SummerCMS 0.2.3

Highlights

SummerCMS 0.2.3 adds breakwater, a Markdown renderer and HTML sanitizer for content your site's users submit. It is the release the new community plugins build on: forum, friends and groups, chat bots, web push notifications and video calls now run on SummerCMS and require 0.2.3.

Added

• breakwater module. breakwater.Render turns GitHub Flavored Markdown into HTML, and breakwater.Purify cleans HTML that arrives as HTML. Both apply one fixed allow-list: basic text formatting, headings, lists, quotes, code, tables and links. Images, scripts, iframes, forms, event-handler attributes, class and id are removed.
• Links may use http, https and mailto only. Every link gets rel="nofollow", and external links also open in a new tab with rel="noopener".
• Raw HTML inside Markdown is stripped, not shown as text, and the engine is safe for concurrent use. Use it for forum posts, comments and anything else that does not come from an administrator; admin rich text keeps its own policy.

Changed

• The "Extending plugins" guide now explains optional dependencies in Go terms. A plugin that integrates with another one only when it is installed still lists that plugin's module in its go.mod, because it imports the interface it looks up. Only Requires() leaves it out, so the plugin is optional at activation, not at compile time.