  the smbclient-based code that was disabled in ELinks 0.11.2.

Incompatibilities:

* ECMAScript support is now disabled by default.  It has known
  bugs 548 and 771 with which malicious web pages can hang ELinks,
  and its security goals are undocumented.  If you must enable
  ECMAScript support, it would be prudent to restrict the ELinks
  process with a sandbox of some kind.
* bugs 871, 752: The numbering of terminal.*.colors no longer depends
  on config options.  This change makes elinks.conf portable between
  different configurations but unfortunately not between this and
  previous versions.
* Changed Python goto_url_hook(current) to goto_url_hook(new).  The
  hook can call the new function elinks.current_url() if desired.
  The Python scripting back-end is much more featureful than in
  previous releases, but it is still considered experimental.
* Guile scripting reads hooks.scm rather than internal-hooks.scm.
  (It still reads user-hooks.scm, too.)

Miscellaneous:

* critical bug 756: ``assertion (cached)->object.refcount >= 0 failed''
  after HTTP proxy was changed
* tabs opened by -remote now go behind existing dialogs
* Debian bug 257762: turn terminal transparency off by default
* bug 724: better parsing of escape sequences and control
  sequences from the terminal
* bug 948: fix wrong UTF-8 output after the charset menu was used
* gzip_read: always call gzclearerr
* bug 816: convert entity references in input/@value only once
* bug 916: if a mailcap entry has no %s, provide the file as stdin
* bug 355: add documents displayed via ``What to do'' dialog to the
  global history
* encode and decode filenames in FSP URLs
* don't use a busy cache entry if it has expired or should be
  reloaded.  See elinks-users mail from 28 Oct 2005.
* several accesskey fixes
* in Lua: don't write to the string returned by lua_tostring
* minor bug 284: render closing bracket for HTML element SUB in the
  same line; don't let it fall to the next
* minor bug 461: ensure contrast in blank areas, to keep the cursor visible
* minor: show quote characters for HTML element Q, rather than italics
* minor bug 951 in user SMJS: garbage-collect SMJS objects on 'File ->
  Flush all caches' to work around their holding cache entries busy.
* trivial bug 387: treat &#013; inside <pre>...</pre> as a newline
* trivial bug 930: refresh status bar when key prefix is eaten
* trivial bug 776: ``elinks -remote http://elinks.cz/'' no longer clears
  the screen
* enhancement 121: if a mailcap entry indicates 'copiousoutput', ELinks
  itself acts as a pager
* enhancement 790: If-Modified-Since and If-None-Match
* enhancement: HTTP negotiate-auth using GSSAPI
* enhancement 517: fixed and enabled HTTP bzip2 decompression
* enhancement: LZMA decompression
* enhancement: FSP progress indicator and password prompt
* enhancement: autocreate directories needed to download a file
* enhancement: ``Add server'' button in the cookie manager
* enhancement 887: ``Save'' in the cookie manager now saves cookies
  even if unmodified
* enhancement 145: internal clipboard support
* enhancement: new actions kill-word-back, move-backward-word,
  move-forward-word
* enhancements 687, 688: options ui.tabs.top, ui.show_menu_bar_always
* enhancement: highlight links as one enters link prefixes
* enhancement: backspace backs out the last digit of the prefix
* enhancement: in text type-ahead searching, don't follow current link
  on enter
* enhancement: add support for parsing space separated CSS class
  attribute values
* enhancement: mouse wheel support over GPM (contrib/gpm-wheel.patch),
  and on BSD via moused -z 4
* enhancement: 24-bit truecolor mode
* enhancement 622: -dump-color-mode
* enhancement: support Ctrl+Alt+letter key combinations
* enhancement 381: reduce memory consumption of codepages and some
  other arrays
* enhancement in user SMJS: new properties/functions elinks.action,
  elinks.execute, elinks.globhist, elinks.load_uri, elinks.vs

Build system and compile-time errors (ignore if you don't build ELinks):

* bug 725: fix version checking for Ruby in 'configure'
* use $(CPPFLAGS) rather than $(AM_CFLAGS)
* update SpiderMonkey configure check Debian compatibility
* enhancement: if make -k was used and a sub-Make fails, build the
  rest before propagating
* enhancement: avoid compilation of vernum.c in 'make install'
* enhancement: make uninstall
* experimental enhancements: --with-python=DIRECTORY, --with-gc=DIRECTORY
* experimental enhancement: native Win32 port

Changes in the experimental ECMAScript support:

* disabled by default, as mentioned under ``Incompatibilities'' above
* critical bug 755: fix crashes due to dangling pointers to struct
  form_state
* enhancement: SEE ECMAScript backend, an alternative to SpiderMonkey
* enhancement: handling onsubmit
* workaround: window.open remembers the last few URLs and doesn't
  reopen them when incremental rendering reruns the onload script
* enhancement: better handling of form.action assignments
* enhancement: form[x] looks up controls also by 'id', not only 'name'
* enhancement: added document.location.href, input.selectedIndex,
  window.setTimeout, window.status

Changes in the experimental SGML/DOM implementation:

* enhancement: minimalistic RSS renderer
* enhancement: source highlighting also recognizes
  application/xhtml+xml and application/docbook+xml.  It doesn't yet
  support arbitrary XML though.
* enhancement: make it possible to use more CSS properties with the
  source highlighting
* enhancement: handle <base href=""> for HTML source rendering
* enhancement: add support for scanning comment endings such as
  '--!>' correctly
* enhancement: incremental parsing
* and more.

//////////////////////////////////////////////////////////////////////
The following changes should be removed from NEWS before ELinks 0.12.0
is released.  They are currently listed here just to show that they
have already been considered.

* Not clear whether the bugs have been fixed:
  - (bugfix 674) Reproduceable crashes while trying to unsubscribe
    from a community on Orkut
  - (bugfix 770) Download resuming simply restarts the download
* Only partially fixed bugs:
  - (bugfix 764) int/long type punning in options
  - (bugfix 890) Change colors 0-15 to match xterm defaults.
    The bug report also requests asking xterm to report its palette,
    but that part will be delayed to 0.13 or later.
  - (bugfix 784) attributes corrupt character entity references if
    terminal charset != document charset
* Fixed bugs that were not in previous versions:
  - (bugfix) Fix a crash when adding a server in the cookie manager.
  - (bugfix) cookies: "Add Server" ignores "cookies.accept_policy".
  - (bugfix) Fix data: protocol.
  - (bugfix 747) Properly deselect the main menu instead of crashing
  - (bugfix 778) ELinks crashes on binary files when
    document.plain.display_links is set
  - (bugfix 782) UTF-8 buffer overwritten while in use
  - (bugfix) switch_to_tab: Prevent "tab number out of range"
    assertion failure.
  - (bugfix) Fixed about:
  - (bugfix 821) I cannot enter national characters in dialog boxes
  - (bugfix 834) Gzip decompression doesn't work
  - (bugfix) Fix out-of-bound access to the quote_char buffer
  - (bugfix 827) Crash with term charset set to Unicode and UTF-8 I/O
    disabled
  - (bugfix 826) too small table for double-cell characters
  - (bugfix 902) crash: "overflow detected realloc()" in realloc_line
  - (bugfix 912) wrong color in one cell of an HTML input field
  - (bugfix 835) Text in textarea is unaffected by horizontal
    scrolling of document in UTF-8 mode
  - (bugfix 823) Big textarea is too slow with CONFIG_UTF8
  - (bugfix 754) Pressing ESC do not pop up main menu anymore.
  - (bugfix 794) tab-close-all-but-current crashes
  - (bugfix 781) document->buf can overflow with UTF-8 enabled
  - (bugfix 882) C1 controls pass through to the terminal if written
    as entity references
  - (bugfix 935) Yes and No buttons override the bottom border of the
    dialog.
  - (bugfix in SEE) Use frame->name instead of target avoiding
    possible segfault.
* Already backported to a previous release but not listed there:
  - (enhancement) Activate link only when onClick returns true.
    Fixed bug 786 in ELinks 0.11.2.
  - when the configure script cleans old object files, this no longer
    causes it to loop.  Commit 564b67883b189a05839bcd2a30d8d4c6eb89c66d
    in ELinks 0.11.1.
  - don't include <sys/param.h> for MIN and MAX because it may interfere with
    CONFIG_IPV6 on Linux.  Commit 63797ae9b331efd91be27512bd9d5b2e2ff74741
    in ELinks 0.11.1.
  - Debian bug 400871: include <sys/types.h> for off_t.  (Bug 936 was
    reported for GIT (HEAD) after the change and may still exist.)
    Commit 135a79a3c309af36cf963f1d3c34b07f296fa2f7 in ELinks 0.11.3.
  - bug 107: recognize "localhost" in file: URIs.  Cannot reproduce in
    earlier versions.
  - fix compilation under gcc 4.x. Backported from gentoo portage.
    Commit bcabd8b7951f3319199811088e607501296ee573 in ELinks 0.11.3.
* Reverted changes:
  - (new feature) document.write, reverted in
    2c087e52e74528a720621186b91880463e039d50
  - (enhancement) restore Linux console mode (UTF-8 or not), reverted
    in 10d72cae7eafa6b90db1c8f303deb200555734c2
  - (enhancement) wcwidth, reverted in
    d050cb67aa37390ab938b0a308c7541f19578506
  - (new feature) Let plain text change colors with ESC [ 31 m or
    similar control sequences, reverted in
    2a6125e3d0407b588eb286d4d0ff5c98c23ebda9
  - (enhancement) Support for pasting from GNU screen clipboard,
    reverted in 763f03f146cc1391b303c8074556f0ddea1e3c7a
* Unimportant changes: 
  - (enhancement) If select fails, save its errno.
  - (bugfix) Use PF_* instead of AF_* as first parameter of socket(2).
    (commits 8b7657deaf6037736d0abe88bae1865fec55fe93 in 0.12.GIT
    and d9b56bad7d528a87376768572c2601c57d8afb02 in 0.11.0.GIT)
  - (bugfix) Better error handling in save_form_data_to_file and
    save_textarea_file.
    (commit 6bdc34cfbcade0c25922c1ad96c753cc7d1c9949 and nearby)
  - (bugfix) Do not call toupper with potentially out-of-range values.
    (commit 9e30ee631ced843f26a264c351cfa1716e7e1941)
  - (bugfix) If ELinks logs debug information to a file, it now opens
    that in binary mode.  (commit 4ced25779dca68c0e15ce1e695ce191b536bb05d)
  - (bugfix) Kill the ESC timer when blocking the terminal.
    (commit 539f756438fca4264ab937b2ccfba2351e916a16)
  - (bugfix) Don't claim that the authentication is for HTTP.
    (commit ef2f6383c6f0bed576e6f69030eacc4931b42a27)
  - (enhancement) Reject invalid UTF-8 input from documents and
    terminals
  - (bugfix) Decode UTF-8 only from bytes, not from codes of special
    keys.
  - (enhancement) "Resize terminal" tries to use the window size
    increment.
  - (bugfix) Subprocess forked for SIGTSTP calls _exit, not exit.
  - (enhancement) Tell the user how to move bookmarks.
  - (enhancement) Localization updates.  For this to be important, we
    should at least list the languages.
  - (enhancement) Ctrl+characters don't trigger hotkeys in menus and
    dialogs.
  - (bitrot) Fix two warnings on Mac OS X.
  - (enhancement) reduce warnings on gcc 4.2 snapshots
  * don't use cmp -b, which FreeBSD doesn't support.  This is commit
    7a5f699a88c5fc89c510854b04702c16c30ece5a in src/dom/test/ which
    is run only by "make test" rather than "make".
  * support much longer locale-specific timestamps when formatting a
    directory listing.  LC_TIME=fi_FI.UTF-8 now works.  Let's treat
    this as part of the UTF-8 support.
  * enhancement in user SMJS: elinks.alert no longer displays as an
    "error"
//////////////////////////////////////////////////////////////////////

ELinks 0.11.3.GIT now:
----------------------

To be released as 0.11.4.

* critical bug 945: don't crash if a Lua script calls e.g. error(nil)
* CVE-2007-2027: check if the program path contains "src/" before
  using ../po files
* important Debian bug 380347: prevent a buffer overflow in entity_cache
  and a possible subsequent crash
* bug 691: don't look up bogus IPv4 addresses based on characters of a
  hostname
* bug 712: GnuTLS works on https://www-s.uiuc.edu/[]
* bug 788: don't read STRLEN n_a, which isn't initialized by POPpx of
  Perl v5.8.8 and later
* bug 928: properly display no-break spaces in a UTF-8 document if the
  terminal uses some other charset
* bug 947: document.html.wrap_nbsp also affects text in tables
* fix passive FTP over IPv6 when connect() fails with EINPROGRESS
* minor bug 396: never show empty filename in the what-to-do dialog
* build bug 950: fix ``config/install-sh: No such file or directory''
  on SunOS

ELinks 0.11.3:
--------------

Released on 2007-04-15.

* critical bugs 846, 870: fix crashes in web ECMAScripts and SMJS user
  scripting
* critical bug 927: fix null pointer crash if META Refresh is in a
  table cell
* critical bug 941: fix assertion failure or memory corruption if FTP
  server responds to PASV with status 200
* critical bug 729 in experimental BitTorrent: fix crashes with
  various bogus BitTorrent URLs
* critical bug 868: fix segfault in check_timers
* critical bugs 897, 919: fix crashes on operating systems lacking
  mremap()
* critical: fix null pointer crash if XBEL bookmark has no title
* critical bug 760: fix crash when moving bookmarks out of a folder
* critical: fix crash in an empty file-extensions menu
* critical bug 715: fix null pointer crash caused by malformed proxy
  setting
* critical: fix SMJS null pointer crash on exit
* critical bug 880 in experimental Python scripting: fix null pointer
  crash with -no-home
* major Gentoo bug 121247: fix segfaults in Ruby user scripting
* major bug 908: don't write to freed memory when the user pushes a
  radio button
* major bug 937: don't send the entire HTTPS request to a CONNECT
  proxy
* bug 899, Debian bug 403139: recognize >2GB files in FTP directory
  listing, if off_t is large enough
* bug 942: encode/decode file names in FTP URLs, so they can contain
  spaces
* bug 741: don't recognize HTML comments inside STYLE elements
* bug 769: fix MD5 computation/formatting in HTTP digest
  authentication
* fix POST to local CGI
* remove a garbage character from the end of the authentication prompt
* bugs 872, 886: editing or deleting cookies in the cookie manager
  should cause a save
* secure file saving: restore umask after *all* failure conditions
* decode the fragment identifier extracted from the URI when looking
  it up
* bug 768 in experimental Python scripting: link with e.g. -lpython2.4
  rather than -lpython
* minor bugs 830, 831: changes in parsing of -remote arguments
* minor Debian bug 313696 and other translation updates
* enhancement 24: fix searching past unselectable elements in menus
* enhancement: recognize function keys and backspace/delete on FreeBSD
* enhancement 772: recognize Shift-Tab on XTerm
* enhancement: place cursor on listbox rather than button, to help
  screen readers
* enhancements in text wrapping
* enhancement 767: recognize URL in META Refresh even without "URL="
* enhancement 396: search for "<html>" if the server doesn't specify a
  Content-Type

ELinks 0.11.2:
--------------

Released on 2006-11-19.

* critical bug 841, CVE-2006-5925: prevent enabling the SMB protocol
* critical bug 786: fix crash when following a link in frames
* print off_t with custom OFF_T_FORMAT instead of PRId64
* build: Minix3 compatibility

ELinks 0.11.1:
--------------

Released on 2006-01-29.

* work around null pointer crashes in HTTP digest authentication
* fix assertion failure with document.plain.display_links and
  uppercase URIs
* fix Gopher crashes
* enhancement 630: native FSP protocol support (replaces CGI program
  in contrib/cgi/)
* SMJS user scripting: check for hooks.js before trying to load it
* SMJS user scripting: the elinks.preformat_html hook gets a second
  argument: a view_state object with .uri and .plain properties
* bug 921 in Lua scripting: fix current_document_formatted
* if given "a?b" in the command line, try to guess whether the
  question mark is part of the file name or indicates a query part
* updated character entity list from unicode.org
* build: use asciidoc -unsafe for AsciiDoc 7.0.4 compatibility
* build bug 738: fix "/config.charset" error triggered by building in
  the source directory

ELinks 0.11.0 (Elated):
-----------------------

Released on 2006-01-01.

* SSL support via GNUTLS now requires 1.2 or higher
* support for Lua 4.x was dropped, we only support Lua 5.x now
* Python scripting back-end (experimental)
* Spidermonkey based ECMAScript scripting back-end (experimental)
* 88 colors support
* default URI-rewrite rule, used when no other rules match but the string that
  was entered in the Go to URL box does not resemble a URI
* support prefixes for add-bookmark-link, document-info, goto-url-current-link,
  history-move-back, and history-move-forward
* BitTorrent protocol (experimental)
* FSP protocol via a CGI script (see contrib/cgi/README.FSP) (experimental)
* enhancement 694: sysmouse support on the BSD console
* new GNU make based build system (aclocal from automake is still required)
* move from CVS to GIT

ELinks 0.10.6:
--------------

Released on 2005-09-15.

* external editor is configurable at run-time

ELinks 0.10.4:
--------------

Released on 2005-04-06.

* explicit keyboard accelerators were defined for buttons in dialogue boxes and
  are now highlighted

ELinks 0.10.2:
--------------

Released on 2005-01-30.

* Ruby scripting back-end (experimental)
* Debian package files (apt-get install devscripts && debuild -uc -us)

ELinks 0.10.0 (Thelma):
-----------------------

Released on 2004-12-24.

* simple CSS
* simple JavaScript/ECMAScript support by the SpiderMonkey Mozilla JS engine
* plain-text mark-up (_^Hx to underline, x^Hx to embolden)
* HTML source high-lighting using DOM implementation
* multiple URIs on the command line
* tabs moving (press Alt-'>' or Alt-'<')
* periodic snapshotting of all tabs in all terminals
* exmode CLI support (press ':' followed by action and args) (experimental)
* cursor routing (aka w3m-style navigation)
* modal text-input form-fields editing (enabled by default)
* manual cookies creating and editing
* incremental searching (press '#/')
* Perl scripting back-end (experimental)
* build-time configurability and feature documentation through features.conf
* Mozilla-compatible -remote option (http://www.mozilla.org/unix/remote.html[])
* support for specifying IP family as protocol postfix (e.g. http4 or ftp6)
* internationalized domain names via libidn (RFC 3490)
* data URI protocol (RFC 2397)
* gopher protocol (RFC 1436)
* NNTP protocol (RFC 977 and RFC 2980) (experimental)
* build system fine-tuned to use automake conditionals
* -localhost option to block connections to remote hosts
* -verbose option to control messages printed at startup
* -default-keys command line option to ignore user-defined keybindings
* -confdir option renamed to -config-dir
* -conffile option renamed to -config-file
* enhanced documentation

ELinks 0.9.2:
-------------

Released on 2004-09-24.

* directional links navigation
* 'unset' configuration directive, which can be used, e.g., to delete default
  MIME type settings or external protocol handlers.

ELinks 0.9.1:
-------------

Released on 2004-01-23.

* support <object> tags by displaying a link to the data
* add beginning-of-buffer and end-of-buffer actions for text fields
* automatic session saving/restoring support (disabled by default)
* add-bookmark-tabs (bookmark all tabs) option and menu item
* fold successive blank lines when displaying a plain-text document
  (disabled by default; use the option document.plain.compress_empty_lines)
* 'fresh' color for any tab that has not been selected
  since its document was loaded

ELinks 0.9.0 (Skyrider):
------------------------

Released on 2003-12-24.

* used gettext for internationalization
* support for background document colors
* tabs support
* new MIME subsystem adding mimetypes files support
* local CGI support
* Guile scripting extensions
* HTML meta refresh
* forms history
* 256 colors support
* regex searches
* cookies manager, cache manager and download manager
* document marks support
* displaying URIs in plain documents as links
* SMB protocol support (requires smbclient)
* builtin user prefixes support (enter 'gg' or 'gg:elinks' to the goto dialog)
* HTTPS proxy support
* typeahead link searching (press '#')

ELinks 0.4.0 (Iceberg):
-----------------------

Released on 2002-12-24.

* merged HTTP_AUTH
* basic proxy auth support
* cookies parser rewritten
* support for tabindex,accesskey,title attribute
* FTP support dramatically improved: bugfixes, interoperability fixes, passive
  mode support, ...
* global history support (+vlink support)
* make some modules (cookies,bookmarks,globhist,..) optional at compile time
* secure saving support (see secure_save option desc. if you're doing weird
  things with your links files like symlinking or nonstandart permissions!!!)
* support for utf8 i/o
* mouse wheel support
* portability enhancements
* performance enhancements
* file/http gzip/bzip2 decompression support
* downloads resuming support
* mailcap support
* hierarchic bookmarks support, XBEL bookmarks support
* source layout was dramatically reorganized
* relocated ELinks configuration files, changed format (if you are upgrading
  from Links or older ELinks version, read INSTALL file to see how to convert
  your old config files!!!)
* options are now in tree hierarchy and are configurable generically
* keybindings can be configured from the user interface
* colorful user interface
* tiny useless LED-like indicators support
* GNUTLS support parallel to the OpenSSL support (fixes some license issues)
* extensive memory debugging support

ELinks 0.3.0:
-------------

Released on 2002-03-02.

* unhistory
* external textarea editor
* DNS rewrite - we handle multi RR per host correctly
* IPv6 support
* rewritten options handling
* bookmarks filtering (aka bookmarks search)
* bookmarks resaving (save on the disk after every change)
* added possibility to change default colors settings

Links 0.96-pb3:
---------------

Released on 2001-10-26.

* secured cookies file creation
* support for title attribute of img tag
* Catalan translation
* Romanian translation
* changing of User-Agent string sent to webserver
* <listing> tag support

Links 0.96-pb2:
---------------

Released on 2001-10-06.

* cookies expiration, saving and resaving
* do NOT strip everything after ? in form action
* http referrer, true http referrer
* limited textarea external editor support
* partial fix of &#13;
* enhanced manual page
* fixed multi-level HTTP moved when using -dump/-source
* fixed keybindings