onionshare version history

- Security fixes to prevent symlink traversal and unauthorized file uploads. - Updated Tor and other dependencies, including Flatpak runtime. - Bug fix for Tor traversal progress display and user warnings.

## 2.6.3 * Feature: It is now possible to view what URLs are visited in Share/Website mode using the CLI tool, with `--log-filenames`. * Feature: It is now possible to automatically start a saved persistent onion tab, once OnionShare itself starts and once Tor is connected. * Bug fix: It is now once again possible to request bridges and use meek as a Pluggable Transport. * Bug fix: Fixed a fatal error with Censorship Circumvention when no bridges are returned. * Bug fix: Fixed an issue with lack of gevent with SocketIO on systems that don't have it. * Bug fix: Fixed a thread-related race condition segfault with the CLI tool on shutdown. * Bug fix: Fixed an issue with the 'auto-stop timer' when the CLI tool is being used in 'Share mode' and someone has visited the share at least once. Desktop was unaffected, as were all other modes. * Locales: Gaeilge, Slovenčina and Tamil languages introduced, and various other translations in existing languages added or improved (thanks to the translators!) * Documentation: Added examples of using a systemd unit file for persistent onions, and various other clarifications. * Documentation: Documented all the config file parameters and

What's new: * Security fix: Removes newlines from History item path * Security fix: Set a maximum length of 524288 characters for text messages in Receive mode * Security fix: Allows only specific ASCII characters for usernames and removes control characters * Security fix: Forcefully disconnect user from chat on `disconnect` event * Security fix: Handle username validation excpeptions to prevent silent joining

What's new: * Release updates: Automate builds with CI, make just 64-bit Windows release, make a single universal2 release for both Intel and Apple Silicon macOS * Upgrade dependencies, including Tor, meek, and snowflake * Bug fix: Restore the primary_action mode settings in a tab after OnionShare reconnects to Tor * Bug fix: Fix issue with auto-connecting to Tor with persistent tabs open * Bug fix: Fix packaging issue where Windows version of OnionShare conflicts with Windows version of Dangerzone * Bug fix: Fix 'Use a bridge' checkbox state change * Bug fix: Raise error from waitress if not shutdown

This is a development release.

What's new: * Major feature: a new 'Quickstart' screen, which enables toggling on or off an animated automatic connection to Tor. This allows configuring network settings prior to automatic connection. * Major feature: Censorship circumvention. Use new features in the upstream Tor API to try to automatically obtain bridges depending on the user's location. * New feature: automatically fetch the built-in bridges from the upstream Tor API rather than hardcode them in each release of OnionShare. * New feature: keyboard shortcuts to access various modes and menus, and accessibility hints * Bug fix: Temporary Directory for serving the OnionShare web pages was broken on Windows * Packaging: Packaging is more automated, and Linux Snapcraft releases are available for amd64, arm64, and armhf * Miscellaneous: Many dependency updates and web page theming improvements

Early release.

Early release to test CI builds.

What's new: * Security fix: Sanitize the path parameter in History item widget to be plain text * Security fix: Use microseconds in Receive mode directory creation to avoid potential DoS * Security fix: Several hardening improvements for session and username management in Chat mode, to prevent impersonation and other issues * Major feature: Obtain bridges from Moat / BridgeDB (over a domain-fronted Meek client) * Major feature: Snowflake bridge support * New feature: Tor connection settings, as well as general settings, are now Tabs rather than dialogs * New feature: User can customize the Content-Security-Policy header in Website mode * New feature: Built-in bridges are automatically updated from Tor's API when the user has chosen to use them * Switch to using our `stem` fork called `cepa`, which is now published on PyPi so we can build it in releases * Various bug fixes

What's new: - Major feature: Private keys (v3 onion client authentication) replaces passwords and HTTP basic auth - Updated Tor to 0.4.6.7 on all platforms - Various bug fixes