Add mention of Martin Brampton's book.
[htmlpurifier-web.git] / news.xhtml
blobcf6fb710ff2f499a04ddecff8057884922b3d3bb
1 <?xml version="1.0" encoding="UTF-8"?>
2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
3 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4 <html xmlns="http://www.w3.org/1999/xhtml"
5 xmlns:xi="http://www.w3.org/2001/XInclude"
6 xmlns:xc="urn:xhtml-compiler"
7 xmlns:rss="urn:xhtml-compiler:RSSGenerator"
8 xml:lang="en">
9 <head>
10 <title>News - HTML Purifier</title>
11 <xi:include href="common-meta.xml" xpointer="xpointer(/*/node())" />
12 <meta name="description"
13 content="Recent news related to HTML Purifier." />
14 <meta name="keywords"
15 content="HTMLPurifier, HTML Purifier, HTML, filter, filtering, standards, compliant, w3c, news, blog, releases, rss" />
16 <link rel="alternate" type="application/rss+xml"
17 title="News - HTML Purifier" href="news.rss"
18 rss:for="news-container"
19 rss:description="Recent news and updates on HTML Purifier" />
20 </head>
21 <body>
23 <xi:include href="common-header.xml" xpointer="xpointer(/*/node())" />
24 <h1 id="title">News</h1>
26 <div id="content">
28 <xi:include href="download-box.xml" xpointer="xpointer(/*/node())" />
30 <div id="news-container" class="news">
32 <div class="item" id="git">
33 <h3 class="title">Switching to Git</h3>
34 <div class="date">Mon, 23 June 2008 22:42:00 EST</div>
36 <div class="body">
37 <p>
38 After several weeks of testing, HTML Purifier is proud to announce that
39 it will be switching to Git as its source control management system.
40 Git offers a number of advantages over Subversion:
41 </p>
42 <ul>
43 <li>
44 <em>Superior support for branchy development.</em> Subversion 1.5 introduces
45 merge-tracking which somewhat diminishes this benefit, but implementing
46 that is entirely at the whimsy of Dreamhost, which I am not going to
47 bother with.
48 </li>
49 <li>
50 <em>Increased possibility for user participation.</em> Git makes it extremely
51 easy to do local development and submit patches.
52 </li>
53 <li>
54 <em>Data redundancy.</em> Every user has a complete copy of HTML Purifier's
55 history, making it extremely difficult to lose data. This is opposed
56 to our current setup, where htmlpurifier.org is a central point of failure,
57 and backups are sent to only one other machine.
58 </li>
59 <li>
60 <em>Performance.</em> Git is fast, both in terms of disk operations
61 and network operations. Gone are the days of waiting several minutes
62 for Subversion to finish committing.
63 </li>
64 </ul>
65 <p>
66 Currently, only <code>htmlpurifier</code> has been migrated to Git;
67 <code>htmlpurifier-web</code> will be migrated after any kinks are
68 worked out. There are number of features such as nightly snapshot
69 generation and contributor documentation that needs to be written.
70 </p>
71 <p>
72 We will be using <a href="http://repo.or.cz/w/htmlpurifier.git">repo.or.cz</a>
73 as our primary remote repository; push access will be administered there,
74 and changes will be mirrored (courtesy of a script by aeruder at #git)
75 to a repository hosted at <a href="http://git.htmlpurifier.org">git.htmlpurifier.org</a>
76 as well as <a href="http://github.com/ezyang/htmlpurifier/tree/master">GitHub</a>.
77 If you want to grab a development copy, use this command:
78 </p>
79 <pre>git clone git://repo.or.cz/htmlpurifier.git</pre>
80 <p>
81 Feel free to play around, and register comments and complaints at
82 <a href="phorum">the forum</a>.
83 </p>
84 </div>
85 </div>
87 <div class="item" id="news-3.1.1-released">
88 <h3 class="title">HTML Purifier 3.1.1 released</h3>
89 <div class="date">Thu, 19 June 2008 17:57:00 EST</div>
91 <div class="body">
92 <p>
93 HTML Purifier 3.1.1 is a security and bugfix release. This release addresses
94 two security vulnerabilities, both related to <abbr>CSS</abbr>, and one of which only
95 applies to users using Shift_JIS as their output encoding. There is also
96 a security improvement regarding the imagecrash attack. There is a backwards
97 incompatible change with %URI.Munge, in which resources are no longer munged
98 by default; please enable using %URI.MungeResources. Besides this, there
99 are numerous improvements to <abbr>URI</abbr> munging, esp. with the addition of
100 %URI.MungeSecretKey, as well as an experimental implementation of
101 %HTML.SafeObject and %HTML.SafeEmbed. There are also some memory optimizations.
102 </p>
104 As a security release, please update as quickly as possible. Care has been
105 taken to prevent backwards-compatibiilty breakage this time (something that
106 plagued users who tried to upgrade to 3.1.0), there is only one slight break
107 related to a bugfix that can be easily undone with %URI.MungeResources.
108 </p>
110 See <a href="http://htmlpurifier.org/svnroot/htmlpurifier/tags/3.1.1/NEWS">NEWS</a>
111 for a complete changelog. There were numerous added configuration directives
112 not mentioned above.
113 </p>
115 Along with this release, we would like to announce full disclosure on
116 the security vulnerability patched in 3.1.0. Please see
117 <a href="security/2008/http-protocol-removal.html"><abbr>HTTP</abbr> Protocol Removal</a>
118 for more information about the vulnerability affecting versions prior
119 to 3.1.0 and 2.1.4.
120 </p>
122 Finally, the security fixes and bug fixes were backported to our PHP4
123 branch with the release of HTML Purifier 2.1.5. See
124 <a href="http://htmlpurifier.org/svnroot/htmlpurifier/tags/2.1.5/NEWS">NEWS (PHP4)</a>
125 for a complete changelog.
126 </p>
127 </div>
128 </div>
130 <div class="item" id="news-2.1.4-released">
131 <h3 class="title">HTML Purifier 2.1.4 released</h3>
132 <div class="date">Sun, 18 May 2008 15:27:00 EST</div>
134 <div class="body">
136 This is a security and bugfix release for the HTML Purifier 2.1
137 series, and should only be downloaded by developers stuck on
138 <abbr>PHP</abbr> 4. <strong>Important:</strong> Please upgrade your
139 libraries as quickly as
140 possible. The vulnerability was discovered internally, and no known
141 exploits have been found in the wild. This is the same vulnerability
142 as was fixed in HTML Purifier 3.1.0.
143 </p>
145 See <a href="http://htmlpurifier.org/svnroot/htmlpurifier/tags/2.1.4/NEWS">NEWS</a>
146 for a complete changelog.
147 </p>
148 </div>
149 </div>
151 <div class="item" id="news-3.1.0-released">
152 <h3 class="title">HTML Purifier 3.1.0 released</h3>
153 <div class="date">Sun, 08 May 2008 14:04:00 EST</div>
155 <div class="body">
157 HTML Purifier 3.1.0 is the first offical stable release for 3.1 series.
158 It improves HTML Purifier's integration with <abbr>PHP</abbr> 5, mainly
159 through the new use of autoloading.
160 It also includes support for the !important CSS modifier,
161 display and visibility CSS properties with %CSS.AllowTricky, marquee with
162 %HTML.Proprietary (had you scared for a moment, hmm?), a kses() wrapper,
163 %CSS.AllowedProperties, %HTML.ForbiddenAttributes and
164 %HTML.ForbiddenElements and a totally revamped ConfigDoc system. Since the
165 release candidate, there have also been a number of stability fixes such as
166 improved URI escaping, a change in serializer ID format, and a relaxed
167 format for %HTML.Allowed. And as always, numerous bugfixes.
168 </p>
170 <strong>Important:</strong> HTML Purifier 3.1.0 also fixes a
171 security vulnerability. Please upgrade your libraries as quickly as
172 possible. The vulnerability was discovered internally, and no known
173 exploits have been found in the wild.
174 </p>
176 For a detailed migration guide, please see the
177 <a href="news/2008/3.1.0-released.html">3.1.0 release page</a>. If
178 you had been using the release candidate, you do not need to worry
179 about this.
180 </p>
181 </div>
182 </div>
184 <div class="item" id="news-3.1.0rc1-released">
185 <h3 class="title">HTML Purifier 3.1.0 release candidate</h3>
186 <div class="date">Tue, 22 Apr 2008 02:51:00 EST</div>
188 <div class="body">
190 I assure you, this has <em>never</em> happened before to HTML Purifier;
191 never before have we had a release candidate. I assure you, there is
192 something big with this release, and that's why I am painstakingly
193 doing a release candidate before the official 3.1 series begins.
194 </p>
196 To read more about it, please check out the
197 <a href="news/2008/3.1.0rc1-released.html">3.1.0rc1 release candidate page</a>.
198 </p>
199 </div>
200 </div>
203 </div> <!-- end news-container -->
205 </div>
207 </body>
208 </html>