Release 1.6.5

• SECURITY: Escape data when listing available plugins
• FIX: Fix typo in apicalls.js which prevented importing isValidJSONPName
• FIX: fixed plugin dependency issue
• FIX: Update iframe_editor.css
• FIX: unbreak Safari iOS line wrapping

Version 1.6.4

Password check fix

1.6.3

• SECURITY: Update ejs
• SECURITY: xss vulnerability when reading window.location.href
• SECURITY: sanitize jsonp
• NEW: Catch SIGTERM for graceful shutdown
• NEW: Show actual applied text formatting for caret position
• NEW: Add settings to improve scrolling of viewport on line changes

1.6.2

• NEW: Added pad shortcut disabling feature
• NEW: Create option to automatically reconnect after a few seconds
• Update: socket.io to 1.7.3
• Update: l10n lib
• Update: request to 2.83.0
• Update: Node for windows to 8.9.0
• Fix: minification of code

Etherpad v1.6.1

• NEW: Hook aceRegisterNonScrollableEditEvents to register events that shouldn't scroll
• NEW: Added 'item' parameter to registerAceCommand Hook
• NEW: Added LibreJS support
• Fix: Crash on malformed export url
• Fix: Re-enable editor after user is reconnected to server
• Fix: minification
• Other: Added 'no-referrer' for all pads
• Other: Improved cookie security
• Other: Fixed compatibility with nodejs 7
• Other: Updates
  • socket.io to 1.6.0
  • express to 4.13.4
  • express-session to 1.13.0
  • clean-css to 3.4.12
  • uglify-js to 2.6.2
  • log4js to 0.6.35
  • cheerio to 0.20.0
  • ejs to 2.4.1
  • graceful-fs to 4.1.3
  • semver to 5.1.0
  • unorm to 1.4.1
  • jsonminify to 0.4.1
  • measured to 1.1.0
  • mocha to 2.4.5
  • supertest to 1.2.0
  • npm to 4.0.2
  • Node.js for Windows to 6.9.2

Etherpad v1.6.0

• SECURITY: Fix a possible xss attack in iframe link
• NEW: Add a aceSelectionChanged hook to allow plugins to react when the cursor location changes.
• NEW: Accepting Arrays on 'exportHtmlAdditionalTags' to handle attributes stored as ['key', 'value']
• NEW: Allow admin to run on a sub-directory
• NEW: Support version 5 of node.js
• NEW: Update windows build to node version 4.4.3
• NEW: Create setting to control if a new line will be indented or not
• NEW: Add an appendText API
• NEW: Allow LibreOffice to be used when exporting a pad
• NEW: Create hook exportHtmlAdditionalTagsWithData
• NEW: Improve DB migration performance
• NEW: allow settings to be applied from the filesystem
• NEW: remove applySettings hook and allow credentials.json to be part of core
• NEW: Use exec to switch to node process
• NEW: Validate incoming color codes
• Fix: Avoid space removal when pasting text from word processor.
• Fix: Removing style that makes editor scroll to the top on iOS without any action from the user
• Fix: Fix API call appendChatMessage to send new message to all connected clients
• Fix: Timeslider "Return to pad" button
• Fix: Generating pad HTML with tags like instead of TAG:VALUE
• Fix: Get git commit hash even if the repo only points to a bare repo.
• Fix: Fix decode error if pad name contains special characters and is sanitized
• Fix: Fix handleClientMessage_USER_* payloads not containing user info
• Fix: Set language cookie on initial load
• Fix: Timeslider Not Translated
• Other: set charset for mysql connection in settings.json
• Other: Dropped support for io.js
• Other: Add support to store credentials in credentials.json
• Other: Support node version 4 or higher
• Other: Update uberDB to version 0.3.0

Etherpad v1.5.7

• NEW: Add support for intermediate CA certificates for ssl
• NEW: Provide a script to clean up before running etherpad
• NEW: Use ctrl+shift+1 to do a ordered list
• NEW: Show versions of plugins on startup
• NEW: Add author on padCreate and padUpdate hook
• Fix: switchToPad method
• Fix: Dead keys
• Fix: Preserve new lines in copy-pasted text
• Fix: Compatibility mode on IE
• Fix: Content Collector to get the class of the DOM-node
• Fix: Timeslider export links
• Fix: Double prompt on file upload
• Fix: setText() replaces the entire pad text
• Fix: Accessibility features on embedded pads
• Fix: Tidy HTML before abiword conversion
• Fix: Remove edit buttons in read-only view
• Fix: Disable user input in read-only view
• Fix: Pads end with a single newline, rather than two newlines
• Fix: Toolbar and chat for mobile devices

Release 1.5.6

• Fix: Error on windows installations

Release 1.5.5

• SECURITY: Also don't allow read files on directory traversal on minify path
• NEW: padOptions can be set in settings.json now
• Fix: Add check for special characters in createPad API function
• Fix: Middle click on a link in firefox
• Fix: Made setPadRaw async to import larger etherpad files
• Fix: rtl
• Fix: Problem in older IEs
• Other: Update to express 4.x
• Other: Dropped support for node 0.8
• Other: Update ejs to version 2.x
• Other: Moved sessionKey from settings.json to a new auto-generated SESSIONKEY.txt file

Release 1.5.4

• SECURITY: Also don't allow read files on directory traversal on frontend tests path