wirelab: wydania / releases

Odznaki rang 1.2.0

Thu, 01 Oct 2026 14:34:48 +0000

Added

Update notices on the ACP page: "Version X is available — what's new", linking to the release notes. The plugin fetches https://updates.wirelab.pl/api/nodebb-plugin-rank-badges.json at most once a day (in the background and when the ACP page is opened, from a cache kept in the database; an hour after a failed attempt) with a plain GET: no query string, no cookies, no data about the forum, User-Agent: nodebb-plugin-rank-badges/<version>, 5 s timeout. Network errors are logged at verbose level only.
"Check for updates" switch on the ACP page, on by default, saved on its own (settings hash rank-badges-update-check). When it is off, no request is made at all.
lib/update-check.js, shared by the wirelab plugins; no new dependencies.

Ikony tematów 1.2.0

Thu, 01 Oct 2026 14:33:41 +0000

Added

Update notices on the ACP page: "Version X is available — what's new", linking to the release notes. The plugin fetches https://updates.wirelab.pl/api/nodebb-plugin-topic-icons.json at most once a day (in the background and when the ACP page is opened, from a cache kept in the database; an hour after a failed attempt) with a plain GET: no query string, no cookies, no data about the forum, User-Agent: nodebb-plugin-topic-icons/<version>, 5 s timeout. Network errors are logged at verbose level only.
"Check for updates" switch on the ACP page, on by default, saved on its own (settings hash topic-icons-update-check). When it is off, no request is made at all.
lib/update-check.js, shared by the wirelab plugins; no new dependencies.

Shoutbox 1.2.0

Thu, 01 Oct 2026 14:32:45 +0000

Added

Update notices on the ACP page: "Version X is available — what's new", linking to the release notes. The plugin fetches https://updates.wirelab.pl/api/nodebb-plugin-wirelab-shoutbox.json at most once a day (in the background and when the ACP page is opened, from a cache kept in the database; an hour after a failed attempt) with a plain GET: no query string, no cookies, no data about the forum, User-Agent: nodebb-plugin-wirelab-shoutbox/<version>, 5 s timeout. Network errors are logged at verbose level only.
"Check for updates" switch on the ACP page, on by default, saved on its own (settings hash shoutbox-update-check). When it is off, no request is made at all.
lib/update-check.js, shared by the wirelab plugins; no new dependencies.

Shoutbox 1.1.2

Thu, 01 Oct 2026 12:39:00 +0000

Security

Use express-rate-limit for the request limits. The ACP page limit is unchanged (60 loads per minute per user) and now comes from express-rate-limit (new dependency), which replaces lib/ratelimit.js.

Odznaki rang 1.1.2

Thu, 01 Oct 2026 12:37:56 +0000

Security

Use express-rate-limit for the request limits. Unchanged (60 ACP page loads and 300 ladder requests per minute per user, guests per IP address, IPv6 grouped by /56) and now come from express-rate-limit (new dependency), which replaces lib/ratelimit.js.

Ikony tematów 1.1.2

Thu, 01 Oct 2026 12:37:52 +0000

Security

Use express-rate-limit and rebuild upload paths from a fixed directory. Request limits are unchanged (20 uploads, 60 ACP page loads and 300 API requests per minute per user, guests per IP address, IPv6 grouped by /56) and now come from express-rate-limit (new dependency), which replaces lib/ratelimit.js. The path of an uploaded file is rebuilt from the system temporary folder fixed at start-up and the bare file name, which must be a multer name (32 hex digits); it must still be a regular file and not a symbolic link.

Ikony tematów 1.1.1

Thu, 01 Oct 2026 11:24:37 +0000

Security

Uploads: only multer's temporary file is read, copied and deleted. Its path must resolve to a regular file inside the system temporary folder, without .. segments and not through a symbolic link (lib/safe-path.js); anything else is refused. Applies to icon and category cover uploads.
The clean-up of unused uploaded files accepts plain file names inside the plugin's upload folder only.
Request limits per user (guests: per IP address), counted in memory without new dependencies (lib/ratelimit.js): 20 uploads per minute, checked after the administrator check and before the file is received; 60 loads of the ACP page per minute; 300 requests per minute to the choices and icons API routes. Above the limit the answer is 429 with Retry-After.
Icons re-rendered in the viewer's language are built from the icon data with DOM methods (the URL checked again), no longer by inserting HTML from the API response.
Findings reported by Snyk Code (CWE-23, CWE-770, CWE-79).

Shoutbox 1.1.1

Thu, 01 Oct 2026 11:23:54 +0000

Security

The ACP page (active mutes and moderation log) is limited to 60 loads per minute per user, counted in memory without new dependencies (lib/ratelimit.js); above that the answer is 429 with Retry-After. Finding reported by Snyk Code (CWE-770).

Odznaki rang 1.1.1

Thu, 01 Oct 2026 11:23:29 +0000

Security

ACP preview and badges re-rendered in the viewer's language are built with DOM methods from the badge data that the ladder route now also returns (view: classes, data attributes, colour, image, icon, bar, plain-text name and label; lib/badge-dom.js). Classes, colours, icons and image URLs (forum paths or https only) are checked again in the browser; no HTML from the response is inserted any more. html stays in the response for other consumers.
Request limits per user (guests: per IP address), counted in memory without new dependencies (lib/ratelimit.js): 60 loads of the ACP page and 300 requests to the ladder route per minute. Above the limit the answer is 429 with Retry-After.
Findings reported by Snyk Code (CWE-79, CWE-770).

Ikony tematów 1.1.0

Thu, 01 Oct 2026 10:07:52 +0000

Added

Topic covers, working with NodeBB's topic thumbnails. A topic without thumbnails can show the first image of its first post (forum uploads; images from other sites only when allowed in the ACP) or the default cover of its category, in that order. Covers are added at display time and never saved as thumbnails, so a changed category cover shows everywhere at once. Each part can be switched off; the first image and images from other sites are off by default.
The first image is looked up once per first post (topic field coverScan), again when the first post is edited, so an image removed in an edit takes the cover away immediately; code blocks and comments are skipped.
Uniform frame for topic thumbnails in lists and in the topic header: 4:3 or square, cropped, rounded, also in topic lists on phones (optional), dark mode through Bootstrap variables, topic title as alt text; CSS custom properties --topic-cover-* for themes.
ACP: "Topic covers" section and a default cover per category (upload, site path or https URL), with a separate admin-only upload route (upload-cover) for PNG, JPEG, WebP, GIF and SVG up to 2 MB; unused uploaded covers are deleted on save.
topicCover in topic data for themes.

Changed

The ACP upload checks accept a list of types and a size limit per kind of upload; JPEG and GIF are recognised by content (icons still accept PNG, WebP and SVG only).

Shoutbox 1.1.0

Thu, 01 Oct 2026 07:50:37 +0000

Added

The widget can be collapsed (*Collapse chat* / *Show chat*). When it is the only widget in the sidebar, the sidebar column disappears on large screens and the page takes the full width, with a narrow tab to bring it back; next to other widgets and on phones it folds to one line.
The state is remembered in localStorage and applied before the first paint by a small inline script in <head> (no layout jump); aria-expanded / aria-controls, reduced motion respected.
en-GB and pl strings widget.collapse, widget.expand.

Rozwiązane tematy 1.1.1

Thu, 01 Oct 2026 00:00:00 +0000

Prywatny plugin, aktualizacja skryptem wirelab. / Private plugin, updated with the wirelab deployment script.

Karta projektu 1.1.0

Thu, 01 Oct 2026 00:00:00 +0000

Prywatny plugin, aktualizacja skryptem wirelab. / Private plugin, updated with the wirelab deployment script.

Shoutbox 1.0.0

Wed, 30 Sep 2026 23:14:20 +0000

First release. Requires NodeBB 4.15 or newer and Node.js 22 or newer.

Added

Dock on every page (a modal bottom sheet on phones) with unread counter, mention marker, "new messages" pill, older messages on demand and the number of users online; /?shoutbox=open opens it.
Widget with the three latest messages and a button that opens the dock.
Messages over the NodeBB websocket, stored in the NodeBB database (Redis, PostgreSQL, MongoDB); kept for 7 days or up to 2000 messages.
Plain text with inline Markdown, http(s) autolinks, @mentions with suggestions and notifications, emoji through nodebb-plugin-emoji; everything rendered and escaped on the server.
Global privileges shoutbox:read, shoutbox:write, shoutbox:moderate, granted once on first start to guests / registered users / Global Moderators.
Writing rules configurable in the ACP: confirmed email, minimum account age, minimum forum posts, links from a rank level of nodebb-plugin-rank-badges or from a number of posts, rate limit.
Moderation: delete messages, mute for 15 min, 1 h, 24 h or permanently with a reason; active mutes and a moderation log in the ACP.
Configurable chat name (default: "Live" / "Na żywo" from the language files).
Optional rank badge images next to names (nodebb-plugin-rank-badges).
Accessible dock and mention list; reduced motion respected; colours as --sb-* custom properties.
en-GB and pl translations.

[1.1.1]: https://github.com/nairdaweb/nodebb-plugin-wirelab-shoutbox/compare/v1.1.0...v1.1.1 [1.1.0]: https://github.com/nairdaweb/nodebb-plugin-wirelab-shoutbox/compare/v1.0.0...v1.1.0 [1.0.0]: https://github.com/nairdaweb/nodebb-plugin-wirelab-shoutbox/releases/tag/v1.0.0

Ikony tematów 1.0.0

Wed, 30 Sep 2026 23:08:54 +0000

First release. Requires NodeBB 4.15 or newer and Node.js 22 or newer.

Added

Icon picker in the composer (nodebb-plugin-composer-default) for new topics and when editing the first post, with the icons of the selected category and a preview of the topic row. Keyboard support (arrow keys, Home, End), focus returns to the button; the pick is kept in drafts; a current icon that is no longer available is marked and can be replaced or removed.
ACP page: icon library (upload, rename, order, categories, active, remove with confirmation), per-category and forum-wide default icons, "who can choose" setting, display switches; category tree, warning about unsaved changes and about a missing group (a chooser group that no longer exists stays selected and is marked); validation in the browser and on the server.
Icons in topic lists and the topic header, with topicIcon in template and API data and a client-side fallback for themes without a slot; names in the viewer's language, also for guests on API routes and for topic lists loaded through API v3.
Server-side rules for the picked icon: checked when a topic is posted, when it is put in the post queue and when the first post is edited; removing an icon needs the same right as setting one; an icon that became invalid while a topic waited in the queue is dropped on approval; a topic moved to a category where its icon is not available loses it.
Removing an icon from the library clears it from its topics (per-icon index) and deletes uploaded images no icon uses.
getTopicIcons(tids, { lang }) for other plugins and themes.
Admin-only upload route (the administrator check runs before the file is received) with CSRF, type/content/size checks, refusal of SVGs with scripts, event handlers (also <svg/onload=…>), external links or external style resources, and unique file names.
Eight built-in SVG icons; en-GB and pl translations.

[1.1.1]: https://github.com/nairdaweb/nodebb-plugin-topic-icons/compare/v1.1.0...v1.1.1 [1.1.0]: https://github.com/nairdaweb/nodebb-plugin-topic-icons/compare/v1.0.0...v1.1.0 [1.0.0]: https://github.com/nairdaweb/nodebb-plugin-topic-icons/releases/tag/v1.0.0

Odznaki rang 1.1.0

Sun, 27 Sep 2026 20:09:49 +0000

Changed

Zero thresholds: level 1 is the starting rank; for every other rank a threshold of 0 means "no requirement" and never grants the rank by itself. In "reputation only" mode the default ladder no longer puts every new user (also with negative reputation) at level 2; in "posts only" mode a rank with only a reputation threshold is no longer free. A later rank whose counted thresholds are all 0 cannot be reached, and the ACP says so.
Empty rank list means no rank badges; the default ladder is used only until the settings are saved for the first time (previously an empty list silently brought back the six default ranks).
Group precedence: administrators, then Global Moderators (including category moderators when enabled), then the other groups in list order. A category moderator who is also in another listed group now gets the Moderator badge.
Reputation disabled: every mode counts posts only, so posts and profiles show the same rank.
Hidden groups: their badges are not shown unless the new per-group "Show if hidden" option is on; even then the group name is left out of data-group and of rankBadge.group. Badges of groups that do not exist are not shown.
Group badges with a colour pick black or white text from the colour's luminance.
Level bars of ladders with more than 10 ranks show "level/total"; long names end with an ellipsis.
The public ladder route returns 403 to viewers who cannot read any category, and now also lists group badges (without group names) and an id per badge.
Requires Node.js 22 (as NodeBB 4.16 does). The redundant en-US language files were removed; en-US and other languages fall back to en-GB.

Fixed

Badges in the viewer's language after ajaxify navigation, on infinite scroll, for new replies pushed over the websocket and in API responses (previously the forum default language).
Translation tokens typed in rank or group names were expanded in aria-label and title. Labels are now translated with a placeholder and the escaped name is inserted afterwards; [ and ] are encoded as [ / ], which NodeBB's translator leaves alone.
A badge rendered from the old settings could stay cached after the settings were saved (race between rendering and invalidation). Caches are written only when the settings did not change in the meantime, and rendered badges are keyed by the settings generation.
Caches use least-recently-used eviction instead of being emptied when full, so many ?lang= values on the public ladder route no longer flush the badges in use.
ACP: saving shows a confirmation or the error; a failed load disables saving instead of letting the defaults overwrite the stored settings.
ACP: thresholds such as 1e3 were saved as 1; only integers written with digits are accepted now, in the ACP and on the server.
ACP: a rank without a name was saved and shown as an empty badge; it is refused now, and a rank without any name renders as "Rank N".
ACP: names in languages removed from "Languages for rank names" stayed active but invisible; they are deleted on save.
Upload with relative_path: only a leading prefix is removed (a file named forum-logo.png on a forum in /forum lost part of its name).
Upload: the file type (PNG, JPG, WebP, GIF, SVG) and size (512 KB) are checked in the browser, and each file gets a unique name, so uploads no longer overwrite each other.
An image that fails to load falls back to the level bar, the group icon or a generic icon, also when the level bar is turned off.
Presets: every folder in presets/ with a preset.json is offered, as documented (previously only wirelab); preset ids and image file names are validated.
Zero-width and bidirectional control characters are removed from names.
Inaccurate code comments and documentation (escaping, upload checks, search results).

Added

ACP translated into English and Polish, with validation errors and warnings (ranks out of order, equal or unreachable ranks, empty rank list, missing or hidden groups, reputation disabled).
Server-side validation of the settings (filter:settings.set).
referrerpolicy="no-referrer" on badge images.
Tests for the rank rules, validation, group precedence, escaping with a translator, hidden groups, contrast, language choice and the LRU cache; the logic moved from library.js to lib/.

Removed

Unused translation key ladder.title.