pbek/QOwnNotes v26.11.3

Release v26.11.3

on GitHub

26.11.3

• Fixed PDF exports adding extra margins beyond those selected in page setup,
  for both single notes and selected notes
  (for #3837)
• Fixed unsafe media and attachment paths being followed when copying, moving, or
  exporting notes (thank you, r3vpwnx)
  (for GHSA-fmqx-8x8h-gf76)
• Hardened file and folder names from notes, imports, the local trash and remote data, so they
  can no longer lead to files outside their folders being read, written or deleted
  (for #3836)
  • The Files navigation panel ignores media and attachment links that escape their folders
  • Note files, including notes created from wiki links or server data, are never stored outside
    the note folder
  • The Joplin import skips folder names and resource file extensions that point outside
    their folders
  • Trashed notes, and scripts from the script repository, are only used with plain file names
  • Exporting a note as HTML with embedded images only embeds files that are real images
  • Path-containment checks resolve symlinks while preserving symlinked root directories
  • Filename cleanup preserves new titles containing path punctuation without touching files
    at their original, unsafe paths
  • Media and attachment transfers reject symlink escapes while preserving links within
    their folders
  • Image filename extensions alone are not trusted when exporting HTML; extensionless
    images and long-header SVGs remain supported
  • Joplin imports reject folder and resource symlinks that escape the import or note folder
  • Local trash restoration rejects symlink destinations outside the note folder
  • Script installation and updates reject symlink escapes from the script repository
  • Creating notes from wiki links rejects subfolder symlinks that escape the note folder
• The 26.11.0 release of
  QOwnNotes for Nextcloud adds bookmark management
  • A Bookmarks dialog lists bookmarks from notes tagged bookmarks or named Bookmarks,
    compatible with QOwnNotes Desktop's Web Companion bookmarks and QOwnNotes Android bookmarks
  • Search and filter bookmarks by tags, open, edit or delete them, with changes saved to all
    bookmark notes containing them; editing includes a Markdown preview
  • Fixed notes failing to load with status code 423 when the note folder doesn't exist yet

Released files

• QOwnNotes-x86_64.AppImage: Portable Linux AppImage build with Qt 6
• QOwnNotes-x86_64.AppImage.sha256sum: SHA-256 checksum for the AppImage
• QOwnNotes-amd64.snap: Linux Snap build with Qt 6
• QOwnNotes-amd64.snap.sha256sum: SHA-256 checksum for the Qt 6 Snap package
• QOwnNotes.zip: Windows ZIP package built with Qt 6
• QOwnNotes.zip.sha256: SHA-256 checksum for the Qt 6 Windows ZIP package
• QOwnNotes.zip.sha256sum: Alternative SHA-256 checksum file for the Qt 6 Windows ZIP package
• QOwnNotes.msi: Windows installer built with Qt 6
• QOwnNotes.msi.sha256sum: SHA-256 checksum for the Qt 6 Windows installer
• QOwnNotes.dmg: macOS disk image built with Qt 6
• QOwnNotesQt5.dmg: macOS disk image built with Qt 5 for older systems