First release in the RefBytes store, with documentation.
Security
- Announcement bodies were shown as typed, so HTML written by a Supervisor could run script in the browser of everyone who read it, Global Administrators included. Bodies are now cleaned with HTMLPurifier when sent and again when shown, whatever the installation's "Use HTMLPurifier" setting.
- External link accepted any address, including
javascript:links. It now takes onlyhttp://andhttps://addresses, and older links of other kinds are no longer shown. - The inbox buttons (read, unread, archive, delete, mark all read, archive all), Recall and Run cleanup had no protection against cross-site requests. They now carry a token, valid for an hour.
Fixed
- Cleanup after days did nothing: there was no automatic cleanup, and Run cleanup ignored the number of days. Now, with a number of days set, messages of announcements that expired that long ago are archived or deleted automatically (checked at most hourly while the admin is in use), and Run cleanup follows the same rule. The settings are renamed Cleanup of expired announcements and Clean up after (days).
- Expiry was compared with the database server's clock while times were stored from PHP's, so on a server not set to UTC announcements expired hours early or late. Every time is now stored and compared in UTC, the expiry date is read in the installation's time zone, and dates are shown in that time zone. Upgrading converts existing expiry dates.
- The Announcements menu entry opened the list of all announcements, which Researchers, Authors and Reviewers may not see: they got Omeka's error page. It now opens the user's own inbox, with All announcements under it for the roles that may use it.
- Users refused a page (Editors on New Announcement or Recall, other roles on any announcement page) got Omeka's error page with status 500. They now get Omeka's Forbidden page (403).
- Recalled announcements still counted as unread on the bell, the dashboard and the Unread tab. They now stay under All only, and an email job that has not run yet sends nothing for them.
- The recipients were taken from the form unchecked and outside a transaction: an announcement could be sent to nobody, to unknown roles, or half-saved after an error. At least one recipient is now required, only real roles and active users are kept, and sending is all or nothing.
- Expiry dates in the past are refused.
- Email text kept HTML entities such as
&and , and ran paragraphs together. - On the New Announcement form, the role checkboxes wrapped next to the wrong labels; the sidebar now lists one role per line.
- Uninstalling now also removes each user's Receive announcement emails preference.
- Admin > Modules shows Configure next to Announcements.