Repository navigation
Releases
Releases · textile/php-textile
v4.1.9
- Improve support for literal IPv6 addresses in links. Supports literal IPv6 address format's square bracket syntax in regular Textile links.
- Fixed: Avoid eating single trailing angle bracket characters that is used right after link URL. Instead, render the trailing angle bracket after the link, similarly how
!,,and.symbols already worked. - Fixed: Handle trailing angle brackets that are used right after link URL the same way in restricted and unrestricted modes, rendering the angle bracket in HTML encoded format after the link. Previously in restricted mode, part of the HTML encoded character would be included in the URL and
;would be rendered after the link.
v4.1.8
- This is a security update, which fixes XSS vulnerability in notextile tag handling.
- Fixed: In restricted mode, escape quotes used within notextile blocks (fixes GHSA-vm23-93g8-64vv).
v4.1.7
- Use tempered greedy token regular expression pattern for line-break conversion post-processing pass, to improve parsing performance when the parser is given a document with a deeply nested raw HTML paragraph structure (fixes GHSA-xv54-7vfx-96j8).
v4.1.6
- Improved support for BCP 47 language tags. Reduces language code restrictions, allowing the use of three letter language codes, and languages with multiple RFC 5646 sub-tags (closes #233).
v4.1.5
- This is a security update, which fixes stored XSS vulnerability in cite tag's cite attribute handling.
- Fixed: Escape any HTML special characters used in cite tag's cite attribute (fixes GHSA-8c32-52rh-j928).
v4.1.4
- Fix PHP 8.5 compatibility issues with note list rendering.
v4.1.3
- This is a security update, which fixes stored XSS vulnerability in image link handing.
- Fixed: In restricted mode, restrict image link protocol. Previously and an image link's href allowed all protocols in restricted mode. Now it goes through the same validation as text links (fixes GHSA-95m2-chm4-mq7m).
v4.1.2
- Fix PHP 8.4 compatibility issues (closes #227).
v4.1.1
- Links are now rendered when block tags are disabled (closes #225).