Changelog

CHANGELOG.md

@@ -11,6 +11,7 @@ See also [the FreshRSS releases](https://github.com/FreshRSS/FreshRSS/releases).
 		* Passing `*` allows all networks like before (unsafe)
 	* Improve SSRF mitigations by restricting `CURLOPT_PROXY` [#8950](https://github.com/FreshRSS/FreshRSS/pull/8950)
 	* Fix auth CSRFs (login and register actions) [#9171](https://github.com/FreshRSS/FreshRSS/pull/9171)
+	* Log invalid challenge and ignore JSON error during login [#9278](https://github.com/FreshRSS/FreshRSS/pull/9278)
 	* Disallow fetching of non remote URI [#9215](https://github.com/FreshRSS/FreshRSS/pull/9215)
 	* Only allow HTTP/HTTPS schemes for enclosure and thumbnail URLs [#9272](https://github.com/FreshRSS/FreshRSS/pull/9272)
 	* Fix access control in `rss` and `opml` actions [#8912](https://github.com/FreshRSS/FreshRSS/pull/8912)
@@ -21,9 +22,11 @@ See also [the FreshRSS releases](https://github.com/FreshRSS/FreshRSS/releases).
 	* Sanitize all fields during JSON import [#9168](https://github.com/FreshRSS/FreshRSS/pull/9168)
 	* Gate `greader` (JSON) user query share format behind *Share by OPML* [#9248](https://github.com/FreshRSS/FreshRSS/pull/9248)
 	* Public OPML should not contain cURL parameters [#9070](https://github.com/FreshRSS/FreshRSS/pull/9070)
+	* Ignore security-relevant OPML attributes for dynamic OPML sources [#9276](https://github.com/FreshRSS/FreshRSS/pull/9276)
 	* Strip feed URL credentials from anonymous user query output [#9246](https://github.com/FreshRSS/FreshRSS/pull/9246)
 	* Set limits for regex during search [#8913](https://github.com/FreshRSS/FreshRSS/pull/8913)
 	* Fix path disclosure in cache error message [#9206](https://github.com/FreshRSS/FreshRSS/pull/9206)
+	* Limit the length and parentheses nesting depth of a search query [#9277](https://github.com/FreshRSS/FreshRSS/pull/9277)
 	* Use timing-safe comparison for tokens [#8945](https://github.com/FreshRSS/FreshRSS/pull/8945)
 	* Use `hash_equals()` for GReader API token comparison [#9183](https://github.com/FreshRSS/FreshRSS/pull/9183)
 	* Mailer: allow disabling SMTPAutoTLS via config [#9026](https://github.com/FreshRSS/FreshRSS/pull/9026)

CREDITS.md

@@ -14,6 +14,7 @@ People are sorted by name so please keep this order.
 * [aarnej](https://github.com/aarnej): [contributions](https://github.com/FreshRSS/FreshRSS/pulls?q=is:pr+author:aarnej)
 * [Aaron Schif](https://github.com/aaronschif): [contributions](https://github.com/FreshRSS/FreshRSS/pulls?q=is:pr+author:aaronschif)
 * [Adam Stephens](https://github.com/adamcstephens): [contributions](https://github.com/FreshRSS/FreshRSS/pulls?q=is:pr+author:adamcstephens)
+* [AdamKorcz](https://github.com/0xdeadrelay): [contributions](https://github.com/FreshRSS/FreshRSS/pulls?q=is:pr+author:0xdeadrelay)
 * [Adrien Dorsaz](https://github.com/Trim): [contributions](https://github.com/FreshRSS/FreshRSS/pulls?q=is:pr+author:Trim), [Web](https://adorsaz.ch/)
 * [Aidi Stan](https://github.com/aidistan): [contributions](https://github.com/FreshRSS/FreshRSS/pulls?q=is:pr+author:aidistan), [Web](https://aidistan.site/)
 * [ale-rt](https://github.com/ale-rt): [contributions](https://github.com/FreshRSS/FreshRSS/pulls?q=is:pr+author:ale-rt)