PrivateBin Files

This release removes the bootstrap (3) template.

The most notable change is the complete removal of jQuery from the frontend, replaced by vanilla JavaScript. This also required dropping support for Bootstrap 3, which depended on jQuery. This release also introduces the first regional translation of traditional Chinese (zh-TW) in addition to Chinese (zh). Support for the Chhoto URL shortener has also been added to the shortener proxy.

On the security side, browsers are now prevented from guessing MIME types on JSON(LD) API responses, CSS classes and inline styles are stripped from Markdown HTML, and several potential issues in comment file handling have been fixed. A subject line is now included in the "Email" share button's mailto link, and Ctrl+S / Cmd+S will send the document. This release also addresses issues with insufficient markdown HTML sanitization. More details on this issue can be found in the security advisory:

• Insufficient Markdown/HTML Sanitization enables Deceptive Popups due to Bootstrap classes

Update procedure

The minimum required PHP version is still 7.4 with the zlib extension, GD, OPcache and PDO extensions are only required for using certain features.

If you have created your own cfg/conf.php file, please check the following entries and update them accordingly:

• section [main], key template: If set to bootstrap replace this with bootstrap5 (see cfg/conf.sample.php (github.com)).

As usual, you can download the archive for a manual upgrade and can find more details in the installation instructions.

We also offer a container images using the nginx web server with php-fpm and one using the FreeUnit application server, that include the recommended secure setup with the non-essential files and data outside of the web servers document root.

Changes since version 2.0.6

• ADDED: Added shortenviachhoto endpoint with an chhoto configuration section
• ADDED: Translation for Chinese (Traditional)
• ADDED: Subject line to the "Email" share button's mailto link (#928)
• ADDED: Send the document with Ctrl+S, or Cmd+S on macOS (#739)
• CHANGED: We removed jQuery in the Frontend and replaced it with vanilla JS.
• CHANGED: Removed the unmaintained js-verify and replaced it with fast-check library.
• CHANGED: Added a jsconfig.json in order to check the types of JavaScript.
• CHANGED: Removed support for Bootstrap 3 as it requires jQuery.
• CHANGED: Encode documents with TextEncoder in compress(), instead of the utf16To8() percent-encoding round trip, which allocated ~20 times the payload
• CHANGED: Upgrading libraries to: DOMpurify 3.4.17, ip-lib 1.22.1 & polyfill-php80 1.43.0
• FIXED: Decode decompressed documents with TextDecoder instead of utf8To16(), which allocated ~3.4 GB for a 100 MB document and killed the tab (#2027)
• FIXED: Prevent browsers guessing MIME types on JSON(LD) API responses (#164)
• FIXED: Insert quoted base path into JSON-LD documents
• FIXED: Several potential issues in handling comment files (#1901)
• FIXED: Sanitize Markdown HTML from CSS classes & styles

Help wanted & greatly appreciated

Apart from the large tasks that require deeper insight and time, there are also smaller issues were help is wanted, topics open to debate and of course many languages that still remain to be translated. We are also still looking for additional long term maintainers among our frequent issue helpers.

What can we offer you in return for your help?

• We can offer you our mentorship, if this is your first time participating as a maintainer of an open source software project. We can guide you through submitting your first pull requests and work with you to ensure your change fulfils the communities quality standards, gets merged and makes it into a release.
• Your work gets publicly credited. This can help you build up a resume, showing off your growing skill set, in programming as well as your soft skills.
• PrivateBin is a smaller project. If you'd like to learn how to participate and contribute in an open source git project, this should be less overwhelming than larger projects.
• We do have a decent unit test code coverage, so it is an environment forgiving of mistakes. You may still introduce logical flaws or issues in new features, not yet covered in the tests, but you can rely on the tests preventing any regressions in other areas.
• You don't have to be proficient in multiple programming languages, there are a lot of things to improve within either the JavaScript or PHP areas that don't need you to understand the other side, beyond their shared API.
• It can be an opportunity to learn about continuous integration tools to automate tasks like tests, security scans, etc.
• We do support the use of LLM and other AI tools, but expect a human to remain in the loop. It can be an opportunity to learn using such tools.

If you are interested in helping with any of these points, we have prepared a development guide including design goals, code structure and tools to get you started. For any questions, you can chat with the maintainers in the discussion area or reach us via email.