pbek/QOwnNotes v26.5.1

Release v26.5.1

on GitHub

26.5.1

• Added a Reload button to the Note Bookmarks dialog to re-check bookmarks
  from disk without having to close and reopen the dialog
  (for #3589)
• The Store note bookmark sub-menu in Note / Navigation is now grayed out
  when the note editing panel does not have focus, making it clear that storing
  a bookmark requires the editor to be active (for #3589)
• Fixed several security issues (for #3591)
  • Fixed a plaintext password leak where a qDebug() call in
    restoreTrashedNoteOnServer() logged a QUrl containing the embedded
    server password
  • Changed the default value of the Ignore SSL errors network setting from
    true to false to prevent man-in-the-middle attacks on fresh installs
  • The MCP server CORS header was narrowed from the wildcard * to
    http://localhost to reduce the DNS-rebinding / localhost attack surface
  • The Linux dark-mode D-Bus check now invokes dbus-send directly instead of
    via /bin/sh -c, eliminating unnecessary shell interpretation
  • URLs typed without a scheme now default to https:// instead of http://
  • A table-name whitelist was added to generateDatabaseTableSha1Signature()
    to guard against SQL injection via concatenated table names
  • The FakeVim shell-filter (!) on Qt < 5.15 no longer passes the full
    command string to QProcess::start() (which invoked the shell); the
    executable is now split out and run directly in all Qt versions
  • The macOS updater temporary script file now has owner-only permissions
    (0700) set before its content is written, hardening against
    TOCTOU replacement by other local users
• Fixed IME candidate window overlapping text when typing with a Japanese (or
  other CJK) IME on Windows by overriding inputMethodQuery() in
  QOwnNotesMarkdownTextEdit to offset the reported cursor rectangle by the
  current viewport margins (for #3590)

Released files

• QOwnNotes-x86_64.AppImage: Portable Linux AppImage build with Qt 6
• QOwnNotes-x86_64.AppImage.sha256sum: SHA-256 checksum for the AppImage
• QOwnNotes-amd64.snap: Linux Snap build with Qt 6
• QOwnNotes-amd64.snap.sha256sum: SHA-256 checksum for the Qt 6 Snap package
• QOwnNotes-Qt5-amd64.snap: Linux Snap build with Qt 5 for older environments
• QOwnNotes-Qt5-amd64.snap.sha256sum: SHA-256 checksum for the Qt 5 Snap package
• QOwnNotes.zip: Windows ZIP package built with Qt 6
• QOwnNotes.zip.sha256: SHA-256 checksum for the Qt 6 Windows ZIP package
• QOwnNotes.zip.sha256sum: Alternative SHA-256 checksum file for the Qt 6 Windows ZIP package
• QOwnNotes.dmg: macOS disk image built with Qt 6
• QOwnNotesQt5.dmg: macOS disk image built with Qt 5 for older systems