<!--
 File        :  doc/source/changelog.sgml

 Purpose     :  Entity included in other project documents.

 Copyright (C) 2013-2021 Privoxy Developers https://www.privoxy.org/
 See LICENSE.

 ======================================================================
  This file used for inclusion with other documents only.
 ======================================================================

 If you make changes to this file, please verify the finished
 docs all display as intended.

 This file is included into:

  user-manual
-->


<!--
 The SGML ChangeLog can be generated with: utils/changelog2doc.pl ChangeLog
-->

<para>
  <application>Privoxy 3.0.32</application> fixes multiple DoS issues
  and a couple of other bugs. The issues also affect earlier Privoxy
  releases.
</para>
 <para>
  Changes in <application>Privoxy 3.0.32</application> stable:
 </para>
 <para>
 <itemizedlist>
  <listitem>
   <para>
    Security/Reliability:
    <itemizedlist>
    <listitem>
     <para>
      ssplit(): Remove an assertion that could be triggered with a
      crafted CGI request.
      Commit 2256d7b4d67. OVE-20210203-0001.
      Reported by: Joshua Rogers (Opera)
     </para>
    </listitem>
    <listitem>
     <para>
      cgi_send_banner(): Overrule invalid image types. Prevents a
      crash with a crafted CGI request if Privoxy is toggled off.
      Commit e711c505c48. OVE-20210206-0001.
      Reported by: Joshua Rogers (Opera)
     </para>
    </listitem>
    <listitem>
     <para>
      socks5_connect(): Don't try to send credentials when none are
      configured. Fixes a crash due to a NULL-pointer dereference
      when the socks server misbehaves.
      Commit 85817cc55b9. OVE-20210207-0001.
      Reported by: Joshua Rogers (Opera)
     </para>
    </listitem>
    <listitem>
     <para>
      chunked_body_is_complete(): Prevent an invalid read of size two.
      Commit a912ba7bc9c. OVE-20210205-0001.
      Reported by: Joshua Rogers (Opera)
     </para>
    </listitem>
    <listitem>
     <para>
      Obsolete pcre: Prevent invalid memory accesses with an invalid
      pattern passed to pcre_compile(). Note that the obsolete pcre code
      is scheduled to be removed before the 3.0.33 release. There has been
      a warning since since 2008 already.
      Commit 28512e5b624. OVE-20210222-0001.
      Reported by: Joshua Rogers (Opera)
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Bug fixes:
    <itemizedlist>
    <listitem>
     <para>
      Properly parse the client-tag-lifetime directive. Previously it was
      not accepted as an obsolete hash value was being used.
      Reported by: Joshua Rogers (Opera)
     </para>
    </listitem>
    <listitem>
     <para>
      decompress_iob(): Prevent reading of uninitialized data.
      Reported by: Joshua Rogers (Opera).
     </para>
    </listitem>
    <listitem>
     <para>
      decompress_iob(): Don't advance cur past eod when looking
      for the end of the file name and comment.
     </para>
    </listitem>
    <listitem>
     <para>
      decompress_iob(): Cast value to unsigned char before shifting.
      Prevents a left-shift of a negative value which is undefined behaviour.
      Reported by: Joshua Rogers (Opera)
     </para>
    </listitem>
    <listitem>
     <para>
      gif_deanimate(): Confirm that that we have enough data before doing
      any work. Fixes a crash when fuzzing with an empty document.
      Reported by: Joshua Rogers (Opera).
     </para>
    </listitem>
    <listitem>
     <para>
      buf_copy(): Fail if there's no data to write or nothing to do.
      Prevents undefined behaviour "applying zero offset to null pointer".
      Reported by: Joshua Rogers (Opera)
     </para>
    </listitem>
    <listitem>
     <para>
      log_error(): Treat LOG_LEVEL_FATAL as fatal even when --stfu is
      being used while fuzzing.
      Reported by: Joshua Rogers (Opera).
     </para>
    </listitem>
    <listitem>
     <para>
      Respect DESTDIR when considering whether or not to install
      config files with ".new" extension.
     </para>
    </listitem>
    <listitem>
     <para>
      OpenSSL ssl_store_cert(): Fix two error messages.
     </para>
    </listitem>
    <listitem>
     <para>
      Fix a couple of format specifiers.
     </para>
    </listitem>
    <listitem>
     <para>
      Silence compiler warnings when compiling with NDEBUG.
     </para>
    </listitem>
    <listitem>
     <para>
      fuzz_server_header(): Fix compiler warning.
     </para>
    </listitem>
    <listitem>
     <para>
      fuzz_client_header(): Fix compiler warning.
     </para>
    </listitem>
    <listitem>
     <para>
      cgi_send_user_manual(): Also reject requests if the user-manual
      directive specifies a https:// URL. Previously Privoxy would try and
      fail to open a local file.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    General improvements:
    <itemizedlist>
    <listitem>
     <para>
      Log the TLS version and the the cipher when debug 2 is enabled..
     </para>
    </listitem>
    <listitem>
     <para>
      ssl_send_certificate_error(): Respect HEAD requests by not sending a body.
     </para>
    </listitem>
    <listitem>
     <para>
      ssl_send_certificate_error(): End the body with a single new line.
     </para>
    </listitem>
    <listitem>
     <para>
      serve(): Increase the chances that the host is logged when closing
      a server socket.
     </para>
    </listitem>
    <listitem>
     <para>
      handle_established_connection(): Add parentheses to clarify an expression
      Suggested by: David Binderman
     </para>
    </listitem>
    <listitem>
     <para>
      continue_https_chat(): Explicitly unset CSP_FLAG_CLIENT_CONNECTION_KEEP_ALIVE
      if process_encrypted_request() fails. This makes it more obvious that the
      connection will not be reused. Previously serve() relied on
      CSP_FLAG_SERVER_CONTENT_LENGTH_SET and CSP_FLAG_CHUNKED being unset.
      Inspired by a patch from Joshua Rogers (Opera).
     </para>
    </listitem>
    <listitem>
     <para>
      decompress_iob(): Add periods to a couple of log messages
     </para>
    </listitem>
    <listitem>
     <para>
      Terminate the body of the HTTP snipplets with a single new line
      instead of "\r\n".
     </para>
    </listitem>
    <listitem>
     <para>
      configure: Add --with-assertions option and only enable assertions
      when it is used
     </para>
    </listitem>
    <listitem>
     <para>
      windows build: Use --with-brotli and --with-mbedtls by default and
      enable dynamic error checking.
     </para>
    </listitem>
    <listitem>
     <para>
      gif_deanimate(): Confirm we've got an image before trying to write it
      Saves a pointless buf_copy() call.
     </para>
    </listitem>
    <listitem>
     <para>
      OpenSSL ssl_store_cert(): Remove a superfluous space before the serial number.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Action file improvements:
    <itemizedlist>
    <listitem>
     <para>
      Disable fast-redirects for .golem.de/
     </para>
    </listitem>
    <listitem>
     <para>
      Unblock requests to adri*.
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests for trc*.taboola.com/
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for .linkedin.com/
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Filter file improvements:
    <itemizedlist>
    <listitem>
     <para>
      Make the second pcrs job of the img-reorder filter greedy again.
      The ungreedy version broke the img tags on:
      https://bulk.fefe.de/scalability/.
     </para>
    </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Privoxy-Log-Parser:
    <itemizedlist>
    <listitem>
     <para>
      Highlight a few more messages.
     </para>
    </listitem>
    <listitem>
     <para>
      Clarify the --statistics output. The shown "Reused connections"
      are server connections so name them appropriately.
     </para>
    </listitem>
    <listitem>
     <para>
      Bump version to 0.9.3.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Privoxy-Regression-Test:
    <itemizedlist>
    <listitem>
     <para>
      Add the --check-bad-ssl option to the --help output.
     </para>
    </listitem>
    <listitem>
     <para>
      Bump version to 0.7.3.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Documentation:
    <itemizedlist>
    <listitem>
     <para>
      Add pushing the created tag to the release steps in the developer manual.
     </para>
    </listitem>
    <listitem>
     <para>
      Clarify that 'debug 32768' should be used in addition to the other debug
      directives when reporting problems.
     </para>
     </listitem>
    <listitem>
     <para>
      Add a 'Third-party licenses and copyrights' section to the user manual.
     </para>
    </listitem>
    </itemizedlist>
   </para>
  </listitem>
 </itemizedlist>
</para>
