Redesigned media library. Browsing, search and upload were rebuilt around one page per folder (PR #233).
AtomPub can manage templates and categories. New collections in each weblog's workspace, documented in the user guide:
/{handle}/categories.atomcat. The entries collection lists its categories inline, as before, and also references that document.New AtomPub Guide (docs/roller-atompub-guide.adoc). It documents every AtomPub URI, permission, element and status code, with examples that the test suite checks against the code.
image/svg+xml gives .svg, parameters such as charset are ignored, and a Slug that already has a matching extension keeps it.next and previous links of a named media directory include the slash before the offset, so paging through it works.edit-media URI; it answered 404.javax.servlet containers can no longer run Roller.webservices.atomPubAuth is still set to oauth, AtomPub refuses every request until you set it to basic.authentication.method set to openid or db-openid must switch to another method before upgrading.propono.properties file and the RollerAtomHandlerFactory extension point are removed, so a deployment that configured its own AtomHandlerFactory (for example, for custom authentication) no longer has that handler. AtomPub clients see no change.Pasted entry images are kept when you publish (ROL-2184). PNG, JPEG and GIF images pasted or dragged into the rich text editor are saved as media files when the author can upload. Otherwise they are kept inline.
weblog.inlineImages.preferInline=true keeps images inline even when uploads are available.weblog.inlineImages.maxFieldBytes (default 60000) limits a content or summary field that has inline images. On MySQL, change the entry columns to MEDIUMTEXT before you raise it.data: images. Custom themes with their own Content Security Policy need data: in img-src.maxPostSize defaults to 2 MB, so larger pastes are refused with a “form is too large” message; raise maxPostSize to accept them.The one-time setup token is also printed to the console. It still goes to Roller's log, and now also appears on standard output (for example catalina.out), so it is easy to find at first start.
Weblog update pings no longer use the XML-RPC client library. Roller builds the weblogUpdates.ping request and reads the response itself, with a connection timeout, a read timeout and a 1 MB cap on the response, and reads only the flerror and message fields the protocol defines. Ping behaviour is otherwise unchanged.
AtomPub honours webservices.enableAtomPub on every request. While the setting is off, every AtomPub URL answers 404, not only the service document.
AtomPub entry bodies default to a 1 MiB limit. A larger entry is refused with 413. Set webservices.atomPubMaxEntrySize in Server Settings to change the limit in bytes (default 1048576). Media uploads use the existing file upload limits.
Templates can no longer reach the objects behind the template wrappers. $weblog.pojo, $entry.pojo and getPojo() no longer resolve in weblog templates. A custom theme that uses them will print the reference text as-is, without an error. Use the wrapper's own properties instead, for example $weblog.handle or $entry.title.
Tag names can no longer contain ", &, ', <, > or `. These characters are removed when a tag is saved, and from existing tag names when they are shown.
Custom-theme files in the media library follow the media rules. A weblog with a custom theme still serves its stylesheets and scripts from the media library as before. Other files there, such as HTML or SVG, are served like any other media file: as a download unless they are an image, audio, video, PDF or plain text. The media file editor sets a file's original path only when mediafile.originalPathEdit.enabled=true, as its form already shows. AtomPub media uploads no longer set one.
The entry editor applies the Limited role to each entry. A Limited member can open, change and remove draft and pending entries only, as in AtomPub and XML-RPC. Other entries answer with the access denied page.
Planet is off by default. planet.aggregator.enabled now defaults to false. While it is off, the Planet admin pages, /planetrss and the Planet background tasks (RefreshRollerPlanetTask, SyncWebsitesTask) do nothing. A site that uses Planet must set planet.aggregator.enabled=true in roller-custom.properties before upgrading.
Planet admin changes require POST. Saving or deleting Planet groups and subscriptions is refused unless the request is a POST from the admin form.
XML parsing uses Apache Commons Secure XML. Roller now bundles commons-secure-xml 1.0.0 and builds all of its XML parsers through it.
Startup fails if the XML-RPC parser cannot be configured. Roller used to log an error and continue. It now stops at startup, so check the log if a custom XML parser is on the classpath.
Text with an unclosed tag loses the tag. Where Roller strips HTML from plain-text fields (for example a weblog‘s description), a tag with attributes and no closing >, such as text <img src=x, is now dropped. Other text with a <, as in a < b, x<y or C<C++ fans, is kept, and no longer gets a space added before the <. The Your Weblogs page shows a weblog’s description as text.
OPML import keeps only web links. An imported bookmark is kept only when its link is an absolute http or https URL; others are skipped and named in the log. A feed URL that is not one is dropped. Blogroll links shown on weblog pages must be relative or use http, https, ftp or mailto; other links, and links with & before the path, are shown without a target. The blogroll shows bookmark names and descriptions as plain text, without HTML formatting.
The user picker matches user names only, except for global admins. When a user who is not a global admin searches for users (for example to invite a member), only user names are matched. Global admins can still search by email address. For other users the picker lists enabled users only, at most 50 at a time. % and _ in the search text match only themselves.
Previews need a role in the weblog. Previewing a weblog's pages or theme resources now requires an enabled user with a role in that weblog (Limited, Author or Admin), or a global admin.
Disabled accounts cannot sign in with an OpenID URL. An account that an administrator has disabled is now refused whenever its OpenID URL is used to sign in, on every sign-in form, as user name and password sign-in already does.
Search queries can name only the search fields. A weblog search may name entry content, title or comment text (for example title:roller). A query that names another field is treated like a query that cannot be parsed. Author user names and comment author names and email addresses are no longer added to the search index. An index built by an earlier version is rebuilt in the background at the first startup after the upgrade.
Search shows only published entries. Weblog search returns entries that are published at the time of the search, even if the search index still holds an entry that has since gone back to draft. Updating an entry through AtomPub so that it is no longer published also removes it from the index, and so does deleting an entry through AtomPub.
Actions that change data need a POST. A request other than a POST that calls an action method which changes data, for example pings!enable.rol, is refused with 405 Method Not Allowed. Roller‘s own ping, invitation and installer links are now small forms that POST with the page’s form token, and return to the page afterwards. Saving a common ping target needs a POST. A bookmark or script that calls such a URL with a GET is refused.
/resources/default) failed with a server error. So did uploading media with no Slug header and no title, uploading to /resources itself, or uploading with a very short Slug. Unknown media directories now answer 404./planetrss printed $utils.escapeXML($siteName) as its title and description, and logged a warning for each. Unsaved Planet settings now use their defaults.2.00).Initial installation now requires a one-time, cryptographically secure setup token printed to the server log. Bootstrap access closes as soon as setup finishes — when the first administrator is created on a new site, or when the database upgrade completes on an existing one.
A maintenance release. Users of 6.1.5 and earlier are encouraged to upgrade.
Three features are retired in this release. Each was optional or long obsolete, but if you rely on one, plan for it:
web.xml. Sites that accepted Trackback pings will stop accepting them. TrackbackLinkbackCommentValidator is retained as an inert validator so an existing configuration that names it still starts.authentication.method now accepts basic and oauth. An installation configured for wsse will fail closed on startup rather than silently falling back — change the setting before upgrading.Two more changes are visible in normal use:
nullCatalogMeansCurrent to default to false.assembly-release/sign-release.sh takes the version and optional release candidate suffix as arguments, requires the signing key to be named through ROLLER_SIGNING_KEY, refuses a key that is not RSA-4096 or stronger, and writes SHA-512 and SHA-256 in shasum(1) format.docs/examples/scripting/. The examples' README files say where to obtain them.Release notes for 6.1.5 and earlier are in the announcements archived at https://lists.apache.org/list.html?user@roller.apache.org.