Updated version and assets for release v26.05.1

This is to reduce the amount of content which will be logged, since
these messages don't really indicate an actual system error but advise
the user of something which went wrong with their request.

.github/translators.txt

@@ -544,3 +544,5 @@ FelixFrizzy :: German
 Pedro de Mattia (pdmtt) :: Portuguese, Brazilian
 lonestan :: Russian
 Paul Kernstock (kernstock) :: German
+brtbr :: German; German Informal
+Ricardo Covelo (covelo12) :: Portuguese

.gitignore

@@ -9,10 +9,10 @@ Homestead.yaml
 .idea
 npm-debug.log
 yarn-error.log
-/public/dist
+/public/dist/*.map
 /public/plugins
-/public/css
-/public/js
+/public/css/*.map
+/public/js/*.map
 /public/bower
 /public/build/
 /public/favicon.ico

app/Access/Controllers/MfaHardwareKeyController.php

@@ -1,133 +0,0 @@
-<?php
-
-namespace BookStack\Access\Controllers;
-
-use BookStack\Access\LoginService;
-use BookStack\Access\Mfa\BackupCodeService;
-use BookStack\Access\Mfa\MfaSession;
-use BookStack\Access\Mfa\MfaValue;
-use BookStack\Access\Mfa\MfaVerificationLimiter;
-use BookStack\Activity\ActivityType;
-use BookStack\Exceptions\NotFoundException;
-use BookStack\Http\Controller;
-use Cose\Algorithms;
-use Exception;
-use Illuminate\Http\Request;
-use Illuminate\Validation\ValidationException;
-use Symfony\Component\Serializer\Encoder\JsonEncode;
-use Symfony\Component\Serializer\Normalizer\AbstractObjectNormalizer;
-use Webauthn\AttestationStatement\AttestationStatementSupportManager;
-use Webauthn\AttestationStatement\NoneAttestationStatementSupport;
-use Webauthn\AuthenticatorSelectionCriteria;
-use Webauthn\Denormalizer\WebauthnSerializerFactory;
-use Webauthn\PublicKeyCredentialCreationOptions;
-use Webauthn\PublicKeyCredentialOptions;
-use Webauthn\PublicKeyCredentialParameters;
-use Webauthn\PublicKeyCredentialRpEntity;
-use Webauthn\PublicKeyCredentialUserEntity;
-
-class MfaHardwareKeyController extends Controller
-{
-    use HandlesPartialLogins;
-
-    protected const SETUP_SECRET_SESSION_KEY = 'mfa-setup-hardware-key-secret';
-
-    public function __construct(
-        protected MfaVerificationLimiter $limiter,
-    ) {
-    }
-
-    /**
-     * Show a view that allows configuration of a hardware key.
-     */
-    public function generate(BackupCodeService $codeService)
-    {
-
-        $domain = parse_url(url('/'), PHP_URL_HOST);
-        $rpEntity = PublicKeyCredentialRpEntity::create(
-            setting('app-name'),
-            $domain,
-        );
-
-        $user = $this->currentOrLastAttemptedUser();
-        // TODO - Ensure user ID is somewhat long and random
-        // See: https://webauthn-doc.spomky-labs.com/prerequisites/user-entity
-        // Maybe hash of (app-id from settings + user id)
-        // Or maybe a UUID/random_string which we connect via DB entry?
-        $userEntity = PublicKeyCredentialUserEntity::create(
-            $user->slug,
-            $user->id,
-            $user->name,
-        );
-
-        $publicKeyCredentialParametersList = [
-            PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_ES256K), // More interesting algorithm
-            PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_ES256),  //      ||
-            PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_RS256),  //      ||
-            PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_PS256),  //      \/
-            PublicKeyCredentialParameters::create('public-key', Algorithms::COSE_ALGORITHM_ED256),  // Less interesting algorithm
-        ];
-
-        $credentialOptions = PublicKeyCredentialCreationOptions::create(
-            $rpEntity,
-            $userEntity,
-            random_bytes(32),
-            $publicKeyCredentialParametersList,
-            hints: [
-                PublicKeyCredentialOptions::HINT_SECURITY_KEY,
-            ],
-            timeout: 60000, // 1 minute
-            authenticatorSelection: AuthenticatorSelectionCriteria::create(
-                userVerification: AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED,
-            )
-        );
-
-        $attestationStatementSupportManager = AttestationStatementSupportManager::create();
-        $attestationStatementSupportManager->add(NoneAttestationStatementSupport::create());
-        $factory = new WebauthnSerializerFactory($attestationStatementSupportManager);
-        $serializer = $factory->create();
-        $jsonOptions = $serializer->serialize(
-            $credentialOptions,
-            'json',
-            [
-                AbstractObjectNormalizer::SKIP_NULL_VALUES => true,
-                JsonEncode::OPTIONS => JSON_THROW_ON_ERROR,
-            ]
-        );
-
-        // TODO - Change
-        $this->setPageTitle(trans('auth.mfa_gen_hardware_key_title'));
-
-        return view('mfa.hardware-key-generate', [
-            'options' => $jsonOptions,
-        ]);
-    }
-
-    /**
-     * Confirm the setup of a hardware key, storing the key value against the user.
-     *
-     * @throws Exception
-     */
-    public function confirm()
-    {
-
-
-        return redirect('/mfa/setup');
-    }
-
-    /**
-     * Verify the MFA method submission on check.
-     *
-     * @throws NotFoundException
-     * @throws ValidationException
-     */
-    public function verify(Request $request, MfaSession $mfaSession, LoginService $loginService)
-    {
-        $user = $this->currentOrLastAttemptedUser();
-        $this->limiter->incrementAttempts($user, $request);
-        if ($this->limiter->hasHitLimit($user, $request)) {
-            $this->clearLastAttemptedUser();
-            $this->limiter->throwException();
-        }
-    }
-}

app/Access/Mfa/MfaValue.php

@@ -23,14 +23,13 @@ class MfaValue extends Model
 
     const METHOD_TOTP = 'totp';
     const METHOD_BACKUP_CODES = 'backup_codes';
-    const METHOD_HARDWARE_KEY = 'hardware_key';
 
     /**
      * Get all the MFA methods available.
      */
     public static function allMethods(): array
     {
-        return [self::METHOD_TOTP, self::METHOD_BACKUP_CODES, self::METHOD_HARDWARE_KEY];
+        return [self::METHOD_TOTP, self::METHOD_BACKUP_CODES];
     }
 
     /**

app/Exceptions/Handler.php

@@ -25,6 +25,7 @@ class Handler extends ExceptionHandler
     protected $dontReport = [
         NotFoundException::class,
         StoppedAuthenticationException::class,
+        NotifyException::class,
     ];
 
     /**

app/Exceptions/NotifyException.php

@@ -6,18 +6,22 @@ use Exception;
 use Illuminate\Contracts\Support\Responsable;
 use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
 
+/**
+ * An exception that is thrown to notify the user of something which went wrong.
+ * Typically these should be translated messages since they will be shown to the end user
+ * via a pop up notification error message in the UI.
+ *
+ * This exception is not intended to be used for internal system/application errors,
+ * and therefore will not be logged by the exception handler.
+ */
 class NotifyException extends Exception implements Responsable, HttpExceptionInterface
 {
-    public $message;
-    public string $redirectLocation;
-    protected int $status;
-
-    public function __construct(string $message, string $redirectLocation = '/', int $status = 500)
-    {
+    public function __construct(
+        string $message,
+        public string $redirectLocation = '/',
+        protected int $status = 500
+    ) {
         $this->message = $message;
-        $this->redirectLocation = $redirectLocation;
-        $this->status = $status;
-
         parent::__construct();
     }
 

app/Search/SearchRunner.php

@@ -290,7 +290,7 @@ class SearchRunner
                 $query->where('name', '=', $tagParts['name']);
             }
 
-            if (is_numeric($tagParts['value']) && $tagParts['operator'] !== 'like') {
+            if (is_numeric($tagParts['value']) && is_finite($tagParts['value']) && $tagParts['operator'] !== 'like') {
                 // We have to do a raw sql query for this since otherwise PDO will quote the value and MySQL will
                 // search the value as a string which prevents being able to do number-based operations
                 // on the tag values. We ensure it has a numeric value and then cast it just to be sure.

app/Uploads/Controllers/AttachmentController.php

@@ -107,6 +107,9 @@ class AttachmentController extends Controller
     {
         /** @var Attachment $attachment */
         $attachment = Attachment::query()->findOrFail($attachmentId);
+        $this->checkOwnablePermission(Permission::PageView, $attachment->page);
+        $this->checkOwnablePermission(Permission::PageUpdate, $attachment->page);
+        $this->checkOwnablePermission(Permission::AttachmentUpdate, $attachment);
 
         try {
             $this->validate($request, [
@@ -120,10 +123,6 @@ class AttachmentController extends Controller
             ]), 422);
         }
 
-        $this->checkOwnablePermission(Permission::PageView, $attachment->page);
-        $this->checkOwnablePermission(Permission::PageUpdate, $attachment->page);
-        $this->checkOwnablePermission(Permission::AttachmentUpdate, $attachment);
-
         $attachment = $this->attachmentService->updateFile($attachment, [
             'name' => $request->input('attachment_edit_name'),
             'link' => $request->input('attachment_edit_url'),
@@ -142,6 +141,10 @@ class AttachmentController extends Controller
     public function attachLink(Request $request)
     {
         $pageId = $request->input('attachment_link_uploaded_to');
+        $page = $this->pageQueries->findVisibleByIdOrFail($pageId);
+
+        $this->checkPermission(Permission::AttachmentCreateAll);
+        $this->checkOwnablePermission(Permission::PageUpdate, $page);
 
         try {
             $this->validate($request, [
@@ -156,11 +159,6 @@ class AttachmentController extends Controller
             ]), 422);
         }
 
-        $page = $this->pageQueries->findVisibleByIdOrFail($pageId);
-
-        $this->checkPermission(Permission::AttachmentCreateAll);
-        $this->checkOwnablePermission(Permission::PageUpdate, $page);
-
         $attachmentName = $request->input('attachment_link_name');
         $link = $request->input('attachment_link_url');
         $this->attachmentService->saveNewFromLink($attachmentName, $link, intval($pageId));

app/Util/HtmlContentFilter.php

@@ -2,6 +2,7 @@
 
 namespace BookStack\Util;
 
+use BookStack\Util\HtmlPurifier\ConfiguredHtmlPurifier;
 use DOMAttr;
 use DOMElement;
 use DOMNodeList;

app/Util/HtmlPurifier/ConfiguredHtmlPurifier.php

@@ -1,13 +1,15 @@
 <?php
 
-namespace BookStack\Util;
+namespace BookStack\Util\HtmlPurifier;
 
 use BookStack\App\AppVersion;
+use BookStack\Util\HtmlPurifier\Filters\UriLimitFileProtocolToAnchors;
 use HTMLPurifier;
 use HTMLPurifier_Config;
 use HTMLPurifier_DefinitionCache_Serializer;
 use HTMLPurifier_HTML5Config;
 use HTMLPurifier_HTMLDefinition;
+use HTMLPurifier_URIDefinition;
 
 /**
  * Provides a configured HTML Purifier instance.
@@ -33,7 +35,13 @@ class ConfiguredHtmlPurifier
 
         $htmlDef = $config->getDefinition('HTML', true, true);
         if ($htmlDef instanceof HTMLPurifier_HTMLDefinition) {
-            $this->configureDefinition($htmlDef);
+            $this->configureHtmlDefinition($htmlDef);
+        }
+
+        /** @var \HTMLPurifier_URIDefinition $uriDef */
+        $uriDef = $config->getDefinition('URI', true, true);
+        if ($uriDef instanceof HTMLPurifier_URIDefinition) {
+            $this->configureUriDefinition($uriDef);
         }
 
         $this->purifier = new HTMLPurifier($config);
@@ -91,7 +99,7 @@ class ConfiguredHtmlPurifier
          // $config->set('Cache.DefinitionImpl', null); // Disable cache during testing
     }
 
-    public function configureDefinition(HTMLPurifier_HTMLDefinition $definition): void
+    protected function configureHtmlDefinition(HTMLPurifier_HTMLDefinition $definition): void
     {
         // Allow the object element
         $definition->addElement(
@@ -151,6 +159,11 @@ class ConfiguredHtmlPurifier
         $definition->addAttribute('a', 'data-mention-user-id', 'Number');
     }
 
+    protected function configureUriDefinition(HTMLPurifier_URIDefinition $definition): void
+    {
+        $definition->registerFilter(new UriLimitFileProtocolToAnchors());
+    }
+
     public function purify(string $html): string
     {
         return $this->purifier->purify($html);

app/Util/HtmlPurifier/Filters/UriLimitFileProtocolToAnchors.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace BookStack\Util\HtmlPurifier\Filters;
+
+use HTMLPurifier_Config;
+use HTMLPurifier_Context;
+use HTMLPurifier_URI;
+use HTMLPurifier_URIFilter;
+
+/**
+ * Limits file:// URIs to only be used on anchor tags href attributes.
+ * This prevents use on iframes/embeds/images where they can be used to load external
+ * content on the network, triggering calls which may include NTLM auth hashes when in
+ * certain windows based environments.
+ */
+class UriLimitFileProtocolToAnchors extends HTMLPurifier_URIFilter
+{
+    /**
+     * @type string
+     */
+    public $name = 'LimitFileProtocolToAnchors';
+
+    /**
+     * @type bool
+     */
+    public $always_load = true;
+
+    /**
+     * @param HTMLPurifier_URI $uri
+     * @param HTMLPurifier_Config $config
+     * @param HTMLPurifier_Context $context
+     * @return bool
+     */
+    public function filter(&$uri, $config, $context)
+    {
+        // Ensure we're only filtering file:// URIs'
+        if ($uri->scheme !== 'file') {
+            return true;
+        }
+
+        $token = $context->get('CurrentToken', true);
+        $attr = $context->get('CurrentAttr', true);
+
+        // Only allow if used on hrefs on anchor tags
+        $isAnchor = $token && $token->name === 'a';
+        $isHref = $attr === 'href';
+        if ($isAnchor && $isHref) {
+            return true;
+        }
+
+        return false;
+    }
+}
+
+// vim: et sw=4 sts=4

composer.json

@@ -40,7 +40,6 @@
         "socialiteproviders/okta": "^4.2",
         "socialiteproviders/twitch": "^5.3",
         "ssddanbrown/htmldiff": "^2.0.0",
-        "web-auth/webauthn-lib": "^5.3",
         "xemlock/htmlpurifier-html5": "^0.1.12"
     },
     "require-dev": {

dev/checksums/vendor

@@ -1 +1 @@
-22e02ee72d21ff719c1073abbec8302f8e2096ba6d072e133051064ed24b45b1
+6d63a835dedf1b2052ca5ca38f2b00f393548763f15c28c8ba18c0fabc1e0299

dev/licensing/js-library-licenses.txt

@@ -482,8 +482,8 @@ electron-to-chromium
 License: ISC
 License File: node_modules/electron-to-chromium/LICENSE
 Copyright: Copyright 2018 Kilian Valkhof
-Source: git+https://github.com/kilian/electron-to-chromium.git
-Link: git+https://github.com/kilian/electron-to-chromium.git
+Source: git+https://github.com/Kilian/electron-to-chromium.git
+Link: git+https://github.com/Kilian/electron-to-chromium.git
 -----------
 emittery
 License: MIT
@@ -860,7 +860,7 @@ License: MIT
 License File: node_modules/handlebars/LICENSE
 Copyright: Copyright (C) 2011-2019 by Yehuda Katz
 Source: https://github.com/handlebars-lang/handlebars.js.git
-Link: https://www.handlebarsjs.com/
+Link: https://handlebarsjs.com/
 -----------
 has-bigints
 License: MIT
@@ -1663,13 +1663,6 @@ Copyright: Copyright (c) Stephen Sugden <**@*************.***> (stephensugden.co
 Source: grncdr/merge-stream
 Link: grncdr/merge-stream
 -----------
-micromatch
-License: MIT
-License File: node_modules/micromatch/LICENSE
-Copyright: Copyright (c) 2014-present, Jon Schlinkert.
-Source: micromatch/micromatch
-Link: https://github.com/micromatch/micromatch
------------
 mimic-fn
 License: MIT
 License File: node_modules/mimic-fn/license
@@ -3574,13 +3567,6 @@ Copyright: Copyright (c) 2017-present Devon Govett
 Source: https://github.com/parcel-bundler/watcher.git
 Link: https://github.com/parcel-bundler/watcher.git
 -----------
-@parcel/watcher-linux-x64-musl
-License: MIT
-License File: node_modules/@parcel/watcher-linux-x64-musl/LICENSE
-Copyright: Copyright (c) 2017-present Devon Govett
-Source: https://github.com/parcel-bundler/watcher.git
-Link: https://github.com/parcel-bundler/watcher.git
------------
 @parcel/watcher
 License: MIT
 License File: node_modules/@parcel/watcher/LICENSE
@@ -3603,8 +3589,8 @@ Link: https://github.com/un-ts/pkgr/blob/master/packages/core
 License: MIT
 License File: node_modules/@sinclair/typebox/license
 Copyright: Copyright (c) 2017-2026 Haydn Paterson
-Source: https://github.com/sinclairzx81/typebox-legacy
-Link: https://github.com/sinclairzx81/typebox-legacy
+Source: https://github.com/sinclairzx81/sinclair-typebox
+Link: https://github.com/sinclairzx81/sinclair-typebox
 -----------
 @sinonjs/commons
 License: BSD-3-Clause
@@ -3817,8 +3803,3 @@ Link: https://github.com/ungap/structured-clone#readme
 License: MIT
 Source: git+https://github.com/unrs/unrs-resolver.git
 Link: https://github.com/unrs/unrs-resolver#readme
------------
-@unrs/resolver-binding-linux-x64-musl
-License: MIT
-Source: git+https://github.com/unrs/unrs-resolver.git
-Link: https://github.com/unrs/unrs-resolver#readme

lang/cs/activities.php

@@ -99,8 +99,8 @@ return [
     'user_update_notification' => 'Uživatel byl úspěšně aktualizován',
     'user_delete' => 'odstranil uživatele',
     'user_delete_notification' => 'Uživatel byl úspěšně odstraněn',
-    'user_mfa_reset' => 'reset MFA for user',
-    'user_mfa_reset_notification' => 'Multi-factor authentication methods reset',
+    'user_mfa_reset' => 'obnovit vícefaktorové ověření pro uživatele',
+    'user_mfa_reset_notification' => 'Obnovení metod vícefaktorového ověřování',
 
     // API Tokens
     'api_token_create' => 'API token byl vytvořen',

lang/cs/auth.php

@@ -8,7 +8,7 @@ return [
 
     'failed' => 'Neplatné přihlašovací údaje.',
     'throttle' => 'Příliš mnoho pokusů o přihlášení. Zkuste to prosím znovu za :seconds sekund.',
-    'mfa_throttle' => 'Too many multi-factor verification attempts. Please try again in :seconds seconds.',
+    'mfa_throttle' => '{0}Příliš mnoho pokusů o vícefázové ověření. Zkuste to prosím znovu za :seconds sekund.|{1}Příliš mnoho pokusů o vícefázové ověření. Zkuste to prosím znovu za :seconds sekundu.|[2,4]Příliš mnoho pokusů o vícefázové ověření. Zkuste to prosím znovu za :seconds sekundy.|[5,*]Příliš mnoho pokusů o vícefázové ověření. Zkuste to prosím znovu za :seconds sekund.',
 
     // Login & Register
     'sign_up' => 'Registrace',

lang/cs/entities.php

@@ -173,7 +173,7 @@ return [
     'books_sort_desc' => 'Pro přeuspořádání obsahu přesuňte kapitoly a stránky v knize. Mohou být přidány další knihy, které umožní snadný přesun kapitol a stránek mezi knihami. Volitelně lze nastavit pravidlo automatického řazení, aby se při změnách automaticky seřadil obsah této knihy.',
     'books_sort_auto_sort' => 'Možnost automatického řazení',
     'books_sort_auto_sort_active' => 'Aktivní automatické řazení: :sortName',
-    'books_sort_auto_sort_creation_hint' => 'Auto sort option rules can be created in the "Lists & Sorting" settings area by a user with the relevant permissions.',
+    'books_sort_auto_sort_creation_hint' => 'Pravidla řazení mohou být vytvořena v nastavení "Seznamy a řazení" uživatelem s příslušnými oprávněními.',
     'books_sort_named' => 'Seřadit knihu :bookName',
     'books_sort_name' => 'Seřadit podle názvu',
     'books_sort_created' => 'Seřadit podle data vytvoření',
@@ -331,9 +331,9 @@ return [
 
     // Editor Sidebar
     'toggle_sidebar' => 'Skrýt/Zobrazit postranní panel',
-    'page_contents' => 'Page Contents',
-    'page_contents_none' => 'No headings were found in the page content.',
-    'page_contents_info' => 'The contents menu is generated from any heading formats used in the page.',
+    'page_contents' => 'Obsah stránky',
+    'page_contents_none' => 'Na stránce nejsou žádné nadpisy.',
+    'page_contents_info' => 'Obsah se generuje ze všech použitých nadpisů na stránce.',
     'page_tags' => 'Štítky stránky',
     'chapter_tags' => 'Štítky kapitoly',
     'book_tags' => 'Štítky knihy',

lang/cs/settings.php

@@ -207,7 +207,7 @@ return [
     'role_all' => 'Vše',
     'role_own' => 'Vlastní',
     'role_controlled_by_asset' => 'Řídí se obsahem, do kterého jsou nahrávány',
-    'role_controlled_by_page_delete' => 'Controlled by page delete permissions',
+    'role_controlled_by_page_delete' => 'Řídí se právem k odstranění stránky',
     'role_save' => 'Uložit roli',
     'role_users' => 'Uživatelé mající tuto roli',
     'role_users_none' => 'Žádný uživatel nemá tuto roli',
@@ -260,13 +260,13 @@ return [
     'users_api_tokens_create' => 'Vytvořit Token',
     'users_api_tokens_expires' => 'Vyprší',
     'users_api_tokens_docs' => 'Dokumentace API',
-    'users_mfa' => 'Vícefázové ověření',
+    'users_mfa' => 'Vícefaktorové ověření',
     'users_mfa_desc' => 'Nastavit vícefaktorové ověřování jako další vrstvu zabezpečení vašeho uživatelského účtu.',
     'users_mfa_x_methods' => ':count nastavená metoda|:count nastavených metod',
     'users_mfa_configure' => 'Konfigurovat metody',
-    'users_mfa_reset' => 'Reset Multi-Factor Authentication Methods',
-    'users_mfa_reset_desc' => 'This will reset and clear all configured multi-factor authentication methods for this user. If multi-factor authentication is required by any of their roles, they\'ll be prompted to configure new methods on their next login.',
-    'users_mfa_reset_confirm' => 'Are you sure you want to reset multi-factor authentication for this user?',
+    'users_mfa_reset' => 'Obnova metod vícefaktorového ověření',
+    'users_mfa_reset_desc' => 'Tímto se obnoví a vymažou všechny nakonfigurované metody vícefaktorového ověřování pro tohoto uživatele. Pokud některá z jeho rolí vyžaduje vícefaktorové ověřování, bude při příštím přihlášení vyzván k nastavení nových metod.',
+    'users_mfa_reset_confirm' => 'Opravdu chcete obnovit vícefaktorové ověřování pro tohoto uživatele?',
 
     // API Tokens
     'user_api_token_create' => 'Vytvořit API Token',

lang/da/auth.php

@@ -8,7 +8,7 @@ return [
 
     'failed' => 'De indtastede brugeroplysninger stemmer ikke overens med vores registreringer.',
     'throttle' => 'For mange mislykkede loginforsøg. Prøv igen om :seconds sekunder.',
-    'mfa_throttle' => 'Too many multi-factor verification attempts. Please try again in :seconds seconds.',
+    'mfa_throttle' => 'For mange mislykkede loginforsøg. Prøv igen om :seconds sekunder.',
 
     // Login & Register
     'sign_up' => 'Registrer',

lang/da/entities.php

@@ -331,9 +331,9 @@ return [
 
     // Editor Sidebar
     'toggle_sidebar' => 'Sidebjælke til/fra',
-    'page_contents' => 'Page Contents',
-    'page_contents_none' => 'No headings were found in the page content.',
-    'page_contents_info' => 'The contents menu is generated from any heading formats used in the page.',
+    'page_contents' => 'Sideindhold',
+    'page_contents_none' => 'Ingen overskrifter blev fundet i sidens indhold.',
+    'page_contents_info' => 'Indholdsmenuen er genereret fra alle kursformater, der bruges på siden.',
     'page_tags' => 'Sidetags',
     'chapter_tags' => 'Kapiteltags',
     'book_tags' => 'Bogtags',

lang/da/settings.php

@@ -367,7 +367,7 @@ return [
         'sk' => 'Slovensky',
         'sl' => 'Slovenščina',
         'sv' => 'Svenska',
-        'th' => 'ภาษาไทย',
+        'th' => 'Thailandsk',
         'tr' => 'Türkçe',
         'uk' => 'Українська',
         'uz' => 'O‘zbekcha',

lang/de/auth.php

@@ -8,7 +8,7 @@ return [
 
     'failed' => 'Diese Anmeldedaten stimmen nicht mit unseren Aufzeichnungen überein.',
     'throttle' => 'Zu viele Anmeldeversuche. Bitte versuchen Sie es in :seconds Sekunden erneut.',
-    'mfa_throttle' => 'Too many multi-factor verification attempts. Please try again in :seconds seconds.',
+    'mfa_throttle' => 'Zu viele Multi-Faktor-Verifizierungsversuche. Bitte versuchen Sie es in :seconds Sekunden erneut.',
 
     // Login & Register
     'sign_up' => 'Registrieren',

lang/de/entities.php

@@ -173,7 +173,7 @@ return [
     'books_sort_desc' => 'Verschieben Sie Kapitel und Seiten innerhalb eines Buches, um dessen Inhalt neu zu ordnen. Es können weitere Bücher hinzugefügt werden, wodurch Kapitel und Seiten problemlos zwischen den Büchern verschoben werden können. Optional kann eine automatische Sortierregel festgelegt werden, um den Inhalt dieses Buches bei Änderungen automatisch zu sortieren.',
     'books_sort_auto_sort' => 'Automatische Sortierfunktionsoption',
     'books_sort_auto_sort_active' => 'Automatische Sortierung aktiv: :sortName',
-    'books_sort_auto_sort_creation_hint' => 'Auto sort option rules can be created in the "Lists & Sorting" settings area by a user with the relevant permissions.',
+    'books_sort_auto_sort_creation_hint' => 'Regeln für die automatische Sortierung können von einem Benutzer mit den entsprechenden Berechtigungen im Einstellungsbereich "Listen & Sortieren" erstellt werden.',
     'books_sort_named' => 'Buch ":bookName" sortieren',
     'books_sort_name' => 'Sortieren nach Namen',
     'books_sort_created' => 'Sortieren nach Erstellungsdatum',
@@ -331,9 +331,9 @@ return [
 
     // Editor Sidebar
     'toggle_sidebar' => 'Seitenleiste umschalten',
-    'page_contents' => 'Page Contents',
-    'page_contents_none' => 'No headings were found in the page content.',
-    'page_contents_info' => 'The contents menu is generated from any heading formats used in the page.',
+    'page_contents' => 'Seiteninhalt',
+    'page_contents_none' => 'Es wurden keine Überschriften im Seiteninhalt gefunden.',
+    'page_contents_info' => 'Das Inhaltsmenü wird aus allen auf der Seite verwendeten Überschriften generiert.',
     'page_tags' => 'Seiten-Schlagwörter',
     'chapter_tags' => 'Kapitel-Schlagwörter',
     'book_tags' => 'Buch-Schlagwörter',

lang/de/settings.php

@@ -207,7 +207,7 @@ return [
     'role_all' => 'Alle',
     'role_own' => 'Eigene',
     'role_controlled_by_asset' => 'Abhängig von dem Asset, in das sie hochgeladen werden',
-    'role_controlled_by_page_delete' => 'Controlled by page delete permissions',
+    'role_controlled_by_page_delete' => 'Kontrolliert durch die Berechtigung zum Löschen einer Seite',
     'role_save' => 'Rolle speichern',
     'role_users' => 'Dieser Rolle zugeordnete Benutzer',
     'role_users_none' => 'Derzeit sind diesem Rollentyp keine Benutzer zugewiesen',
@@ -265,7 +265,7 @@ return [
     'users_mfa_x_methods' => ':count Methode konfiguriert|:count Methoden konfiguriert',
     'users_mfa_configure' => 'Methoden konfigurieren',
     'users_mfa_reset' => 'Setze Multifaktor-Authentifizierung zurück',
-    'users_mfa_reset_desc' => 'Dies wird alle konfigurierten Multifaktor-Authentifizierungsmethoden für diesen Nutzer zurücksetzen. Falls Multifaktor-Authentifizierung für eine seiner Rollen erforderlich ist, werden sie aufgefordert, neue Methoden beim nächsten Login zu konfigurieren.',
+    'users_mfa_reset_desc' => 'Dies wird alle konfigurierten Multifaktor-Authentifizierungsmethoden für diesen Nutzer zurücksetzen. Falls Multifaktor-Authentifizierung für eine seiner Rollen erforderlich ist, wird der Nutzer aufgefordert, neue Methoden beim nächsten Login zu konfigurieren.',
     'users_mfa_reset_confirm' => 'Sind Sie sicher, dass Sie diese Multi-Faktor-Authentifizierungsmethode für diesen Nutzer zurücksetzen möchten?',
 
     // API Tokens

lang/de_informal/auth.php

@@ -8,7 +8,7 @@ return [
 
     'failed' => 'Die eingegebenen Anmeldedaten sind ungültig.',
     'throttle' => 'Zu viele Anmeldeversuche. Bitte versuche es in :seconds Sekunden erneut.',
-    'mfa_throttle' => 'Too many multi-factor verification attempts. Please try again in :seconds seconds.',
+    'mfa_throttle' => 'Zu viele Multi-Faktor-Verifizierungsversuche. Bitte versuche es in :seconds Sekunden erneut.',
 
     // Login & Register
     'sign_up' => 'Registrieren',

lang/de_informal/entities.php

@@ -173,7 +173,7 @@ return [
     'books_sort_desc' => 'Kapitel und Seiten innerhalb eines Buches verschieben, um dessen Inhalt zu reorganisieren. Andere Bücher können hinzugefügt werden, was das Verschieben von Kapiteln und Seiten zwischen Büchern erleichtert. Optional kann eine automatische Sortierregel erstellt werden, um den Inhalt dieses Buches nach Änderungen automatisch zu sortieren.',
     'books_sort_auto_sort' => 'Auto-Sortieroption',
     'books_sort_auto_sort_active' => 'Automatische Sortierung aktiv: :sortName',
-    'books_sort_auto_sort_creation_hint' => 'Auto sort option rules can be created in the "Lists & Sorting" settings area by a user with the relevant permissions.',
+    'books_sort_auto_sort_creation_hint' => 'Regeln für die automatische Sortierung können von einem Benutzer mit den entsprechenden Berechtigungen im Einstellungsbereich "Listen & Sortieren" erstellt werden.',
     'books_sort_named' => 'Buch ":bookName" sortieren',
     'books_sort_name' => 'Sortieren nach Namen',
     'books_sort_created' => 'Sortieren nach Erstellungsdatum',
@@ -331,9 +331,9 @@ return [
 
     // Editor Sidebar
     'toggle_sidebar' => 'Seitenleiste umschalten',
-    'page_contents' => 'Page Contents',
-    'page_contents_none' => 'No headings were found in the page content.',
-    'page_contents_info' => 'The contents menu is generated from any heading formats used in the page.',
+    'page_contents' => 'Seiteninhalt',
+    'page_contents_none' => 'Es wurden keine Überschriften im Seiteninhalt gefunden.',
+    'page_contents_info' => 'Das Inhaltsmenü wird aus allen auf der Seite verwendeten Überschriften generiert.',
     'page_tags' => 'Seiten-Schlagwörter',
     'chapter_tags' => 'Kapitel-Schlagwörter',
     'book_tags' => 'Buch-Schlagwörter',

lang/de_informal/settings.php

@@ -208,7 +208,7 @@ Hinweis: Benutzer können ihre E-Mail Adresse nach erfolgreicher Registrierung
     'role_all' => 'Alle',
     'role_own' => 'Eigene',
     'role_controlled_by_asset' => 'Berechtigungen werden vom Uploadziel bestimmt',
-    'role_controlled_by_page_delete' => 'Controlled by page delete permissions',
+    'role_controlled_by_page_delete' => 'Kontrolliert durch die Berechtigung zum Löschen einer Seite',
     'role_save' => 'Rolle speichern',
     'role_users' => 'Dieser Rolle zugeordnete Benutzer',
     'role_users_none' => 'Bisher sind dieser Rolle keine Benutzer zugeordnet',
@@ -266,8 +266,8 @@ Hinweis: Benutzer können ihre E-Mail Adresse nach erfolgreicher Registrierung
     'users_mfa_x_methods' => ':count Methode konfiguriert|:count Methoden konfiguriert',
     'users_mfa_configure' => 'Methoden konfigurieren',
     'users_mfa_reset' => 'Setze Multifaktor-Authentifizierung zurück',
-    'users_mfa_reset_desc' => 'Dies wird alle konfigurierten Multifaktor-Authentifizierungsmethoden für diesen Nutzer zurücksetzen. Falls Multifaktor-Authentifizierung für eine seiner Rollen erforderlich ist, werden sie aufgefordert, neue Methoden beim nächsten Login zu konfigurieren.',
-    'users_mfa_reset_confirm' => 'Sind Sie sicher, dass Sie diese Multi-Faktor-Authentifizierungsmethode für diesen Nutzer zurücksetzen möchten?',
+    'users_mfa_reset_desc' => 'Dies wird alle konfigurierten Multifaktor-Authentifizierungsmethoden für diesen Nutzer zurücksetzen. Falls Multifaktor-Authentifizierung für eine seiner Rollen erforderlich ist, wird der Nutzer aufgefordert, neue Methoden beim nächsten Login zu konfigurieren.',
+    'users_mfa_reset_confirm' => 'Bist du sicher, dass du diese Multi-Faktor-Authentifizierungsmethode für diesen Nutzer zurücksetzen möchtest?',
 
     // API Tokens
     'user_api_token_create' => 'Neuen API-Token erstellen',

lang/hu/settings.php

@@ -367,7 +367,7 @@ return [
         'sk' => 'Slovensky',
         'sl' => 'Slovenščina',
         'sv' => 'Svenska',
-        'th' => 'ภาษาไทย',
+        'th' => 'Thai',
         'tr' => 'Türkçe',
         'uk' => 'Українська',
         'uz' => 'O‘zbekcha',

lang/ja/entities.php

@@ -173,7 +173,7 @@ return [
     'books_sort_desc' => 'ブック内のチャプタおよびページを移動して内容を再編成できます。他のブックを並べて、ブック間でチャプタやページを簡単に移動することもできます。オプションで自動ソートルールを設定すると、変更時にブックの内容を自動的にソートすることができます。',
     'books_sort_auto_sort' => '自動ソートオプション',
     'books_sort_auto_sort_active' => '自動ソート有効: :sortName',
-    'books_sort_auto_sort_creation_hint' => 'Auto sort option rules can be created in the "Lists & Sorting" settings area by a user with the relevant permissions.',
+    'books_sort_auto_sort_creation_hint' => '自動ソートオプションのルールは、関連する権限を持ったユーザーによって設定の「一覧とソート」エリアで作成できます。',
     'books_sort_named' => 'ブック「:bookName」を並べ替え',
     'books_sort_name' => '名前で並べ替え',
     'books_sort_created' => '作成日で並べ替え',

lang/ja/settings.php

@@ -207,7 +207,7 @@ return [
     'role_all' => '全て',
     'role_own' => '自身',
     'role_controlled_by_asset' => 'このアセットに対し、右記の操作を許可:',
-    'role_controlled_by_page_delete' => 'Controlled by page delete permissions',
+    'role_controlled_by_page_delete' => 'ページ削除権限を適用',
     'role_save' => '役割を保存',
     'role_users' => 'この役割を持つユーザー',
     'role_users_none' => 'この役割が付与されたユーザーはいません',

lang/nl/entities.php

@@ -331,7 +331,7 @@ return [
 
     // Editor Sidebar
     'toggle_sidebar' => 'Zijbalk Tonen/Verbergen',
-    'page_contents' => 'Page Contents',
+    'page_contents' => 'Pagina Inhoud',
     'page_contents_none' => 'No headings were found in the page content.',
     'page_contents_info' => 'The contents menu is generated from any heading formats used in the page.',
     'page_tags' => 'Pagina Labels',

lang/pt/entities.php

@@ -50,8 +50,8 @@ return [
     'import_zip_validation_errors' => 'Errors were detected while validating the provided ZIP file:',
     'import_pending' => 'Pending Imports',
     'import_pending_none' => 'No imports have been started.',
-    'import_continue' => 'Continue Import',
-    'import_continue_desc' => 'Review the content due to be imported from the uploaded ZIP file. When ready, run the import to add its contents to this system. The uploaded ZIP import file will be automatically removed on successful import.',
+    'import_continue' => 'Continuar importação',
+    'import_continue_desc' => 'Continuar importação',
     'import_details' => 'Import Details',
     'import_run' => 'Run Import',
     'import_size' => ':size Import ZIP Size',

lang/pt/errors.php

@@ -78,7 +78,7 @@ return [
     // Users
     'users_cannot_delete_only_admin' => 'Não pode excluir o único administrador',
     'users_cannot_delete_guest' => 'Não pode excluir o usuário convidado',
-    'users_could_not_send_invite' => 'Could not create user since invite email failed to send',
+    'users_could_not_send_invite' => 'Não foi possível criar o utilizador, pois o envio do endereço eletrónico de convite falhou',
 
     // Roles
     'role_cannot_be_edited' => 'Este cargo não pode ser editado',
@@ -106,7 +106,7 @@ return [
     'back_soon' => 'Voltaremos em breve.',
 
     // Import
-    'import_zip_cant_read' => 'Could not read ZIP file.',
+    'import_zip_cant_read' => 'Não foi possível ler o ficheiro ZIP.',
     'import_zip_cant_decode_data' => 'Could not find and decode ZIP data.json content.',
     'import_zip_no_data' => 'ZIP file data has no expected book, chapter or page content.',
     'import_zip_data_too_large' => 'ZIP data.json content exceeds the configured application maximum upload size.',

lang/uk/activities.php

@@ -99,8 +99,8 @@ return [
     'user_update_notification' => 'Користувача було успішно оновлено',
     'user_delete' => 'вилучений користувач',
     'user_delete_notification' => 'Користувача успішно видалено',
-    'user_mfa_reset' => 'reset MFA for user',
-    'user_mfa_reset_notification' => 'Multi-factor authentication methods reset',
+    'user_mfa_reset' => 'скинути MFA для користувача',
+    'user_mfa_reset_notification' => 'Скидання методів багатофакторної автентифікації',
 
     // API Tokens
     'api_token_create' => 'створений APi токен',

lang/uk/auth.php

@@ -8,7 +8,7 @@ return [
 
     'failed' => 'Цей обліковий запис не знайдено.',
     'throttle' => 'Забагато спроб входу в систему. Будь ласка, спробуйте ще раз через :seconds секунд.',
-    'mfa_throttle' => 'Too many multi-factor verification attempts. Please try again in :seconds seconds.',
+    'mfa_throttle' => 'Занадто багато спроб багатофакторної перевірки. Будь ласка, спробуйте ще раз через :seconds секунд.',
 
     // Login & Register
     'sign_up' => 'Реєстрація',

lang/uk/entities.php

@@ -173,7 +173,7 @@ return [
     'books_sort_desc' => 'Перекладіть розділи та сторінки в межах книги, щоб реорганізувати вміст. Інші книги можна додати, що дозволяє легко переміщати глави та сторінки між книгами. При необхідності правило автоматичного сортування може бути встановлено для автоматичного сортування вмісту цієї книги при змінах.',
     'books_sort_auto_sort' => 'Опція автоматичного сортування',
     'books_sort_auto_sort_active' => 'Автосортування : :sortName',
-    'books_sort_auto_sort_creation_hint' => 'Auto sort option rules can be created in the "Lists & Sorting" settings area by a user with the relevant permissions.',
+    'books_sort_auto_sort_creation_hint' => 'Правила автоматичного сортування можуть бути створені в області налаштувань "Списки і сортування" за допомогою користувача з відповідними дозволами.',
     'books_sort_named' => 'Сортувати книгу :bookName',
     'books_sort_name' => 'Сортувати за назвою',
     'books_sort_created' => 'Сортувати за датою створення',
@@ -331,9 +331,9 @@ return [
 
     // Editor Sidebar
     'toggle_sidebar' => 'Перемикач бічної панелі',
-    'page_contents' => 'Page Contents',
-    'page_contents_none' => 'No headings were found in the page content.',
-    'page_contents_info' => 'The contents menu is generated from any heading formats used in the page.',
+    'page_contents' => 'Вміст сторінки',
+    'page_contents_none' => 'У тексті сторінки не знайдено заголовків.',
+    'page_contents_info' => 'Вміст меню створюється з будь-яких форматів заголовків, використовуваних для сторінки.',
     'page_tags' => 'Теги сторінки',
     'chapter_tags' => 'Теги розділів',
     'book_tags' => 'Теги книг',

lang/uk/errors.php

@@ -125,7 +125,7 @@ return [
     'api_incorrect_token_secret' => 'Секрет, наданий для даного використовуваного токена API є неправильним',
     'api_user_no_api_permission' => 'Власник використовуваного токена API не має дозволу здійснювати виклики API',
     'api_user_token_expired' => 'Термін дії токена авторизації закінчився',
-    'api_cookie_auth_only_get' => 'Only GET requests are allowed when using the API with cookie-based authentication',
+    'api_cookie_auth_only_get' => 'Дозволяються тільки запити GET при використанні API з автентифікацією на основі cookie',
 
     // Settings & Maintenance
     'maintenance_test_email_failure' => 'Помилка під час надсилання тестового електронного листа:',

lang/uk/settings.php

@@ -104,7 +104,7 @@ return [
     'sort_rule_op_chapters_first' => 'Спочатку розділи',
     'sort_rule_op_chapters_last' => 'Розділи останні',
     'sorting_page_limits' => 'Обмеження відображення сторінок',
-    'sorting_page_limits_desc' => 'Set how many items to show per-page in various lists within the system. Typically a lower amount will be more performant, while a higher amount avoids the need to click through multiple pages. Using a multiple of 6 is recommended.',
+    'sorting_page_limits_desc' => 'Кількість елементів для відображення в різних списках в системі. Зазвичай менша кількість буде більш продуктивною, в той час як більша кількість уникає необхідність натискання на кілька сторінок. Використання кратного 6 рекомендується.',
 
     // Maintenance settings
     'maint' => 'Обслуговування',
@@ -207,7 +207,7 @@ return [
     'role_all' => 'Все',
     'role_own' => 'Власне',
     'role_controlled_by_asset' => 'Контролюється за об\'єктом, до якого вони завантажуються',
-    'role_controlled_by_page_delete' => 'Controlled by page delete permissions',
+    'role_controlled_by_page_delete' => 'Керується правами доступу для видалення сторінки',
     'role_save' => 'Зберегти роль',
     'role_users' => 'Користувачі в цій ролі',
     'role_users_none' => 'Наразі жоден користувач не призначений для цієї ролі',
@@ -264,9 +264,9 @@ return [
     'users_mfa_desc' => 'Двофакторна аутентифікація додає ще один рівень безпеки для вашого облікового запису.',
     'users_mfa_x_methods' => ':count метод налаштовано|:count методів налаштовано',
     'users_mfa_configure' => 'Налаштувати Методи',
-    'users_mfa_reset' => 'Reset Multi-Factor Authentication Methods',
-    'users_mfa_reset_desc' => 'This will reset and clear all configured multi-factor authentication methods for this user. If multi-factor authentication is required by any of their roles, they\'ll be prompted to configure new methods on their next login.',
-    'users_mfa_reset_confirm' => 'Are you sure you want to reset multi-factor authentication for this user?',
+    'users_mfa_reset' => 'Скинути методи багатофакторної автентифікації',
+    'users_mfa_reset_desc' => 'Це скине та очистить всі налаштовані методи багатофакторної аутентифікації для цього користувача. Якщо багатофакторна аутентифікація обов\'язкова будь-якою зі своїх ролей, то вона буде запитана налаштувати нові способи при наступному вході в систему.',
+    'users_mfa_reset_confirm' => 'Ви впевнені, що хочете скинути багатофакторну аутентифікацію для цього користувача?',
 
     // API Tokens
     'user_api_token_create' => 'Створити токен API',

resources/views/mfa/hardware-key-generate.blade.php

@@ -1,74 +0,0 @@
-@extends('layouts.simple')
-
-@section('body')
-
-    <div class="container very-small py-xl">
-        <div class="card content-wrap auto-height">
-            <h1 class="list-heading">{{ trans('auth.mfa_gen_hardware_key_title') }}</h1>
-            <p>{{ trans('auth.mfa_gen_hardware_key_desc') }}</p>
-
-            <div class="text-center mb-xs">
-                <button type="button" id="setup">setup_key</button>
-            </div>
-
-            <form action="{{ url('/mfa/hardware_key/confirm') }}" method="POST">
-                {{ csrf_field() }}
-                <div class="mt-s text-right">
-                    <a href="{{ url('/mfa/setup') }}" class="button outline">{{ trans('common.cancel') }}</a>
-                    <button class="button">{{ trans('auth.mfa_gen_confirm_and_enable') }}</button>
-                </div>
-            </form>
-        </div>
-    </div>
-
-    <script type="module" nonce="{{ $cspNonce }}">
-        // TODO - Extract to its own compontent
-        // TODO - Add some guidance and call this on click
-        // https://webauthn-doc.spomky-labs.com/prerequisites/javascript#using-native-browser-api
-        const setupButton = document.getElementById('setup');
-        const options = {!! $options !!};
-
-        const publicKeyCredentialCreationOptions = {
-            ...options,
-            challenge: base64urlDecode(options.challenge),
-            user: {
-                ...options.user,
-                id: base64urlDecode(options.user.id)
-            },
-            excludeCredentials: options.excludeCredentials?.map(cred => ({
-                ...cred,
-                id: base64urlDecode(cred.id)
-            }))
-        };
-
-        setupButton.addEventListener('click', async () => {
-            console.log(publicKeyCredentialCreationOptions);
-            const credential = await navigator.credentials.create({
-                publicKey: publicKeyCredentialCreationOptions,
-            });
-            console.log(credential);
-        });
-
-        function base64urlEncode(buffer) {
-            const base64 = btoa(String.fromCharCode(...new Uint8Array(buffer)));
-            return base64
-                .replace(/\+/g, '-')
-                .replace(/\//g, '_')
-                .replace(/=/g, '');
-        }
-
-        function base64urlDecode(base64url) {
-            const base64 = base64url
-                .replace(/-/g, '+')
-                .replace(/_/g, '/');
-            const padding = '='.repeat((4 - base64.length % 4) % 4);
-            const binary = atob(base64 + padding);
-            const bytes = new Uint8Array(binary.length);
-            for (let i = 0; i < binary.length; i++) {
-                bytes[i] = binary.charCodeAt(i);
-            }
-            return bytes.buffer;
-        }
-    </script>
-
-@stop

resources/views/mfa/setup.blade.php

@@ -8,7 +8,7 @@
             <p class="mb-none"> {{ trans('auth.mfa_setup_desc') }}</p>
 
             <div class="setting-list">
-                @foreach(\BookStack\Access\Mfa\MfaValue::allMethods() as $method)
+                @foreach(['totp', 'backup_codes'] as $method)
                     @include('mfa.parts.setup-method-row', ['method' => $method])
                 @endforeach
             </div>

routes/web.php

@@ -319,8 +319,6 @@ Route::middleware('mfa-setup')->group(function () {
     Route::post('/mfa/totp/confirm', [AccessControllers\MfaTotpController::class, 'confirm']);
     Route::get('/mfa/backup_codes/generate', [AccessControllers\MfaBackupCodesController::class, 'generate']);
     Route::post('/mfa/backup_codes/confirm', [AccessControllers\MfaBackupCodesController::class, 'confirm']);
-    Route::get('/mfa/hardware_key/generate', [AccessControllers\MfaHardwareKeyController::class, 'generate']);
-    Route::post('/mfa/hardware_key/confirm', [AccessControllers\MfaHardwareKeyController::class, 'confirm']);
 });
 Route::middleware('guest')->group(function () {
     Route::get('/mfa/verify', [AccessControllers\MfaController::class, 'verify']);

tests/Entity/PageContentFilteringTest.php

@@ -464,6 +464,11 @@ HTML;
             '<div style="background:#FF0000;left:0;color:#00FFEE;">Hello!</div>' => '<div style="background:#FF0000;color:#00FFEE;">Hello!</div>',
             '<div style="color:#00FFEE;">Hello!<style>testinghello!</style></div>' => '<div style="color:#00FFEE;">Hello!</div>',
             '<div drawio-diagram="5332" another-attr="cat">Hello!</div>' => '<div drawio-diagram="5332">Hello!</div>',
+            '<iframe src="file://link/to/file" id="bkmrk-file-iframe"></iframe>' => '<iframe id="bkmrk-file-iframe"></iframe>',
+            '<embed src="file://link/to/file" id="bkmrk-file-embed"></embed>' => '<embed id="bkmrk-file-embed">',
+            '<object data="file://link/to/file" id="bkmrk-file-object"></object>' => '<object id="bkmrk-file-object">',
+            '<div id="bkmrk-file-img"><img src="file://link/to/file" alt="My local image"></div>' => '<div id="bkmrk-file-img"></div>',
+            '<div id="bkmrk-file-img"><img srcset="file://link/to/file" alt="My local image"></div>' => '<div id="bkmrk-file-img"></div>',
         ];
 
         config()->set('app.content_filtering', 'a');
@@ -476,6 +481,7 @@ HTML;
             $resp = $this->get($page->getUrl());
 
             $resp->assertSee($expected, false);
+            $resp->assertDontSee($input, false);
         }
     }
 
@@ -484,6 +490,7 @@ HTML;
         $testCasesExpectedByInput = [
             '<p><a href="https://example.com" target="_blank">New tab linkydoodle</a></p>',
             '<p><a href="https://example.com/user/1" data-mention-user-id="5">@mentionusertext</a></p>',
+            '<p><a href="file://link/to/file">Link to file</a></p>',
             '<details><summary>Hello</summary><p>Mydetailshere</p></details>',
         ];
 

tests/Search/EntitySearchTest.php

@@ -233,6 +233,18 @@ class EntitySearchTest extends TestCase
         $this->get('/search?term=' . urlencode('danzorbhsing {created_before:2037-01-01}'))->assertDontSee($page->name);
     }
 
+    public function test_search_tags_with_unexpected_numeric_values_does_not_cause_error()
+    {
+        $pageA = $this->entities->page();
+        $pageA->name = 'MyTestPageWithAwkwardNumericTagValue';
+        $pageA->save();
+        $pageA->tags()->save(new Tag(['name' => 'Count', 'value' => '1E999']));
+
+        $resp = $this->asEditor()->get('/search?term=' . urlencode('[Count=1E999]'));
+        $resp->assertStatus(200);
+        $resp->assertSee('MyTestPageWithAwkwardNumericTagValue');
+    }
+
     public function test_entity_selector_search()
     {
         $page = $this->entities->newPage(['name' => 'my ajax search test', 'html' => 'ajax test']);

tests/Uploads/AttachmentTest.php

@@ -159,6 +159,38 @@ class AttachmentTest extends TestCase
         $this->files->deleteAllAttachmentFiles();
     }
 
+    public function test_attachment_update_without_permission()
+    {
+        $page = $this->entities->page();
+        $attachment = Attachment::factory()->create(['uploaded_to' => $page->id]);
+
+        $this->permissions->disableEntityInheritedPermissions($page);
+
+        $resp = $this->asViewer()->put("attachments/{$attachment->id}", [
+            'attachment_edit_name' => 'My new attachment name',
+            'attachment_edit_url'  => 'https://test.example.com',
+        ]);
+
+        $this->assertPermissionError($resp);
+    }
+
+    public function test_attachment_update_without_permission_with_validation_errors()
+    {
+        $page = $this->entities->page();
+        /** @var Attachment $attachment */
+        $attachment = Attachment::factory()->create(['uploaded_to' => $page->id]);
+
+        $this->permissions->disableEntityInheritedPermissions($page);
+
+        $resp = $this->asViewer()->put("attachments/{$attachment->id}", [
+            'attachment_edit_name' => '',
+            'attachment_edit_url'  => 'https://test.example.com',
+        ]);
+
+        $this->assertPermissionError($resp);
+        $resp->assertDontSee($attachment->path);
+    }
+
     public function test_file_deletion()
     {
         $page = $this->entities->page();

version

@@ -1 +1 @@
-v26.05-dev
+v26.05.1