Features
- Add Word Clouds interaction (#254)
- Audit logs for rate limits and suspicious submissions
- Admin can disable a user (soft delete), re-enable them, or permanently delete a user with their events and audit logs (their interactions in other events are kept anonymously)
- Admin user details page lists the events owned by the user
- Disable and delete actions are on the admin user and event details pages
Fixes and improvements
- Fix the transcription API key appearing cleared one day after it was saved.
- Fix attendee page crashing when a poll option or vote click arrives after the presenter switched to another interaction.
- Fix scoring on CSV export of quizzes
Security
- Parse custom embeds into HTTP(S)-only iframe attributes and render escaped HTML.
- Improve URL filtering of embeds.
- Escape quiz titles, questions and options in QTI exports.
- Ignore client-supplied event ownership fields on updates; ownership can only be assigned when creating an event.
- Fix security enrollment for LTI platforms and admin option to disable the feature.
- Enforce one poll ballot per participant and one quiz submission per question, including concurrent requests.
- Prevent OIDC account takeover through email claims.
- Fix
disconnected_fromthat discloses event names by only filtering with UUID. - Restore
SAMEORIGINframing protection on/and/join.