Security fixes:
- Fix path traversal vulnerability in mod_http_files (CVE-2016-1231)
- Fix use of weak PRNG in generation of dialback secrets (CVE-2016-1232)
Bugs:
- Improve handling of CNAME records in DNS
- Fix traceback when deleting a user in some configurations
- MUC: restrict_room_creation could prevent users from joining rooms
- MUC: fix occasional dropping of iq stanzas sent privately between
occupants
- Fix a potential memory leak in mod_pep
Additions:
- Add http:list() command to telnet to view active HTTP services
- Simplify IPv4/v6 address selection code for outgoing s2s
- Add support for importing SCRAM hashes from ejabberd
Security
- Improve Dialback Key Generation and Validation support (XEP-0185)
- More generally, improve random number generator to avoid timing /
guessing attacks on any random value.
Database
- Use BLOB instead of TEXT on mysql in stanza storage
- Use UTF8MB4 character set in MySQL tables
- Make Riak working on Erlang R18
MAM
- Use stanza-id tags for deduplication
- Advertise MAM in disco info for account/room JID
- Improve MUC support
- Don't store resent messages
- Do not forget to include xmlns in mam prefs response (#859)
- Honor Message Processing Hints (XEP-0334)
MUC
- Add support for muc#roomconfig_presencebroadcast option
- Only filter rooms in Service Disco when more than 100 (EJAB-343)
- List in Service Disco non-empty rooms and provide Node for empty (EJAB-343)
- When user joins logged room, he must be warned (EJAB-726)
Pubsub
- Fix pubsub virtual nodetree plugin
- Use correct notification_type for last items (#827)
- PubSub plugin for online users only
- Disable use of multi-subscribe and subscription-option on standard
plugins
- Limit number of subscriptions per node and allow custom default node
configuration
- Don't force max_items_node to MAXITEMS if not defined
- Don't read pubsub options when plugin does not use them
Elixir
- Upgrade Elixir to v1.1.0
Admin
- Add plugin for passing extra erl_opts flags to deps, and use it
for hipe
- Add --enable-latest-deps to configure
- Remove "--enable-nif" flag
- New send_stanza command
- ejabberdctl: new --no-timout flag
- ejabberdctl: Don't let "reopen_log" rotate files (EJAB-1243)
- ejabberdctl: Improve escaping of arguments passed to ejabberdctl
- OpenSSL minimum required version: raised from 0.9.8 to 1.0.0
Config
- New option accept_interval in ejabberd_listener
- Webadmin console visual refresh (EJAB-1142)
- If mod_register access_from is 'none', then don't advertise IBR (#857)
- Fix handling of some options in old style configs
- Fix parsing option trusted_proxies
- Fix ipv6 configuration processing (#803)
- ejabberd_service: simplify configuration: no need for 'hosts', just
provide 'password'
Cleanup and optimisations
- Faster string_to_jid/1 implementation
- Move JID related functions from jlib.erl to jid.erl (#847)
- Remove usage of erlang's now()
- Update dependency name from p1_cache_tab to cache_tab
- Use crypto:rand_uniform instead of random:uniform
- Fix randoms.erl on R17 that don't have random:seed(integer())
- Faster and more memory efficient XML parsing.
- Faster stringprep library.
Other changes
- ejabberd_http: Cope with large POST/PUT requests
- ejabberd_http: Log debug message on receive errors
- mod_offline: Discard chat states notifications
- mod_offline: Honor store hint
- mod_http_upload: various fixes
- XEP-0198: Fix stanza counting corner case issue
- Adding WEBIRC, custom realname & ident, ISO-8859-15
- Update hebrew translation
gstreamer is not an option any longer.
version 2.10.12 (MM/DD/YY):
Windows-Specific Changes:
* Updates to dependencies:
* Cyrus SASL 2.1.26
* libxml2 2.9.2
* NSS 3.17.3 and NSPR 4.10.7
* Perl 5.20.1
* SILC 1.1.12
* Remove support for Tcl plugins
Gadu-Gadu:
* Updated internal libgadu to version 1.12.1.
This is a major feature release with a bit of bugfixes.
With this release jabberd2 joins HTTP realm with WebSocket client
connections handling built in C2S module! :-)
Changes:
* Rewrite TLS ephemeral key + cipher handling
* Recover Berkeley DB before opening it
* bcrypt support for PostgreSQL
* Option to set authreg module per realm
* AuthReg ANONYMOUS does not offer password check
* Answer to disco#info queries to user JID
* WebSocket C2S SX plugin
Note: websockets are not available, as the required http-parser module
is not (yet) in pkgsrc.
o fix a program hang upon invalid utf-8 sequences
o /set log and /window log no longer double the output
o /lastlog no longer adds trailing ^Os to log files
this also fixes an assert() in /server.
New features
- core: add completion "colors" (issue #481)
- core: start/stop search in buffer at current scroll position by default, add
key Ctrl+q to stop search and reset scroll (issue #76, issue #393)
- core: add option weechat.look.key_grab_delay to set the default delay when
grabbing a key with Alt+k
- core: add option weechat.look.confirm_upgrade (issue #463)
- core: allow Ctrl+c to exit WeeChat when the passphrase is asked on startup
(issue #452)
- core: allow pointer as list name in evaluation of hdata (issue #450)
- core: add signal "signal_sighup"
- api: add support of evaluated sub-strings and current date/time in function
string_eval_expression() and command /eval
- api: add function string_eval_path_home()
- alias: add options "add", "addcompletion" and "del" in command /alias, remove
command /unalias (issue #458)
- irc: add option irc.network.channel_encode (issue #218, issue #482)
- irc: add option irc.color.topic_current (issue #475)
- irc: evaluate content of server option "nicks"
- logger: evaluate content of option logger.file.path (issue #388)
- relay: display value of HTTP header "X-Real-IP" for websocket connections
(issue #440)
- script: rename option script.scripts.dir to script.scripts.path, evaluate
content of option (issue #388)
- xfer: evaluate content of options xfer.file.download_path and
xfer.file.upload_path (issue #388)
Bugs fixed
- core: flush stdout/stderr after sending text directly on them (fix corrupted
data sent to hook_process() callback) (issue #442)
- core: allow execution of command "/input return" on a buffer which is not
displayed in a window
- core: allow jump from current to previous buffer with default keys Alt+j, NN
(issue #466)
- core: fix crash if a file descriptor used in hook_fd() is too high (> 1024 on
Linux/BSD) (issue #465)
- core: fix display of invalid UTF-8 chars in bars
- core: fix bar item "scroll" after /buffer clear (issue #448)
- core: fix display of time in bare display when option
weechat.look.buffer_time_format is set to empty string (issue #441)
- api: add missing function infolist_search_var() in script API (issue #484)
- api: add missing function hook_completion_get_string() in script API (issue #484)
- api: fix type of value returned by functions strcasestr, utf8_prev_char,
utf8_next_char, utf8_add_offset and util_get_time_string
- api: fix type of value returned by function strcasestr
- fifo: fix send error on Cygwin when something is received in the pipe (issue #436)
- irc: fix update of lag item when the server lag changes
- irc: do not allow command /query with a channel name (issue #459)
- irc: decode/encode only text in IRC messages and not the headers (bug #29886,
issue #218, issue #451)
- irc: fix crash with commands /allchan, /allpv and /allserv if the executed
command closes buffers (issue #445)
- irc: do not open auto-joined channels buffers when option "-nojoin" is used
in command /connect (even if the option irc.look.buffer_open_before_autojoin
is on)
- irc: fix errors displayed on WHOX messages received (issue #376)
- lua: add detection of Lua 5.3
- ruby: add detection of Ruby 2.2
- xfer: fix crash if the DCC file socket number is too high (> 1024 on
Linux/BSD) (issue #465)
- xfer: fix parsing of DCC chat messages (handle "\r\n" at the end of messages)
(issue #425, issue #426)
- doc: replace PREFIX with CMAKE_INSTALL_PREFIX in cmake instructions (issue #354)
Only call CodecsUpdated() when config params have changed and the other side should be notified
Run dispose from the main thread always
Add a block-ready property to TfStream
This allows the application to block the calling of the Ready() dbus method
until some pre-condition as been accomplished. If this property is set to
TRUE during the "stream-created" signal, then Ready() will not be called
before it is unset.
Remove set-but-unused variable
Set the rtp header extension preferences before the codec prefs
The RTP header extension preferences are only taken into account when the
codec preferences are changed.
Set Farsight2's default header extensions and codecs
stream-get-codec-config signal does not have details, removing hint
Set the local RTP header extensions
Set remote RTP Header extensions
Set local Feedback Messages
Implement setting remote feedback messages
Ensure there is a stop call before a start call always
Don't free codecs borrowed from the GstMessage
Implement StartNamedTelephoneEvent
Return TRUE when messages are handled, a few were missing
Add StartSoundTelephonyEvent and StartNamedTelephonyEvent
The sound variant has an implementation since its trivial
python: Don't link to libpython
Some distributions (Debian) link libpython statically into the python
interpreter
async_method_callback_optional: also ignore NotImplemented errors (#35791)
async_method_callback_optional: use g_error_matches()
Also use early returns to make things easier to read.
Don't leak the tpcodecs if we do Supported then Update
pkgsrc changes:
- Remove obsolete and broken MESSAGE files.
- Find zlib correctly when enabled.
- Add SMF manifest.
- Update patch files and add comments where necessary.
Upstream changes:
- This release fixes a SASL Denial of Service issue
Patch provided by Marco Wessel in joyent/pkgsrc#306.
The find-prefix infrastructure was required in a pkgviews world where
packages installed from pkgsrc could have different installation
prefixes, and this was a way for a dependency prefix to be determined.
Now that pkgviews has been removed there is no longer any need for the
overhead of this infrastructure. Instead we use BUILDLINK_PREFIX.pkg
for dependencies pulled in via buildlink, or LOCALBASE/PREFIX where the
dependency is coming from pkgsrc.
Provides a reasonable performance win due to the reduction of `pkg_info
-qp` calls, some of which were redundant anyway as they were duplicating
the same information provided by BUILDLINK_PREFIX.pkg.
