Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at https://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Apache Commons FileUpload 1.6.0 Release Notes --------------------------------------------- The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.6.0. The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. This release requires Java 8. Changes in this version include: New features: o [1.x] Enable multipart/related on FileUpload #314. Thanks to mufasa1976, Jochen Wiedmann, Gary Gregory. o Add JApiCmp to the default Maven goal. Thanks to Gary Gregory. o Add partHeaderSizeMax, a new limit that sets a maximum number of bytes for each individual multipart header. The default is 512 bytes. Thanks to Mark Thomas. Fixed Bugs: o Replace use of Locale.ENGLISH with Locale.ROOT. Thanks to Gary Gregory. o Remove unused exception from FileUploadBase.createItem(Map, boolean). Thanks to Gary Gregory. o Migrate from deprecated API in DiskFileItem.getOutputStream(). Thanks to Gary Gregory. o Use try-with-resources. Thanks to Gary Gregory. o Port to Java 1.4 Throwable APIs (!). Thanks to Gary Gregory. o Remove -nouses directive from maven-bundle-plugin. OSGi package imports now state 'uses' definitions for package imports, this doesn't affect JPMS (from org.apache.commons:commons-parent:80). Thanks to Gary Gregory. o DiskFileItem.getInputStream() now uses NIO. Thanks to Gary Gregory. o Last statement in DiskFileItem.finalize() method should be a call to super.finalize(). Thanks to Gary Gregory. o org.apache.commons.fileupload.FileUploadBase.FileUploadIOException is now a proper Java 1.4-style exception (propagates its cause to super). Thanks to Gary Gregory. o Use java.util.Base64 instead of custom code. Thanks to Gary Gregory. Changes: o Bump Java from 6 to 8. Thanks to Gary Gregory. o Bump org.apache.commons:commons-parent from 62 to 84, upgrades Doxia from 1 to 2. Thanks to Gary Gregory. o Bump commons-io from 2.11.0 to 2.19.0. Thanks to Gary Gregory. o Bump javax.servlet:servlet-api from 2.4 to 2.5. Thanks to Gary Gregory. o Bump JUnit from junit:junit:4.13.2 org.junit.vintage:junit-vintage-engine from parent POM. Thanks to Gary Gregory. Historical list of changes: https://commons.apache.org/proper/commons-fileupload/changes.html For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Commons FileUpload website: https://commons.apache.org/proper/commons-fileupload/ Download page: https://commons.apache.org/proper/commons-fileupload/download_fileupload.cgi Apache Commons Team ------------------------------------------------------------------------------ Apache Commons FileUpload 1.5 RELEASE NOTES The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.5. The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Version 1.3 onwards requires Java 6 or later. No client code changes are required to migrate from version 1.4 to 1.5. Changes in version 1.5 include: New features: o Add a configurable limit (disabled by default) for the number of files to upload per request. Fixed Bugs: o FILEUPLOAD-293: DiskFileItem.write(File) had been changed to use FileUtils.moveFile internally, preventing an existing file as the target. o Improve parsing speed. Thanks to David Georg Reichelt. Changes: o Bump Commons IO to 2.11.0 o FILEUPLOAD-328 Switch from Cobertura code coverage to Jacoco code coverage. Thanks to Arturo Bernal. o Bump JUnit to 4.13.2 For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Apache Commons FileUpload website: https://commons.apache.org/proper/commons-fileupload/ ------------------------------------------------------------------------------ Apache Commons FileUpload 1.4 RELEASE NOTES The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.4. The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Version 1.3 onwards requires Java 6 or later. No client code changes are required to migrate from version 1.3.0 to 1.3.1. 1.4 Release Changes in version 1.4 include: New features: o Site: added security report Fixed Bugs: o FILEUPLOAD-252: DiskFileItem#write() could lose original IO exception o FILEUPLOAD-258: DiskFileItem#getStoreLocation() wrongly returned a File object for items stored in memory o FILEUPLOAD-242: FileUploadBase - should not silently catch and ignore all Throwables o FILEUPLOAD-257: Fix Javadoc 1.8.0 errors o FILEUPLOAD-234: Fix section "Resource cleanup" of the user guide o FILEUPLOAD-237: Fix streaming example: use FileItem.getInputStream() instead of openStream() o FILEUPLOAD-248: DiskFileItem might suppress critical IOExceptions on rename - use FileUtil.move instead o FILEUPLOAD-251: DiskFileItem#getTempFile() is broken o FILEUPLOAD-250: FileUploadBase - potential resource leak - InputStream not closed on exception o FILEUPLOAD-244: DiskFileItem.readObject fails to close FileInputStream o FILEUPLOAD-245: DiskFileItem.get() may not fully read the data Changes: o FILEUPLOAD-292: Don't create un-needed resources in FileUploadBase.java o FILEUPLOAD-282: Upversion complier.source, compiler.target to 1.6 o FILEUPLOAD-246: FileUpload should use IOUtils.closeQuietly where relevant o FILEUPLOAD-243: Make some MultipartStream private fields final Thanks to Ville Skytt�. For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Apache Commons FileUpload website: http://commons.apache.org/proper/commons-fileupload/ ------------------------------------------------------------------------------ Apache Commons FileUpload 1.3.3 RELEASE NOTES The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.3.3. The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Version 1.3 onwards requires Java 5 or later. No client code changes are required to migrate from version 1.3.0, 1.3.1, or 1.3.2, to 1.3.3 Changes in version 1.3.3 include: o FILEUPLOAD-279: DiskFileItem can no longer be deserialized, unless a particular system property is set. For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Apache Commons FileUpload website: http://commons.apache.org/proper/commons-fileupload/ ------------------------------------------------------------------------------ No client code changes are required to migrate from version 1.3.1 to 1.3.2. Changes in version 1.3.2 include: o FILEUPLOAD-272: Performance Improvement in MultipartStream. Prevents a DoS (CVE-2016-3092) For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Apache Commons FileUpload website: http://commons.apache.org/proper/commons-fileupload/ ------------------------------------------------------------------------------ Apache Commons FileUpload 1.3.1 RELEASE NOTES The Apache Commons FileUpload team is pleased to announce the release of Apache Commons FileUpload 1.3.1. The Apache Commons FileUpload component provides a simple yet flexible means of adding support for multipart file upload functionality to servlets and web applications. Version 1.3 onwards requires Java 5 or later. No client code changes are required to migrate from version 1.3.0 to 1.3.1. This is a security and maintenance release that includes an important security fix as well as a small number of bugfixes. Changes in version 1.3.1 include: Fixed Bugs: o SECURITY - CVE-2014-0050. Specially crafted input can trigger a DoS if the buffer used by the MultipartStream is not big enough. When constructing MultipartStream enforce the requirements for buffer size by throwing an IllegalArgumentException if the requested buffer size is too small. This prevents the DoS. o When deserializing DiskFileItems ensure that the repository location, if any, is a valid one. Thanks to Arun Babu Neelicattu. o Correct example in usage documentation so it compiles. For complete information on Apache Commons FileUpload, including instructions on how to submit bug reports, patches, or suggestions for improvement, see the Apache Apache Commons FileUpload website: http://commons.apache.org/proper/commons-fileupload/