Version 2.6.1 ()
------------------------------------------------------------------------

* Security fix: The check for which URLs are allowed to be fetched
when downloading images to the ML was outdated and
did not catch e.g. AWS IMDS at 169.254.169.254.
Thanks to @riodrwn for the report and patch.

* Security fix: Close an open redirect in exit.php that was opened
when the trackexit plugin was installed and the
option was set to redirect comment links via the blog.
Thanks to @DevVaibhav07 for the report and patch.

* Security fix: A new account could re-use the username of an
existing account and gain adming rights this way.
Thanks to @DevVaibhav07 for the report and patch.

* Security fix: Reflected XSS in search clean-URL route.
Thanks to @hutsbotnet for the report and patch.

* Fix plugin drag'n drop not working on new installs

* Fix some PHP 8 code quality warnings

* Add cleanCache() on comment editing, deletion and category changes
(thanks to @fasterit/DLange)

* Fix division by zero error when accessing all PHP comments on PHP 8
(thanks to @qbi)

* Fix error message and 404 status code on plugin pages when cache
was active (thanks to @fasterit/DLange)

Version 2.6.0 (April 10th, 2026)
------------------------------------------------------------------------

* Add an option to limit which hosts are accepted as automatically
detected baseURL, serendipity['validBaseHosts']. This is a security
measure for installations that run under multiple domains and also
accept arbitrary host headers.

* Security fix: Attackers could manipulate the mail headers of
notification mails, on some server setups.
Thanks to Marcelo Barbosa for the report.

* Security fix: The domain of the login cookie could be manipulated,
on some server setups.
Thanks to Marcelo Barbosa for the report.

* Rework of the XSRF token protection, it was a replaced with a
check on the Sec-Fetch-Site header. This should eliminate the
timeouts that caused referer error messages on entry previews and
saves.

* Fix: The bootstrap4 theme now sets the serendipity_entry class.
This fixes the lightbox plugins photoswipe mode when using one
gallery per entry and potentially other plugins.

* Provide option for a second factor on login. Currently this
consists of a code sent to the autor's email that has to be entered
on login.

* 2k11 now shows examples for its multiple date format options in the
theme's configuration

* Maintenance action for clearing the template cache now also empties
the internal cache of serendipity and clears all smarty cache
files. It was thus renamed to "clear cache".

* nl2br: Fix an error that occured on some configuration in nl2p mode
on the isolation tags check

* Removed Sourceforge from Spartacus' mirror list, as it caused HTML
to be written to the plugin files instead of the wanted PHP code.

* Removed obsolete Pragma header from some responses, controlling
brwoser cache behaviour. Alternative headers were already set.

* Fix: clean blog's sticky header (that appears when scrolling up)
was positioned with a gap, when it contained too many
navigation links

* Breaking Change: Removed Net/DNSBL.php, Net/CheckIP.php and
pear/net_dns2 from the bundled libs.

* Update Smarty to current v5.6.0 (official support for PHP 8.4)

* Make smarty->entries also available when entry is cached. This
fixes e.g. opengraph tags of the social plugin disappearing.

* Brute force protection for the logins. Logins now only accept 5
login attempts a minute, bound to the user's anonymized IP.

* Show error when uploaded file is too big (PHP ini settings)

* Move 2k11's url validation helper function into the load event, so
loading of jQuery itself can be delayed

* clean blog: Updated to use newer versions of font awesome,
bootstrap and its webfonts. Also hosts those files locally now and
drops the shims for old versions of the Internet Explorer. Add
option for a mastodon profile button.

* Fix CSS based tabs in plugin and media upload area

* Fix tooltips in installer not working and the installer's language
list using the wrong encoding

* Add XSLT shylesheet to the RSS and Atom feed, including a link to an
explainer about how to use feeds

Version 2.5.0 (13.02.2024)
------------------------------------------------------------------------

* Restore compatibility with PHP 7.4

* Remove bundled composer.phar (thanks to hboeck)

* Update composer dependencies (mostly for PHP 8.3 compatibility):
katzgrau/klogger (1.0.0 => 1.2.2)
pear/http_request2 (v2.5.1 => v2.6.0)
pear/net_dns2 (v1.5.3 => v1.5.4)
psr/log (1.0.0 => 1.1.4)
smarty/smarty (v4.3.2 => v4.3.5)

* Fix a PHP notice in User management ("isEditable") (garvinhicking)

* Fix a bug when the p parameter given was set to 0 (@hannob)

* Fix an incompatibility with MySQL 5.7 or later (@mariohommel)

Version 2.4.0 (November 20th, 2022)
------------------------------------------------------------------------

* Fix: Avoid bad number of arguments to sprintf and fix logic error
in spamblock plugin.

* Improve w3c compatibility be encode square brackets of comment
mode links (thanks @hannob)

* Fix: Previewing comments warning threw a warning on PHP 8, when
debug mode on (thanks @hannob)

* Fix: Editor autosave cached was not deleted when saving entry

* Fix: Editor autosave was not on by default, despite the setting
being active by default

* Fix: admin/entries.tpl: fix undefined variable iso2br

* Fix: The calendar plugin threw a warning about $cond['join'] not
existing in some setups

* Fix: Avoid one more situation where responsive image upscaled
a small thumbnail

* Bugfix: Entryproperites plugin no longer insert empty records
for multiple authors (garvinhicking)

* Improve permalink generation performance and enable more unicode
replacements (thanks to mbirth!)

Version 2.3.5 (April 25th, 2020)
------------------------------------------------------------------------

* Fix: CSS: Restrict block display of summary to trackbacks. (#703)

* Fix: Don't strip HTML from comments body in serendipity_plugin_comments
before serendipity_event_unstrip_tags can convert the HTML tags
(being called via frontend_display hook). (#702)

* Fix: [CKE] Don't remove <details> and <summary> elements from
WYSIWYG editor.

* Fix: Don't delete extend properties from the entryproperties
plugin when publishing from dashboard (or sending
delayed trackbacks). (#695)

* Fix: SQL error in serendipity_plugin_history present since we
"don't allow requesting an archive page that doesn't exist"
(2.3.3). (#694)

* Fix: Entry title in backend list of entries was double escaped.

* Fix: Don't drop upgraded_version from local plugin cache.

* Fix: Regular expression in functions_routing.inc.php

* Fix: Truncate extension of media items to 5 chars (which ist the
max length of the corresponding database field). (#609)
Thanks to @mmitch!