diff --git a/CHANGES.md b/CHANGES.md new file mode 100644 index 0000000000..ca2ff1b780 --- /dev/null +++ b/CHANGES.md @@ -0,0 +1,66 @@ +# Apache Roller — Changes + +## 6.1.6 + +A maintenance release. Users of 6.1.5 and earlier are encouraged to upgrade. + +### Behaviour changes worth reading before upgrading + +Three features are retired in this release. Each was optional or long obsolete, +but if you rely on one, plan for it: + +- **Incoming Trackback support is removed.** The Trackback endpoint no longer + exists and is unmapped from `web.xml`. Sites that accepted Trackback pings + will stop accepting them. `TrackbackLinkbackCommentValidator` is retained as + an inert validator so an existing configuration that names it still starts. +- **Outbound Trackback is removed.** The entry editor no longer sends + Trackbacks, and the associated action and screen are gone. +- **WSSE AtomPub authentication is retired.** `authentication.method` now + accepts `basic` and `oauth`. An installation configured for `wsse` will fail + closed on startup rather than silently falling back — change the setting + before upgrading. + +Two more changes are visible in normal use: + +- **Media file content types are derived from file content** rather than the + upload request, so a file whose declared type disagrees with its contents is + now stored and served by what it actually is. +- **Enclosure metadata is stored as submitted.** Adding an enclosure no longer + fetches the remote URL to discover its type and length; both are taken from + the media file or the submitted values. + +### Improvements + +- Authoring resource lookups are scoped to the weblog the action is operating + on. +- XML-RPC Blogger and MetaWeblog handlers check the caller's weblog permission + per method, and answer a disabled endpoint before doing any authentication + work. +- Vendor extension types are disabled on the XML-RPC servlet. +- OAuth authorization is bound to the current Roller session, and approval is + one-shot. +- The CSRF filters keep the submitted salt and the salt issued for the response + separate. +- Weblog template resources resolve within the active theme. +- Front-page selection moved into the administrator setup workflow, and + front-page directory parameters are normalized before the bundled theme + renders them. +- Authoring UI event handlers moved from inline JavaScript onto data + attributes. +- Bookmark and configuration parsing share a single JDOM builder that treats a + document strictly as data. + +### Build and packaging + +- `assembly-release/sign-release.sh` takes the version and optional release + candidate suffix as arguments, requires the signing key to be named through + `ROLLER_SIGNING_KEY`, refuses a key that is not RSA-4096 or stronger, and + writes SHA-512 and SHA-256 in `shasum(1)` format. +- Four third-party jars are no longer shipped in the source distribution under + `docs/examples/scripting/`. The examples' README files say where to obtain + them. + +## Earlier releases + +Release notes for 6.1.5 and earlier are in the announcements archived at +. diff --git a/docs/examples/scripting/bsf/README.txt b/docs/examples/scripting/bsf/README.txt index 3ceb14107e..64947717cf 100644 --- a/docs/examples/scripting/bsf/README.txt +++ b/docs/examples/scripting/bsf/README.txt @@ -4,7 +4,8 @@ Some experiments with using BSF to enable scripting in Roller templates. To use it in Roller: -1) Put roller-scripting.jar and bsf.jar in WEB-INF/lib +1) Put roller-scripting.jar and bsf.jar in WEB-INF/lib. bsf.jar is not + distributed with Roller; download Apache BSF and use the jar from it. 2) Add the jars necessary JavaScript, Groovy or JRuby to WEB-INF/lib diff --git a/docs/examples/scripting/bsf/lib/bsf.jar b/docs/examples/scripting/bsf/lib/bsf.jar deleted file mode 100644 index 3028967306..0000000000 Binary files a/docs/examples/scripting/bsf/lib/bsf.jar and /dev/null differ diff --git a/docs/examples/scripting/groovy/examples/adminprotocol/README.txt b/docs/examples/scripting/groovy/examples/adminprotocol/README.txt index 3faa6efc7e..8f359af24d 100644 --- a/docs/examples/scripting/groovy/examples/adminprotocol/README.txt +++ b/docs/examples/scripting/groovy/examples/adminprotocol/README.txt @@ -8,7 +8,9 @@ Roller Admin Protocol (RAP). 1) Have Groovy 1.0 installed on your system -2) Put the RAP SDK, JDOM and Commons Codec jars in your classpath. For example: +2) Put the RAP SDK, JDOM and Commons Codec jars in your classpath. These are + not distributed with Roller; download them and place them in ./lib, or point + the classpath at wherever you keep them. For example: $ export CLASSPATH=./lib/jdom.jar:./lib/roller-rap-sdk.jar:./lib/commons-codec-1.3.jar diff --git a/docs/examples/scripting/groovy/examples/adminprotocol/lib/commons-codec-1.3.jar b/docs/examples/scripting/groovy/examples/adminprotocol/lib/commons-codec-1.3.jar deleted file mode 100644 index 957b6752af..0000000000 Binary files a/docs/examples/scripting/groovy/examples/adminprotocol/lib/commons-codec-1.3.jar and /dev/null differ diff --git a/docs/examples/scripting/groovy/examples/adminprotocol/lib/jdom.jar b/docs/examples/scripting/groovy/examples/adminprotocol/lib/jdom.jar deleted file mode 100644 index 288e64cb5c..0000000000 Binary files a/docs/examples/scripting/groovy/examples/adminprotocol/lib/jdom.jar and /dev/null differ diff --git a/docs/examples/scripting/groovy/examples/adminprotocol/lib/roller-rap-sdk.jar b/docs/examples/scripting/groovy/examples/adminprotocol/lib/roller-rap-sdk.jar deleted file mode 100644 index cde09e43ef..0000000000 Binary files a/docs/examples/scripting/groovy/examples/adminprotocol/lib/roller-rap-sdk.jar and /dev/null differ