Release 3.3.3

db85cb7f · JC Brand · d8f2a1eb · db85cb7f · db85cb7f · db85cb7f
Commit db85cb7f authored Feb 14, 2018 by JC Brand
49 changed files
--- a/CHANGES.md
+++ b/CHANGES.md
 # Changelog

-## 3.3.3 (Unreleased)
+## 3.3.3 (2018-02-14)

 ### Bugfixes
 - Attribute error when empty IQ stanza is returned for vCard query
- Don't allow PEP bookmarks if `pubsub#publish-options` is not advertised by the server.
 - In fullscreen view, sometimes a background MUC would come into the foreground
  when a new message appears inside it.

-_Note: previously this meant that bookmarks sent to servers that don't
-support `pubsub#publish-options` were visible to all your contacts, even
-though they should be private._
+### Security fixes
+
+- CVE-2018-6591: Don't allow PEP bookmarks if `pubsub#publish-options` is not advertised by the server.
+
+    In previous versions of converse.js, bookmarks sent to servers that don't
+    support `pubsub#publish-options` were visible to all your contacts, even
+    though they should be kept private. This is due to those servers simply
+    ignoring the `pubsub#publish-options` directive and converse.js not checking
+    first whether `pubsub#publish-options` is supported before setting bookmarks
+    via PEP.
+
+    More info here: https://gultsch.de/converse_bookmarks.html

 ### New features
 - XEP-0382 Spoiler Messages (currently only for private chats)
@@ -19,6 +27,7 @@ though they should be private._
    - No need to manually blacklist or whitelist any plugins.
    - Relies on the [view_mode](https://conversejs.org/docs/html/configurations.html#view-mode) being set to `'embedded'`.
    - The main `converse.js` build can be used for the embedded usecase.
+    - Maintain MUC session upon page reload

 ### API changes
 - New API method `_converse.disco.getIdentity` to check whether a JID has a given identity.

--- a/COPYRIGHT
+++ b/COPYRIGHT
@@ -2,7 +2,7 @@
 *
 *  An XMPP chat client that runs in the browser.
 *
- *  Version: 3.3.2
+ *  Version: 3.3.3
 *
 *  Copyright: JC Brand 2012-2017
 *  Except for 3rd party dependencies.

--- a/Makefile
+++ b/Makefile
@@ -71,7 +71,7 @@ serve_bg: dev
 ########################################################################
 ## Translation machinery

-GETTEXT = xgettext --language="JavaScript" --keyword=__ --keyword=___ --from-code=UTF-8 --output=locale/converse.pot dist/converse-no-dependencies.js --package-name=Converse.js --copyright-holder="Jan-Carel Brand" --package-version=3.3.2 -c
+GETTEXT = xgettext --language="JavaScript" --keyword=__ --keyword=___ --from-code=UTF-8 --output=locale/converse.pot dist/converse-no-dependencies.js --package-name=Converse.js --copyright-holder="Jan-Carel Brand" --package-version=3.3.3 -c

 .PHONY: pot
 pot: dist/converse-no-dependencies.js

--- a/README.md
+++ b/README.md
@@ -116,6 +116,7 @@ The following people are making recurring donations:
 * [Rafael](https://www.patreon.com/user/creators?u=4340078)
 * [mt7479](https://www.patreon.com/user/creators?u=3892290)
 * [roelra](https://www.patreon.com/user/creators?u=5958918)
+* [Guus der Kinderen](https://www.patreon.com/user/creators?u=8302585)
 * An anonymous backer on Liberapay

 Additionally this project is supported by

--- a/dist/converse-muc-embedded.js
+++ b/dist/converse-muc-embedded.js
--- a/dist/converse-no-dependencies.js
+++ b/dist/converse-no-dependencies.js
--- a/dist/converse.js
+++ b/dist/converse.js
--- a/docs/source/conf.py
+++ b/docs/source/conf.py
@@ -48,9 +48,9 @@ copyright = u'2017, JC Brand'
 # built documents.
 #
 # The short X.Y version.
-version = '3.3.2'
+version = '3.3.3'
 # The full version, including alpha/beta/rc tags.
-release = '3.3.2'
+release = '3.3.3'

 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.

--- a/docs/source/quickstart.rst
+++ b/docs/source/quickstart.rst
@@ -22,8 +22,8 @@ The latest versions of these files are available at these URLs:

 To load a specific version of Converse.js you can put the version in the URL, like so:

-* https://cdn.conversejs.org/3.3.2/dist/converse.min.js
-* https://cdn.conversejs.org/3.3.2/css/converse.min.css
+* https://cdn.conversejs.org/3.3.3/dist/converse.min.js
+* https://cdn.conversejs.org/3.3.3/css/converse.min.css

 You can include these two URLs inside the *<head>* element of your website
 via the *script* and *link* tags:

--- a/locale/af/LC_MESSAGES/converse.json
+++ b/locale/af/LC_MESSAGES/converse.json
--- a/locale/af/LC_MESSAGES/converse.po
+++ b/locale/af/LC_MESSAGES/converse.po
--- a/locale/ca/LC_MESSAGES/converse.json
+++ b/locale/ca/LC_MESSAGES/converse.json
--- a/locale/ca/LC_MESSAGES/converse.po
+++ b/locale/ca/LC_MESSAGES/converse.po
--- a/locale/converse.pot
+++ b/locale/converse.pot
--- a/locale/de/LC_MESSAGES/converse.json
+++ b/locale/de/LC_MESSAGES/converse.json
--- a/locale/de/LC_MESSAGES/converse.po
+++ b/locale/de/LC_MESSAGES/converse.po
--- a/locale/es/LC_MESSAGES/converse.json
+++ b/locale/es/LC_MESSAGES/converse.json
--- a/locale/es/LC_MESSAGES/converse.po
+++ b/locale/es/LC_MESSAGES/converse.po
--- a/locale/fr/LC_MESSAGES/converse.json
+++ b/locale/fr/LC_MESSAGES/converse.json
--- a/locale/fr/LC_MESSAGES/converse.po
+++ b/locale/fr/LC_MESSAGES/converse.po
--- a/locale/he/LC_MESSAGES/converse.json
+++ b/locale/he/LC_MESSAGES/converse.json
--- a/locale/he/LC_MESSAGES/converse.po
+++ b/locale/he/LC_MESSAGES/converse.po
--- a/locale/hu/LC_MESSAGES/converse.json
+++ b/locale/hu/LC_MESSAGES/converse.json
--- a/locale/hu/LC_MESSAGES/converse.po
+++ b/locale/hu/LC_MESSAGES/converse.po
--- a/locale/id/LC_MESSAGES/converse.json
+++ b/locale/id/LC_MESSAGES/converse.json
--- a/locale/id/LC_MESSAGES/converse.po
+++ b/locale/id/LC_MESSAGES/converse.po
--- a/locale/it/LC_MESSAGES/converse.json
+++ b/locale/it/LC_MESSAGES/converse.json
--- a/locale/it/LC_MESSAGES/converse.po
+++ b/locale/it/LC_MESSAGES/converse.po
--- a/locale/ja/LC_MESSAGES/converse.json
+++ b/locale/ja/LC_MESSAGES/converse.json
--- a/locale/ja/LC_MESSAGES/converse.po
+++ b/locale/ja/LC_MESSAGES/converse.po
--- a/locale/nb/LC_MESSAGES/converse.json
+++ b/locale/nb/LC_MESSAGES/converse.json
--- a/locale/nb/LC_MESSAGES/converse.po
+++ b/locale/nb/LC_MESSAGES/converse.po
--- a/locale/nl/LC_MESSAGES/converse.json
+++ b/locale/nl/LC_MESSAGES/converse.json
--- a/locale/nl/LC_MESSAGES/converse.po
+++ b/locale/nl/LC_MESSAGES/converse.po
--- a/locale/pl/LC_MESSAGES/converse.json
+++ b/locale/pl/LC_MESSAGES/converse.json
--- a/locale/pl/LC_MESSAGES/converse.po
+++ b/locale/pl/LC_MESSAGES/converse.po
--- a/locale/pt_BR/LC_MESSAGES/converse.json
+++ b/locale/pt_BR/LC_MESSAGES/converse.json
--- a/locale/pt_BR/LC_MESSAGES/converse.po
+++ b/locale/pt_BR/LC_MESSAGES/converse.po
--- a/locale/ru/LC_MESSAGES/converse.json
+++ b/locale/ru/LC_MESSAGES/converse.json
--- a/locale/ru/LC_MESSAGES/converse.po
+++ b/locale/ru/LC_MESSAGES/converse.po
--- a/locale/uk/LC_MESSAGES/converse.json
+++ b/locale/uk/LC_MESSAGES/converse.json
--- a/locale/uk/LC_MESSAGES/converse.po
+++ b/locale/uk/LC_MESSAGES/converse.po
--- a/locale/zh_CN/LC_MESSAGES/converse.json
+++ b/locale/zh_CN/LC_MESSAGES/converse.json
--- a/locale/zh_CN/LC_MESSAGES/converse.po
+++ b/locale/zh_CN/LC_MESSAGES/converse.po
--- a/locale/zh_TW/LC_MESSAGES/converse.json
+++ b/locale/zh_TW/LC_MESSAGES/converse.json
--- a/locale/zh_TW/LC_MESSAGES/converse.po
+++ b/locale/zh_TW/LC_MESSAGES/converse.po
--- a/package-lock.json
+++ b/package-lock.json
 {
  "name": "converse.js",
-  "version": "3.3.2",
+  "version": "3.3.3",
  "lockfileVersion": 1,
  "requires": true,
  "dependencies": {

--- a/package.json
+++ b/package.json
 {
  "name": "converse.js",
-  "version": "3.3.2",
+  "version": "3.3.3",
  "description": "Browser based XMPP instant messaging client",
  "main": "main.js",
  "directories": {

--- a/src/start.frag
+++ b/src/start.frag
@@ -2,7 +2,7 @@
 *
 *  An XMPP chat client that runs in the browser.
 *
- *  Version: 3.3.2
+ *  Version: 3.3.3
 */

 /* jshint ignore:start */