fixed script md5 -> sha256

[jirafeau/jirafeau.git] / CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a4d6f380c1c678652cb6072c6d1f6ea66459221..ed7b7417ab3ff6afc1689e9da3b9f9aaef6c30a2 100644 (file)
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,8 +14,16 @@
 
 ## Version 4.7.x (not yet released)
 
 
 ## Version 4.7.x (not yet released)
 

+- Favicon was missing in the `modern` theme

 - ...
 
 - ...
 

+## Version 4.7.1
+
+- Fixed another possibility to bypass the checks for [CVE-2022-30110](https://www.cve.org/CVERecord?id=CVE-2022-30110), [CVE-2024-12326](https://www.cve.org/CVERecord?id=CVE-2024-12326) and [CVE-2025-7066](https://www.cve.org/CVERecord?id=CVE-2025-7066) (prevent preview of SVG images and other critical files) by sending a manipulated HTTP request with a MIME type like "image". When doing the preview, the browser tries to automatically detect the MIME type resulting in detecting SVG and possibly executing JavaScript code. To prevent this, MIME sniffing is disabled.
+- The default value of `max_upload_chunk_size_bytes` was set to `5000000`. Higher values could trigger a bug Chromium-based browsers on servers with HTTP/3 enabled, causing asynchronous uploads to fail.
+- Docker image: Updated PHP to 8.3 and removed `mime-types.conf` from `lighttpd.conf`
+- Upgrade from 4.7.0: in-place upgrade, you also should set `max_upload_chunk_size_bytes` to `5000000` in your `config.local.php`!
+

 ## Version 4.7.0
 
 - Added feature for using shortened download links. This requires a web server that supports URL rewriting, like Apache with `mod_rewrite`.
 ## Version 4.7.0
 
 - Added feature for using shortened download links. This requires a web server that supports URL rewriting, like Apache with `mod_rewrite`.