<!--
 File        :  doc/source/changelog.sgml

 Purpose     :  Entity included in other project documents.

 Copyright (C) 2013-2023 Privoxy Developers https://www.privoxy.org/
 See LICENSE.

 ======================================================================
  This file used for inclusion with other documents only.
 ======================================================================

 If you make changes to this file, please verify the finished
 docs all display as intended.

 This file is included into:

  user-manual
-->


<!--
 The SGML ChangeLog can be generated with: utils/changelog2doc.pl ChangeLog
-->

<para>
  <application>Privoxy 3.0.34</application> fixes a few
  minor bugs and comes with a couple of general improvements
  and new features.
</para>
<para>
  Changes in <application>Privoxy 3.0.34</application> stable:
</para>
<para>
 <itemizedlist>
  <listitem>
   <para>
    Bug fixes:
    <itemizedlist>
    <listitem>
     <para>
      Improve the handling of chunk-encoded responses by buffering the data
      even if filters are disabled and properly keeping track of where the
      various chunks are supposed to start and end. Previously Privoxy would
      merely check the last bytes received to see if they looked like the
      last-chunk. This failed to work if the last-chunk wasn't received in one
      read and could also result in actual data being misdetected
      as last-chunk.
      Should fix: SF support request #1739.
      Reported by: withoutname.
     </para>
    </listitem>
    <listitem>
     <para>
      remove_chunked_transfer_coding(): Refuse to de-chunk invalid data
      Previously the data could get corrupted even further.
      Now we simply pass the unmodified data to the client.
     </para>
    </listitem>
    <listitem>
     <para>
      gif_deanimate(): Tolerate multiple image extensions in a row.
      This allows to deanimate all the gifs on:
      https://commons.wikimedia.org/wiki/Category:Animated_smilies
      Fixes SF bug #795 reported by Celejar.
     </para>
    </listitem>
    <listitem>
     <para>
      OpenSSL generate_host_certificate(): Use X509_get_subject_name()
      instead of X509_get_issuer_name() to get the issuer for generated
      website certificates so there are no warnings in the browser when using
      an intermediate CA certificate instead of a self-signed root certificate.
      Problem reported and patch submitted by Chakib Benziane.
     </para>
    </listitem>
    <listitem>
     <para>
      can_filter_request_body(): Fix a log message that contained a spurious u.
     </para>
    </listitem>
    <listitem>
     <para>
      handle_established_connection(): Check for pending TLS data from the client
      before checking if data is available on the connection.
      The TLS library may have already consumed all the data from the client
      response in which case poll() and select() will not detect that data is
      available to be read.
      Sponsored by: Robert Klemme.
     </para>
    </listitem>
    <listitem>
     <para>
      ssl_send_certificate_error(): Don't crash if there's no certificate
      information available. This is only relevant when Privoxy is built with
      wolfSSL 5.0.0 or later (code not yet published). Earlier wolfSSL versions
      or the other TLS backends don't seem to trigger the crash.
     </para>
    </listitem>
    <listitem>
     <para>
      socks5_connect(): Add support for target hosts specified as IPv4 address
      Previously the IP address was sent as domain.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    General improvements:
    <itemizedlist>
    <listitem>
     <para>
      Add a client-body-tagger action which creates tags based on
      the content of the request body.
      Sponsored by: Robert Klemme.
     </para>
    </listitem>
    <listitem>
     <para>
      When client-body filters are enabled, buffer the whole request
      before opening a connection to the server.
      Makes it less likely that the server connection times out
      and we don't open a connection if the buffering fails anyway.
      Sponsored by: Robert Klemme.
     </para>
    </listitem>
    <listitem>
     <para>
      Add periods to a couple of log messages.
     </para>
    </listitem>
    <listitem>
     <para>
      accept_connection(): Add missing space to a log message.
     </para>
    </listitem>
    <listitem>
     <para>
      Initialize ca-related defaults with strdup_or_die() so errors
      aren't silently ignored.
     </para>
    </listitem>
    <listitem>
     <para>
      make_path: Use malloc_or_die() in cases where allocation errors
      were already fatal anyway.
     </para>
    </listitem>
    <listitem>
     <para>
      handle_established_connection(): Improve an error message slightly.
     </para>
    </listitem>
    <listitem>
     <para>
      receive_client_request(): Reject https URLs without CONNECT request.
     </para>
    </listitem>
    <listitem>
     <para>
      Include all requests in the statistics if mutexes are available.
      Previously in case of reused connections only the last request got
      counted. The statistics still aren't perfect but it's an improvement.
     </para>
    </listitem>
    <listitem>
     <para>
      Add read_socks_reply() and start using it in socks5_connect()
      to apply the socket timeout more consistently.
     </para>
    </listitem>
    <listitem>
     <para>
      socks5_connect(): Deal with domain names in the socks reply
     </para>
    </listitem>
    <listitem>
     <para>
      Add a filter for bundeswehr.de that hides the cookie and
      privacy info banner.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Action file improvements:
    <itemizedlist>
    <listitem>
     <para>
      Disable filter{banners-by-size} for .freiheitsfoo.de/.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable filter{banners-by-size} for freebsdfoundation.org/.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for consent.youtube.com/.
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to ups.xplosion.de/.
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests for elsa.memoinsights.com/t.
     </para>
    </listitem>
    <listitem>
     <para>
      Fix a typo in a test.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for launchpad.net/.
     </para>
    </listitem>
    <listitem>
     <para>
      Unblock .eff.org/.
     </para>
    </listitem>
    <listitem>
     <para>
      Stop unblocking .org/.*(image|banner) which appears to be too generous
      The example URL http://www.gnu.org/graphics/gnu-head-banner.png is
      already unblocked due to .gnu.org being unblocked.
     </para>
    </listitem>
    <listitem>
     <para>
      Unblock adfd.org/.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable filter{banners-by-link} for .eff.org/.
     </para>
    </listitem>
    <listitem>
     <para>
      Block requests to odb.outbrain.com/.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for .gandi.net/.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects{} for .onion/.*/status/.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects{} for twitter.com/.*/status/.
     </para>
    </listitem>
    <listitem>
     <para>
      Unblock pinkstinks.de/.
     </para>
    </listitem>
    <listitem>
     <para>
      Disable fast-redirects for .hagalil.com/.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Privoxy-Log-Parser:
    <itemizedlist>
    <listitem>
     <para>
      Bump version to 0.9.5.
     </para>
    </listitem>
    <listitem>
     <para>
      Highlight more log messages.
     </para>
    </listitem>
    <listitem>
     <para>
      Highlight the Crunch reason only once. Previously the "crunch reason"
      could also be highlighted when the URL contained a matching string.
      The real crunch reason only occurs once per line, so there's no need
      to continue looking for it after it has been found once.
      While at it, add a comment with an example log line.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    uagen:
    <itemizedlist>
    <listitem>
     <para>
      Bump version to 1.2.4.
     </para>
    </listitem>
    <listitem>
     <para>
      Update BROWSER_VERSION and BROWSER_REVISION to 102.0
      to match the User-Agent of the current Firefox ESR.
     </para>
    </listitem>
    <listitem>
     <para>
      Explicitly document that changing the 'Gecko token' is suspicious.
     </para>
    </listitem>
    <listitem>
     <para>
      Consistently use a lower-case 'c' as copyright symbol.
     </para>
    </listitem>
    <listitem>
     <para>
      Bump copyright.
     </para>
    </listitem>
    <listitem>
     <para>
      Add 'aarch64' as Linux architecture.
     </para>
    </listitem>
    <listitem>
     <para>
      Add OpenBSD architecture 'arm64'.
     </para>
    </listitem>
    <listitem>
     <para>
      Stop using sparc64 as FreeBSD architecture.
      It hasn't been supported for a while now.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Build system:
    <itemizedlist>
    <listitem>
     <para>
      Makefile: Add a 'dok' target that depends on the 'error' target
      to show the "You are not using GNU make or did nor run configure"
      message.
     </para>
    </listitem>
    <listitem>
     <para>
      configure: Fix --with-msan option.
      Also (probably) reported by Andrew Savchenko.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    macOS build system:
    <itemizedlist>
    <listitem>
     <para>
      Enable HTTPS inspection when building the macOS binary
      (using OpenSSL as TLS library).
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
  <listitem>
   <para>
    Documentation:
    <itemizedlist>
    <listitem>
     <para>
      Add OpenSSL to the list of libraries that may be licensed under the
      Apache 2.0 license in which case the linked Privoxy binary has to be
      distributed under the GPLv3 or later.
     </para>
    </listitem>
    <listitem>
     <para>
      config: Fix the documented ca-directory default value.
      Reported by avoidr.
     </para>
    </listitem>
    <listitem>
     <para>
      Rebuild developer-manual and tidy with 'HTML Tidy for FreeBSD version 5.8.0'.
     </para>
    </listitem>
    <listitem>
     <para>
      Update developer manual with new macOS packaging instructions.
     </para>
    </listitem>
    <listitem>
     <para>
      Note that the FreeBSD installation instructions work for
      ElectroBSD as well.
     </para>
    </listitem>
    <listitem>
     <para>
      Note that FreeBSD/ElectroBSD users can try to install Privoxy
      as binary package using 'pkg'.
     </para>
     </listitem>
    </itemizedlist>
   </para>
  </listitem>
 </itemizedlist>
</para>
