A security release for the mobile apps. Notification taps and content shared into Ditto from another app now arrive as plain data instead of being assembled into code, so a hostile app on your phone can't use them to steer Ditto somewhere you never tapped. Links that try to bounce you off ditto.pub to another site are turned away too. Nothing else about the app changes.
Fixed
- Notification taps and shares from other apps are handled as data, closing off a path a malicious app on your device could have used to take Ditto somewhere you didn't ask for
- Links dressed up to look like ditto.pub addresses but pointing at another site are now rejected instead of followed