Publify 8.0.2 - Security and bug fixes

Released Sunday September the 14th, Publify 8.0.2 is the result of a bug squashing session.

Thank you to our contributors Alexander Markov, Benoit C. Sirois, Hans de Graaff, Soon Van, Tor Helland and Nicolas Bianco.

CVE-2014-3211

Très Acton has discovered a risk of denial of service by memory exhaustion in the way Publify comments user input are parsed.

Other bugs

When using the more tag, articles content is displayed twice (#423 and #474)

The editor save bar jumps up and down when typing with inconsistent behavior (#428).

The help messages can't be hiden (#429)

Avatars in the Dashboard's last comments block are not inline with the comment. (#431)

Dashboard inbound links widget is broken (#432)

The admin / content search does not bring anything back (#433)

The content and page editor layout are not consistent (#442, #453)

When creating a post, tags are shown in white on white (#443)

The articles date picker does not allow to change the time the article is published (#444)

Using the articles date picker results in a 500 error (#445)

Marking content as spam using the thumb icon results in a 500 error (#447)

Media library: the JS refactoring removed the lightbox (#454)

Admin / sidebar: trying to remove a sidebar item does not work (#455, #473)

Admin / sidebar: the help box should be in a blue block (#456)

Lots of unused assets to clear (#475)

Cancel links are not displayed correctly (#482)

File upload is broken (#488)

Fixes link caching issue (All cached links are the same basically)

Use a relative image path for blogs installed outside of the site root

Fixes archives page caching

Feature and improvement

Improved Russian, Norwegian and French translations

Upgrade to Rails 3.2.18

Add support for a human.txt

Publify 8.0.1

This 8.0.1 release fixes the most important bugs we found since the 8.0 release.

• #398: the user-style.css stylesheet is not loaded in the Bootstrap theme
• #399: the note style is not applied.
• #402, #410, #411: deployment crashes on Heroku (thank you @slainer68 for fixing that).
• #412: the editor locally saves the content of the edited note, which means it reloads it when you edit another note, overwriting the legit content.

Publify 8.0

Publify 8.0

It's been 5 months since Publify 7.1, and considering the figures, Publify 8.0 is the biggest release we ever pushed in 9 years: 474 commits, 71 issues closed, 8 contributors, 567 files changed, 60,767 additions and 45,166 deletions.

But you probably don't care about numbers that much, except if you're wondering whether or not the project is till alive. TL; DR: it is.

The project itself has known one big change, moving from Fred's personal Github account to a dedicated organization. We have been thinking about it for a while, and we believe it's the best we could do for Publify.

Simpler, better, faster

Last summer, we started to rethink what we wanted Publify to be. At a time where online publishing is more or less split between Wordpress, hosted platforms and static engines, being "only" a blogging platform had no meaning anymore. We started to extend publishing capabilities, choosing Twitter pushed short notes as a first step before we add more content type. This led to Publify 7.0, and once again we knew it was the way to go.

Before adding these feature, we wanted Publify 8.0 to rebuild the whole user experience. It had to be simpler, clearer and better, far from the MS Word 97 style that prevails in Web publishing since more than 10 years.

This meant a simpler interface with a single, smaller menu, getting out of the old create / read / update / delete scheme when possible, merging some sections and finally removing lots of things. This also means using the most of large screens capabilities, using responsive layouts as much as we could, even though it made the job more difficult at some point.

The editor has been completely revamped, following the way opened by both Medium and Ghost. We've pushed aside everything that may distract you from writing. The post settings are one click away from the editor so you won't feel lost anyway. You can even go fullscreen and chose a dark or white background. We know how much work is left to get a really classy tool, but we're working on it.

The notes have also been improved. When replying to a tweet, Publify now displays the original tweet so readers can see the context of the reply.

Users' profiles have been improved to. Each user now has their own detailed page with avatar, contact links, short bio and indeed the published content.

Missing in action

The old categories vs. tags separation is no more. We merged the first into the second as a strict categorization has no real meaning on most blogs. Don't worry about your URLs, we took care of everything, creating the necessary redirects where needed.

The excerpt has been removed. Excerpt was meant to display a different content on the listing page and on the post itself. It was an interesting feature, but only a handful of people, if any, were using it, and it made the editor more complicated than necessary.

The old Typographic theme is not part of the core anymore. It has moved to its own project and will still be maintained.

The old XMLRPC backend has been discontinued. This means Publify does not support desktop clients anymore. This choice has been motivated by the fact that the APIs it was relying on had not been updated for 10 years, and that most desktop editors are not maintained anymore either. Web browsers' capabilities have evolved, and you can now have a fairly decent editor with local saving without the need for a desktop application.

Under the hood

Publify has been around for 9 years now. Rails was not 1.0 yet, and some of our code was older than you can ever imagine.

Publify 8.0 got rid of most of that legacy code. The old Prototype based helpers that made Rails famous back then left the building. Prototype itself has finally been replaced by jQuery, and Rails i18n allowed the Globalize based translation system to enjoy a deserved retirement. Most helpers have been removed too, as most of them were only used in one place.

This should not affect you unless you're running custom themes and plugins. If so, have a look at the Bootstrap theme to see how we're now working.

That's all folks, you can now download Publify, or give it a try on our demo platform.

Publify 7.1

This is our 60th release, we really want to thank our contributors who've been helping since Typo / Publify has been around.

Since Publify 7.0 release 8 days ago, a few bugs have been fixed:

• #246: added a migration to fix empty permalinks on article and empty guid on notes when they exist (may have been introduced by an old historical bug and they now make notes crash).
• #247: fixed a bug that made the application crash when saving a note would fail for any reason.
• #248: fixed a bug introduced by some heavy code cleaning that made feedback/article/xxx to crash.
• #252: fixed an old bug making comment creation from the admin crashing.

Publify 7.0

New features and enhancement

Notes and POSSE to Twitter

The most important feature of this new release is the addition of notes. Notes are (more or less) short statuses that were not long enough to deserve a full blog post. Notes come with their own feed you can find in /notes/ and can optionnaly be displayed on your Publify main feed. Notes have auto discovery for twitter account (@publify), hashtags (#publify) and links.

Notes can optionnaly be pushed to Twitter, with a perma short link back to the original content. They handle Twitter in reply context, so if you reply to a tweet, the original message will be displayed with a proper link just above yours. If the note and perma short link are short enough to fit into 140 characters, the link back is dislayed under the (foo.com something) form. Otherwise, the tweet is sent with a full link to the content.

Visual editor and self dogfooding

The visual editor and file manager were completely removed in the name of self dogfooding (issue #224 and #164). This was a hard to take decision, as we understand you may be reluctant to use the Markdown, Textile or plain HTML syntaxes. The reason why we finally removed it was simple: none of us would use it, so it was poorly implemented and tested and, for many points, broken.

Other features

• ##198: 404 errors are now handled by the themes instead of the application settings (change bd427c8).
• #219: Default theme now supports hentry Microformat (change 2671fd7)
• #224: Visual editor was removed. It may come back under another form later (change 8058ec5).
• Editor toolbar behaves according to the selected text filter (change c802f0a).
• Old, deprecated converters from Wordpress and Dotclear were removed (change 8f29f35).
• A new sidebar plugin displays the most popular posts.
• A new sidebar plugin displays the 5 latest published notes.
• URL shortener can now use a ustom domain (change 31573fa)
• A little revamping of the login / register / confirm / lost password / setup pages (change 1257ce2, 0bdfa85).
• Themes now can embed their own gems (change 373cfb8).
• Admin layout now behaves nicely with mobile devices (change 56cf701).
• Add very basic support for OpenGraph data (changes e7a60b1, changes 6240670). By Diego Elio Pettenò.
• Excerpts: pre-process the excerpts with the filter (change a636e23). By Diego Elio Pettenò.
• Added dynamic_form error_messages_for user created on signup page. (change 01f8ade). By Kyle Fazzari.
• Upgrade to Rails 3.2.13.
• Feed cleaning: don't append the subtitle to the page title (change 6bf9a5b). By Diego Elio Pettenò.

Thank you to all the contributors who helped improving the UI by pushing wording improvement or contributing to translation effort (Soon Van, Raman Sinha, mariozig, Geraud Puechaldou)

Bugs squashed

• #59: Articles were randomly rendered as password protected.
• #65: Saving articles may make them lose tags.
• #97 Dashboard crashing when fetching some RSS from Google alerts.
• #150: Theme crashing when displaying comments count
• #161, #162: Gemfile processing would crash because of YAML not being availale (change f3765d6).
• #163: Iconv gem was missing in Gemfile.
• #174: Articles using excerpt did not have the "continue reading" link (change b7839d2).
• #179: Fixes article deletion in admin. Solves
• #228: Changelog is meaningless.
• #237: Missing or incorrect labels on many forms.
• #239: Dashboard: marking a comment as spam should load the next non spammy comment.
• #240: On authors pages, links are rails escaped.
• Avoid resetting tags when posts are published via trigger (change f1e44c8). By Diego Elio Pettenò.
• Sqlite3 making Article.bestof crash (change 56ea99a).
• "Mark checked item as (Ham|Spam)" do what they're supposed to do (change 79c44a8). By Diego Elio Pettenò.
• Incorrect sprintf format in Norwegian translation in users/index.html.erb (change 40b823b). By Tor Helland.
• Article text filters would e reset on edit (change 1e820ef).
• Gravatar generated HTML did not validate correctly (change 05e1372).
• Incorrect migration versioning scheme (change 80ca76c, change 77a0039, change 7fc1bc0, change 318aec2 and change 0ffdae8). By David Ryder.
• The search plugin didn't echo the form_tag, which was deprecated in Rails 3.0 and unsupported in Rails 3.1. This fixes that. (change 4ff48a8)
• Inbound link widget on the dashboard did not work (change 0d64ba9).

Publify 7.0 beta 1

New features and enhancement

Notes and POSSE to Twitter

The most important feature of this new release is the addition of notes. Notes are (more or less) short statuses that were not long enough to deserve a full blog post. Notes come with their own feed you can find in /notes/ and can optionnaly be displayed on your Publify main feed. Notes have auto discovery for twitter account (@publify), hashtags (#publify) and links.

Notes can optionnaly be pushed to Twitter, with a perma short link back to the original content. They handle Twitter in reply context, so if you reply to a tweet, the original message will be displayed with a proper link just above yours. If the note and perma short link are short enough to fit into 140 characters, the link back is dislayed under the (foo.com something) form. Otherwise, the tweet is sent with a full link to the content.

Visual editor and self dogfooding

The visual editor and file manager were completely removed in the name of self dogfooding (issue #224 and #164). This was a hard to take decision, as we understand you may be reluctant to use the Markdown, Textile or plain HTML syntaxes. The reason why we finally removed it was simple: none of us would use it, so it was poorly implemented and tested and, for many points, broken.

Other features

• ##198: 404 errors are now handled by the themes instead of the application settings (change bd427c8).
• #219: Default theme now supports hentry Microformat (change 2671fd7)
• #224: Visual editor was removed. It may come back under another form later (change 8058ec5).
• Editor toolbar behaves according to the selected text filter (change c802f0a).
• Old, deprecated converters from Wordpress and Dotclear were removed (change 8f29f35).
• A new sidebar plugin displays the most popular posts.
• A new sidebar plugin displays the 5 latest published notes.
• URL shortener can now use a ustom domain (change 31573fa)
• A little revamping of the login / register / confirm / lost password / setup pages (change 1257ce2, 0bdfa85).
• Themes now can embed their own gems (change 373cfb8).
• Admin layout now behaves nicely with mobile devices (change 56cf701).
• Add very basic support for OpenGraph data (changes e7a60b1, changes 6240670). By Diego Elio Pettenò.
• Excerpts: pre-process the excerpts with the filter (change a636e23). By Diego Elio Pettenò.
• Added dynamic_form error_messages_for user created on signup page. (change 01f8ade). By Kyle Fazzari.
• Upgrade to Rails 3.2.13.
• Feed cleaning: don't append the subtitle to the page title (change 6bf9a5b). By Diego Elio Pettenò.

Thank you to all the contributors who helped improving the UI by pushing wording improvement or contributing to translation effort (Soon Van, Raman Sinha, mariozig, Geraud Puechaldou)

Bugs squashed

• #59: Articles were randomly rendered as password protected.
• #65: Saving articles may make them lose tags.
• #97 Dashboard crashing when fetching some RSS from Google alerts.
• #150: Theme crashing when displaying comments count
• #161, #162: Gemfile processing would crash because of YAML not being availale (change f3765d6).
• #163: Iconv gem was missing in Gemfile.
• #174: Articles using excerpt did not have the "continue reading" link (change b7839d2).
• #179: Fixes article deletion in admin. Solves
• Avoid resetting tags when posts are published via trigger (change f1e44c8). By Diego Elio Pettenò.
• Sqlite3 making Article.bestof crash (change 56ea99a).
• "Mark checked item as (Ham|Spam)" do what they're supposed to do (change 79c44a8). By Diego Elio Pettenò.
• Incorrect sprintf format in Norwegian translation in users/index.html.erb (change 40b823b). By Tor Helland.
• Article text filters would e reset on edit (change 1e820ef).
• Gravatar generated HTML did not validate correctly (change 05e1372).
• Incorrect migration versioning scheme (change 80ca76c, change 77a0039, change 7fc1bc0, change 318aec2 and change 0ffdae8). By David Ryder.
• The search plugin didn't echo the form_tag, which was deprecated in Rails 3.0 and unsupported in Rails 3.1. This fixes that. (change 4ff48a8)
• Inbound link widget on the dashboard did not work (change 0d64ba9).