sebsauvage · muki · Sep 15, 2014 · Sep 15, 2014 · Sep 15, 2014 · Sep 15, 2014
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,55 +1,55 @@
 # ZeroBin version history #
 
-  * **Alpha 0.8 (2012-04-11):**
-    * Source code not published yet.
-    * Interface completely redesigned. Icons added.
-    * Now properly supports IE6/7 (ugly display, but it works. "Clone" button is disabled though.)
-    * Added one level of depth for storage directories (This is better for higher load servers).
-    * php version is now checked (min: 5.2.6)
-    * Better checks on posted json data on server.
-    * Added "1 year" expiration.
-    * URLs are now converted to clickable links. This include http, https, ftp and magnet links.
-    * Clickable links include ''rel="nofollow"'' to discourage SEO.
-    * On my public service (http://sebsauvage.net/paste/)
-      * All data will be deleted (you were warned - this is a test service)
-      * Default paste expiration is now 1 month to prevent clogging-up my host.
-  * **Alpha 0.9 (2012-04-11):**
-    * Oh bummer... IE 8 is as shitty as IE6/7: Its does not seem to support ''white-space:pre-wrap'' correctly. I had to activate the special handling mode. I still have to test IE 9.
-  * **Alpha 0.10 (2012-04-12):**
-    * IE9 does not seem to correctly support ''pre-wrap'' either. Special handling mode activated for all version of IE<10. (Note: **ALL other browsers** correctly support this feature.) 
-  * **Alpha 0.11 (2012-04-12):**
-    * Automatically ignore parameters (such as &utm_source=...) added //after// the anchor by some stupid Web 2.0 services.
-    * First public release.
-  * **Alpha 0.12 (2012-04-18):**
-    * **DISCUSSIONS !** Now you can enable discussions on your pastes. Of course, posted comments and nickname are also encrypted and the server cannot see them.
-    * This feature implies a change in storage format. You will have to delete all previous pastes in your ZeroBin. 
-    * Added [[php:vizhash_gd|Vizhash]] as avatars, so you can match posters IP addresses without revealing them. (Same image = same IP). Of course the IP address cannot be deduced from the Vizhash.
-    * Remaining time before expiration is now displayed.
-    * Explicit tags were added to CSS and jQuery selectors (eg. div#aaa instead of #aaa) to speed up browser. 
-    * Better cleaning of the URL (to make sure the key is not broken by some stupid redirection service)
-  * **Alpha 0.13 (2012-04-18):**
-    * FIXED: ''imageantialias()'' call removed because it's not really usefull and can be a problem on most hosts (if GD is not compiled in php).
-    * FIXED: $error not properly initialized in index.php
-  * **Alpha 0.14 (2012-04-20):**
-    * ADDED: GD presence is checked. 
-    * CHANGED: Traffic limiter data files moved to data/ (→easier rights management)
-    * ADDED: "Burn after reading" implemented. Opening the URL will display the paste and immediately destroy it on server.
-  * **Alpha 0.15 (2012-04-20):**
-    * FIXED: 2 minor corrections to avoid notices in php log.
-    * FIXED: Sources converted to UTF-8.
-  * **Alpha 0.15 (2012-04-20):**
-    * FIXED: 2 minor corrections to avoid notices in php log.
-    * FIXED: Sources converted to UTF-8.
-  * **Alpha 0.16**:
-    * FIXED minor php warnings.
-    * FIXED: zerobin.js reformated and properly commented.
-    * FIXED: Directory structure re-organized.
-    * CHANGED: URL shortening button was removed. (It was bad for privacy.)
-  * **Alpha 0.17 (2013-02-23)**:
-    * ADDED: Deletion URL.
-    * small refactoring.
-    * improved regex checks.
-    * larger server alt on installation.    
+  * **0.22 (2015-11-09)**:
+    * ADDED: Tab character input support
+    * ADDED: Dark bootstrap theme
+    * ADDED: Option to hide clone button on expiring pastes
+    * ADDED: Option to set a different default language then English and/or enforce it as the only language
+    * ADDED: Database now contains version to allow automatic update of structure, only if necessary; removing database structure check on each request
+    * ADDED: Favicons
+    * FIXING: Regressions in database layer, prohibiting pastes from being stored
+    * FIXING: Fixing "missing" comments when they were posted during the same second to the same paste
+    * FIXING: JS failing when password input disabled
+    * CHANGED: Switching positions of "New" and "Send" button, highlighting the latter to improve workflow
+    * CHANGED: Renamed config file to make updates easier
+    * CHANGED: Switching to JSON-based REST-API
+    * CHANGED: Database structure to store attachments, allowing larger attachments to be stored (depending on maximum BLOB size of database backend)
+    * CHANGED: Refactored data model, traffic limiting & request handling
+  * **0.21.1 (2015-09-21)**:
+    * FIXING: lost meta data when using DB model instead of flat files
+    * FIXING: mobile navbar getting triggered on load
+    * CHANGED: database table "paste" gets automatically extended with a "meta" column
+    * CHANGED: navbar of "bootstrap" template now spans full width of view port on large screens
+  * **0.21 (2015-09-19)**:
+    * ADDED: Translations for German, French and Polish, language selection menu (optional)
+    * ADDED: File upload and image display support (optional)
+    * ADDED: Markdown format support
+    * ADDED: "bootstrap-compact" template that hides some of the options in a drop down menu to ensure the nav bar fitting on one line on smaller screen sizes
+    * FIXING: Various usability issues with different screen sizes / device types in the "bootstrap" template
+    * CHANGED: Instead of having different options to enable and preselect certain formats there is now a generic `[formatter_options]` section where formats can be added to the displayed format drop down menu. A `defaultformatter` can be set, it defaults to "plaintext". The `syntaxhighlighting` configuration got deprecated.
+    * `zerobin.js` got a major refactoring:
+      * moved from global namespace into anonymous function
+      * events are no longer set via "onclick" attributes in the templates, but bound by from JS side
+      * for simpler maintenance the functions were grouped into objects: zerobin (display logic, event handling), filter (compression,
+encryption), i18n (translation, counterpart of i18n.php) and helper (stateless utilities)
+    * Wiki pages were added to address common topics:
+      * [Upgrading from ZeroBin 0.19 Alpha](https://github.com/elrido/ZeroBin/wiki/Upgrading-from-ZeroBin-0.19-Alpha)
+      * [ZeroBin Directory of public servers](https://github.com/elrido/ZeroBin/wiki/ZeroBin-Directory)
+      * [Translation](https://github.com/elrido/ZeroBin/wiki/Translation)
+      * [Templates](https://github.com/elrido/ZeroBin/wiki/Templates)
+  * **0.20 (2015-09-03)**:
+    * ADDED: Password protected pastes (optional)
+    * ADDED: configuration options for highlighting, password, discussions, expiration times, rate limiting
+    * ADDED: JSON-only retrieval of paste incl. discussion, used to be able to refresh paste when posting a comment
+    * ADDED: bootstrap CSS based template
+    * CHANGED: "Burn after reading" pastes are now deleted only after the paste was successfully decrypted via callback. This prevents accidental deletion by chatbots following URLs and the like. Usage of a password is suggested to ensure only the desired recipient is able to encrypt it.
+    * CHANGED: the "opendiscussion" option now only controls if the discussion checkbox is preselected. Use "discussion = false" to disable the discussion feature completely (which also removes the checkbox from the template).
+    * FIXING: Behaviour of several conflicting configuration options. As a general measure unit tests for 9 of the options and all their possible configurations were added via a unit test generator.
+    * updated JS libraries: jquery to 1.11.3, sjcl to 1.0.2, base64.js to 2.1.9, deflate to 0.5, inflate to 0.3 and prettify to latest
+    * generally improved documentation, both inline phpdoc / JSdoc source code documentation, as well as Wiki pages on installation, configuration, development and JSON-API
+  * **Alpha 0.19 (2013-07-05)**:
+    * Corrected XSS security flaw which affected IE<10. Other browsers were not affected.
+    * Corrected spacing display in IE<10.
   * **Alpha 0.18 (2013-02-24)**:
     * ADDED: The resulting URL is automatically selected after pressing "Send". You just have to press CTRL+C.
     * ADDED: Automatic syntax highlighting for 53 languages using highlight.js
@@ -63,7 +63,50 @@
     * ADDED: Better json checking (including entropy).
     * ADDED: Added version to js/css assets URLs in order to prevent some abusive caches to serve an obsolete version of these files when ZeroBin is upgraded.
     * "Burn after reading" option has been moved out of Expiration combo to a separate checkbox. Reason is: You can prevent a read-once paste to be available ad vitam eternam on the net.
-  * **Alpha 0.19 (2013-07-05)**:
-    * Corrected XSS security flaw which affected IE<10. Other browsers were not affected.
-    * Corrected spacing display in IE<10.
-
+  * **Alpha 0.17 (2013-02-23)**:
+    * ADDED: Deletion URL.
+    * small refactoring.
+    * improved regex checks.
+    * larger server alt on installation.
+  * **Alpha 0.16**:
+    * FIXED minor php warnings.
+    * FIXED: zerobin.js reformated and properly commented.
+    * FIXED: Directory structure re-organized.
+    * CHANGED: URL shortening button was removed. (It was bad for privacy.)
+  * **Alpha 0.15 (2012-04-20):**
+    * FIXED: 2 minor corrections to avoid notices in php log.
+    * FIXED: Sources converted to UTF-8.
+  * **Alpha 0.14 (2012-04-20):**
+    * ADDED: GD presence is checked. 
+    * CHANGED: Traffic limiter data files moved to data/ (→easier rights management)
+    * ADDED: "Burn after reading" implemented. Opening the URL will display the paste and immediately destroy it on server.
+  * **Alpha 0.13 (2012-04-18):**
+    * FIXED: ''imageantialias()'' call removed because it's not really usefull and can be a problem on most hosts (if GD is not compiled in php).
+    * FIXED: $error not properly initialized in index.php
+  * **Alpha 0.12 (2012-04-18):**
+    * **DISCUSSIONS !** Now you can enable discussions on your pastes. Of course, posted comments and nickname are also encrypted and the server cannot see them.
+    * This feature implies a change in storage format. You will have to delete all previous pastes in your ZeroBin. 
+    * Added [[php:vizhash_gd|Vizhash]] as avatars, so you can match posters IP addresses without revealing them. (Same image = same IP). Of course the IP address cannot be deduced from the Vizhash.
+    * Remaining time before expiration is now displayed.
+    * Explicit tags were added to CSS and jQuery selectors (eg. div#aaa instead of #aaa) to speed up browser. 
+    * Better cleaning of the URL (to make sure the key is not broken by some stupid redirection service)
+  * **Alpha 0.11 (2012-04-12):**
+    * Automatically ignore parameters (such as &utm_source=...) added //after// the anchor by some stupid Web 2.0 services.
+    * First public release.
+  * **Alpha 0.10 (2012-04-12):**
+    * IE9 does not seem to correctly support ''pre-wrap'' either. Special handling mode activated for all version of IE<10. (Note: **ALL other browsers** correctly support this feature.) 
+  * **Alpha 0.9 (2012-04-11):**
+    * Oh bummer... IE 8 is as shitty as IE6/7: Its does not seem to support ''white-space:pre-wrap'' correctly. I had to activate the special handling mode. I still have to test IE 9.
+  * **Alpha 0.8 (2012-04-11):**
+    * Source code not published yet.
+    * Interface completely redesigned. Icons added.
+    * Now properly supports IE6/7 (ugly display, but it works. "Clone" button is disabled though.)
+    * Added one level of depth for storage directories (This is better for higher load servers).
+    * php version is now checked (min: 5.2.6)
+    * Better checks on posted json data on server.
+    * Added "1 year" expiration.
+    * URLs are now converted to clickable links. This include http, https, ftp and magnet links.
+    * Clickable links include ''rel="nofollow"'' to discourage SEO.
+    * On my public service (http://sebsauvage.net/paste/)
+      * All data will be deleted (you were warned - this is a test service)
+      * Default paste expiration is now 1 month to prevent clogging-up my host.
diff --git a/CREDITS.md b/CREDITS.md
@@ -0,0 +1,18 @@
+Credits
+=======
+Sébastien Sauvage - original idea and main developer
+
+Alexey Gladkov - syntax highlighting
+Greg Knaddison - robots.txt
+MrKooky - HTML5 markup, CSS cleanup
+Simon Rupf - MVC refactoring, configuration, i18n and unit tests
+Hexalyse - Password protection
+Viktor Stanchev - File upload support
+azlux - Tab character input support
+Adam Fisher - Favicons
+
+Translations:
+Hexalyse - French
+Kuba Niewiarowski - Polish
+Gabbalo - German
+Draky50110 - French
diff --git a/INSTALL.md b/INSTALL.md
@@ -0,0 +1,106 @@
+Installation
+============
+
+## Basic installation
+
+**TL;DR:** Download the [latest release archive](https://github.com/elrido/ZeroBin/releases/latest)
+and extract it in your web hosts folder were you want to install your ZeroBin instance.
+
+### Requirements
+
+- PHP version 5.2.6 or above
+- GD extension
+- mcrypt extension (recommended)
+- some disk space or (optional) a database supported by PDO
+- A web browser with javascript support
+
+### Configuration
+
+In the file `cfg/conf.ini` you can configure ZeroBin. A `cfg/conf.ini.sample` 
+is provided containing all options on default values. You can copy it to 
+`cfg/conf.ini` and adapt it as needed. The config file is divided into multiple 
+sections, which are enclosed in square brackets.
+
+In the `[main]` section you can enable or disable the discussion feature, set the
+limit of stored pastes and comments in bytes. The `[traffic]` section lets you
+set a time limit in seconds. Users may not post more often then this limit to
+your ZeroBin installation.
+
+More details can be found in the
+[configuration documentation](https://github.com/elrido/ZeroBin/wiki/Configuration).
+
+## Advanced installation
+
+### Changing the path
+
+In the index.php you can define a different `PATH`. This is useful to secure your
+installation. You can move the configuration, data files, templates and PHP
+libraries (directories cfg, data, lib, tpl, tmp and tst) outside of your document
+root. This new location must still be accessible to your webserver / PHP process
+([open_basedir setting](http://php.net/manual/en/ini.core.php#ini.open-basedir)).
+
+> #### PATH Example
+> Your zerobin installation lives in a subfolder called "paste" inside of your
+> document root. The URL looks like this:
+> http://example.com/paste/
+> The full path of ZeroBin on your webserver is:
+> /home/example.com/htdocs/paste
+> 
+> When setting the path like this:
+> define('PATH', '../../secret/zerobin/');
+> ZeroBin will look for your includes here:
+> /home/example.com/secret/zerobin
+
+### Using a database instead of flat files
+
+In the configuration file the `[model]` and `[model_options]` sections let you
+configure your favourite way of storing the pastes and discussions on your server.
+
+`zerobin_data` is the default model, which stores everything in files in the data
+folder. This is the recommended setup for most sites.
+
+Under high load, in distributed setups or if you are not allowed to store files
+locally, you might want to switch to the `zerobin_db` model. This lets you store
+your data in a database. Basically all databases that are supported by
+[PDO](http://php.net/manual/en/book.pdo.php) may be used. Automatic table
+creation is provided for `pdo_ibm`, `pdo_informix`, `pdo_mssql`, `pdo_mysql`,
+`pdo_oci`, `pdo_pgsql` and `pdo_sqlite`. You may want to provide a table prefix,
+if you have to share the zerobin database with another application. The table
+prefix option is called `tbl`.
+
+> #### Note
+> The "zerobin_db" model has only been tested with SQLite and MySQL, although it
+would not be recommended to use SQLite in a production environment. If you gain
+any experience running ZeroBin on other RDBMS, please let us know.
+
+For reference or if you want to create the table schema for yourself:
+
+    CREATE TABLE prefix_paste (
+        dataid CHAR(16) NOT NULL,
+        data BLOB,
+        postdate INT,
+        expiredate INT,
+        opendiscussion INT,
+        burnafterreading INT,
+        meta TEXT,
+        attachment MEDIUMBLOB,
+        attachmentname BLOB,
+        PRIMARY KEY (dataid)
+    );
+
+    CREATE TABLE prefix_comment (
+        dataid CHAR(16),
+        pasteid CHAR(16),
+        parentid CHAR(16),
+        data BLOB,
+        nickname BLOB,
+        vizhash BLOB,
+        postdate INT,
+        PRIMARY KEY (dataid)
+    );
+    CREATE INDEX parent ON prefix_comment(pasteid);
+
+    CREATE TABLE prefix_config (
+        id CHAR(16) NOT NULL, value TEXT, PRIMARY KEY (id)
+    );
+    INSERT INTO prefix_config VALUES('VERSION', '0.22');