BookStack Code Mirror - website/blob - content/blog/2023/bookstack-release-v23-08.md

   1 +++
   2 categories = ["Releases"]
   3 tags = ["Releases"]
   4 title = "BookStack Release v23.08"
   5 date = 2023-08-29T12:00:00Z
   6 author = "Dan Brown"
   7 image = "/images/blog-cover-images/deer_dan_brown.jpg"
   8 slug = "bookstack-release-v23-08"
   9 draft = false
  10 +++
  11
  12 The August release of BookStack is now here! This is focused upon an initial implementation of
  13 a notification system for content, but as usual there are a few other improvements to enjoy.
  14
  15 * [Update instructions](/docs/admin/updates)
  16 * [GitHub release page](https://github.com/BookStackApp/BookStack/releases/tag/v23.08)
  17
  18
  19 **Upgrade Notices**
  20
  21 - **Security - Webhooks** - In scenarios where admins users are not trusted, webhooks could potentially be used maliciously. This update adds a control for such functionality. Please read [our documentation for the new `ALLOWED_SSR_HOSTS` option](/docs/admin/security/#server-side-request-allow-list) if this may be a concern for your instance.
  22
  23 Note that [v23.06.1](/docs/admin/updates/#updating-to-v23061-or-higher) and [v23.06.2](/docs/admin/updates/#updating-to-v23062-or-higher) also had version specific upgrade notices that should be considered
  24 if not already read and/or upgraded to those.
  25
  26 TODO - Video:
  27 <!-- {{<pt 69eAVo8iNHPYs4n4UTT3Nb>}} -->
  28
  29 ### Content Notification System
  30
  31 TODO
  32
  33 ### Drawing Save Safety Net
  34
  35 TODO
  36
  37 ### API - Set Page/Chapter Ordering in Books
  38
  39 The sort ordering of pages and chapters within a book can now be managed
  40 via the API. This functionality comes through the addition of a new `priority` parameter
  41 available on create & update requests for pages & chapters. As an example:
  42
  43 ```http
  44 PUT https://bookstack.example.com/api/chapters/15
  45 Content-Type: application/json
  46 Authorization: Token {{token_id}}:{{token_secret}}
  47
  48 {
  49   "priority": 22
  50 }
  51 ```
  52
  53 Items within a book or chapter are shown from lowest priority number to largest.
  54
  55 Thanks to [@rouet on GitHub](https://github.com/BookStackApp/BookStack/pull/4313) for providing
  56 the pull request to add this functionality.
  57
  58 ### Server Side Request Allow List
  59
  60 As mentioned in the upgrade notices, is was reported that webhooks could be used maliciously as a server-side-request
  61 means to potentially hit unexpected or private endpoints from the BookStack instance system.
  62 This is usually not a concern, but there could be scenarios where an instance is hosted for admins that are untrusted, within a usually private environment.
  63
  64 To help with such cases, a new `ALLOWED_SSR_HOSTS` option has been added as a form of allow-list for use in functionality like webhooks:
  65
  66 ```bash
  67 ALLOWED_SSR_HOSTS="https://*.example.com https://example.org/bookstack/"
  68 ```
  69
  70 This defaults to `ALLOWED_SSR_HOSTS="*"` to allow all hosts by default, to prevent breaking webhooks for existing users, and since this only a mild concern in specific environments due to the permissions required and the limits of exploitation in those environments.
  71
  72 Thanks to [morioka12 on huntr.dev](https://huntr.dev/users/scgajge12) ([@scgajge12 on Twitter](https://twitter.com/scgajge12)) for reporting this vulnerability via huntr.dev.
  73
  74 For more detail on the new option, see the ["Server Side Request Allow List" section in our security docs](/docs/admin/security/#server-side-request-allow-list).
  75
  76 ### Translations
  77
  78 TODO
  79
  80 - User - *Language*
  81
  82 ### Next Steps
  83
  84 While spending time of the features of this release, I noticed some of the UI and views are becoming a
  85 little untidy, to a point where it now might be confusing to understand where certain options may exist,
  86 especially when it comes to user options and preferences.
  87 I want to spend a release cycle focused on cleaning up rough edges and existing bug reports, just to ensure
  88 the platform remains at a good level of polish and the user experience remains intuitive.
  89
  90 Looking a little further forward into the future,
  91 I've been thinking about aligning a few inputs where some formatting may be desired,
  92 but not at the level of a full-blown page editor. As an example, comments can actually accept markdown input
  93 for formatting but this is not clear nor intuitive to most users. There have also been requests for slightly more formatting
  94 in descriptions for books, chapters and shelves. Therefore I envision setting up a simplified WYSIWYG editor across these inputs.
  95 I just need to be sure we do that in a way that works with existing functionality and doesn't
  96  cause too many forward compatibility issues.
  97
  98 ### Other Updates
  99
 100 In regards to other goings on in the project over the last month,
 101 In July we reached the 8 year mark for the project. You can find
 102 a lot more about that [in my post here](/blog/8-years-of-bookstack/) where
 103 I dig into the figures and finances, and reflect on the project reach.
 104
 105 On the video side of things, I've set-up a PeerTube instance as a YouTube
 106 alternative for our video content. I wrote about this in detail in
 107 [my blogpost here](/blog/bookstack-on-foss-video/).
 108 On the instance you can find the new videos I've published since last
 109 release:
 110
 111 - [More Power User Features in BookStack](https://foss.video/w/b4aTq3YzsTVjdEFBQtuHgZ)
 112 - [Installing BookStack on Debian 12 (Bookworm) with HTTPS](https://foss.video/w/mUKH26XNcYwxkF7VzupQAa)
 113 - [Tea Break: 8 Years of BookStack, LLM Connection Demo & Video Hosting](https://foss.video/w/mB67n8JBBHb9mSMYUM5DED)
 114
 115 As one last thing, I've been a long term viewer of the Linus Tech Tips YouTube channel and, although they've been going
 116 through some problems & controversy lately, it was pretty cool to see them using BookStack, in their ["Here's the plan." video](https://youtu.be/qAE5KoyFEUo?si=WdaqNUH77Fg9AMeM&t=231) (About 3:51), as a tool to improve/define their processes.
 117
 118 ### Full List of Changes
 119
 120 **Released in v23.08**
 121
 122 * Added content notification system. ([#4390](https://github.com/BookStackApp/BookStack/pull/4390), [#4371](https://github.com/BookStackApp/BookStack/issues/4371), [#241](https://github.com/BookStackApp/BookStack/issues/241))
 123 * Added browser-based drawing backup storage mechanism. ([#4457](https://github.com/BookStackApp/BookStack/pull/4457), [#4421](https://github.com/BookStackApp/BookStack/issues/4421))
 124 * Added order/priority control within books via the API. Thanks to [@rouet](https://github.com/BookStackApp/BookStack/pull/4313). ([#4313](https://github.com/BookStackApp/BookStack/pull/4313), [#4298](https://github.com/BookStackApp/BookStack/issues/4298))
 125 * Added host allow list option for server side requests like webhooks. ([#4410](https://github.com/BookStackApp/BookStack/issues/4410))
 126 * Added additional comment-specific activities. ([#4389](https://github.com/BookStackApp/BookStack/pull/4389))
 127 * Updated translations with latest Crowdin changes. ([#4380](https://github.com/BookStackApp/BookStack/pull/4380))
 128 * Fixed API docs caching failure when using DB cache driver. ([#4453](https://github.com/BookStackApp/BookStack/issues/4453))
 129 * Fixed overly wide page view when using an RTL language. ([#4429](https://github.com/BookStackApp/BookStack/issues/4429))
 130 * Fixed status cache check to work better for simultaneous requests. ([#4396](https://github.com/BookStackApp/BookStack/issues/4396))
 131
 132 **Released in v23.06.2**
 133
 134 * Re-added shelf create permissions, now include a note to indicate permission usage. ([#4375](https://github.com/BookStackApp/BookStack/issues/4375))
 135 * Fixed issue causing some delete-based action webhooks to create not-found errors. ([#4373](https://github.com/BookStackApp/BookStack/issues/4373))
 136 * Updated translations with latest Crowdin changes. ([#4367](https://github.com/BookStackApp/BookStack/pull/4367))
 137
 138 **Released in v23.06.1**
 139
 140 * Updated MAIL_ENCRYPTION usage due to incorrectly forcing initial TLS usage. ([#4358](https://github.com/BookStackApp/BookStack/issues/4358))
 141 * Updated translations with latest Crowdin changes. ([#4352](https://github.com/BookStackApp/BookStack/pull/4352))
 142 * Fixed image updated timestamp not updating when gallery images are replaced. ([#4354](https://github.com/BookStackApp/BookStack/issues/4354))
 143 * Fixed sort options breaking roles page load. ([#4350](https://github.com/BookStackApp/BookStack/issues/4350))
 144 * Fixed IPv6 addresses in audit log spilling into date column. ([#4349](https://github.com/BookStackApp/BookStack/issues/4349))
 145 * Fixed many inaccuracies in API example responses. Thanks to [@devdot](https://github.com/BookStackApp/BookStack/pull/4344). ([#4344](https://github.com/BookStackApp/BookStack/pull/4344))
 146
 147 ----
 148
 149 <span style="font-size: 0.8em;opacity:0.9;">Header Image Credits: <span>Photo by <a href="https://danb.me">Dan Brown</a></span></span>