Merge pull request #1870 from hackmdio/release/2.5.4

Release 2.5.4

README.md

@@ -39,7 +39,7 @@ HackMD is built with one promise - **You own and control all your content**:
 
 ## CodiMD - The Open Source HackMD
 
-CodiMD is the free software version of [HackMD](https://hackmd.io), developed and opened source by the HackMD team with reduced features (without book mode), you can use CodiMD for your community and own all your data. *(See the [origin of the name CodiMD](https://github.com/hackmdio/hackmd/issues/720).)* 
+CodiMD is the free software version of [HackMD](https://hackmd.io), developed and open sourced by the HackMD team with reduced features (without book mode), you can use CodiMD for your community and own all your data. *(See the [origin of the name CodiMD](https://github.com/hackmdio/hackmd/issues/720).)* 
 
 CodiMD is perfect for open communities, while HackMD emphasizes on permission and access controls for commercial use cases. 
 

deployments/docker-compose.yml

@@ -11,10 +11,7 @@ services:
     restart: always
   codimd:
     # you can use image or custom build below,
-    # if you need CJK character with exported PDF files,
-    # please change the image tag with `cjk` postfix version
-    image: nabo.codimd.dev/hackmdio/hackmd:2.1.0
-    # image: nabo.codimd.dev/hackmdio/hackmd:2.1.0-cjk
+    image: nabo.codimd.dev/hackmdio/hackmd:2.5.3
     # build:
     #   context: ..
     #   dockerfile: ./deployments/Dockerfile

lib/imageRouter/filesystem.js

@@ -22,8 +22,8 @@ function randomFilename () {
  */
 function pickFilename (defaultFilename) {
   let retryCounter = 5
-  let filename = defaultFilename
   const extname = path.extname(defaultFilename)
+  let filename = `${randomFilename()}${extname}`
   while (retryCounter-- > 0) {
     if (fs.existsSync(path.join(config.uploadsPath, filename))) {
       filename = `${randomFilename()}${extname}`

lib/migrations/20240114120250-revision-add-index.js

@@ -0,0 +1,11 @@
+'use strict'
+
+module.exports = {
+  up: (queryInterface, Sequelize) => {
+    return queryInterface.addIndex('Revisions', ['noteId'], {})
+  },
+
+  down: (queryInterface, Sequelize) => {
+    return queryInterface.removeIndex('Revisions', 'noteId')
+  }
+}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codimd",
-  "version": "2.5.3",
+  "version": "2.5.4",
   "description": "Realtime collaborative markdown notes on all platforms.",
   "keywords": [
     "Collaborative",

public/docs/release-notes.md

@@ -1,6 +1,23 @@
 Release Notes
 ===
 
+<i class="fa fa-tag"></i> 2.5.4 <i class="fa fa-clock-o"></i> 2024-06-06
+---
+
+[Check out the complete release note][v2_5_4]. Thank you CodiMD community and all our contributors. ❤️
+
+[v2_5_4]: https://hackmd.io/@codimd/release-notes/%2F%40codimd%2Fv2_5_4
+
+## Enhancements
+
+- Add index at revision table for improving system performance [#1856](https://github.com/hackmdio/codimd/pull/1856)
+- Refactor to reuse random filename in filesystem image provider [#1867](https://github.com/hackmdio/codimd/pull/1867)
+
+## Fixes
+
+- Fix exclusion of name attribute from iframe filterXSS allowlist [#1865](https://github.com/hackmdio/codimd/pull/1865)
+- Fix typo: "opened source" -> "open sourced" [#1869](https://github.com/hackmdio/codimd/pull/1869)
+
 <i class="fa fa-tag"></i> 2.5.3 <i class="fa fa-clock-o"></i> 2024-01-08
 ---
 

public/js/render.js

@@ -20,7 +20,7 @@ whiteList.style = []
 // allow kbd tag
 whiteList.kbd = []
 // allow ifram tag with some safe attributes
-whiteList.iframe = ['allowfullscreen', 'name', 'referrerpolicy', 'src', 'width', 'height']
+whiteList.iframe = ['allowfullscreen', 'referrerpolicy', 'src', 'width', 'height']
 // allow summary tag
 whiteList.summary = []
 // allow ruby tag