2026-08-06
 - reject path traversal and non-gallery files in the f= URL parameter
 - auth form no longer echoes QUERY_STRING (XSS)
 - escape album title and breadcrumb names in HTML output
 - video files without a thumbnail show an icon
 - avoid PHP 8 warnings/fatals on missing thumbnails and invalid g= paths
 - tighten g= realpath check so album root is not a mere string prefix
 - fix slideshow timer (setTimeout was calling onloadtimer immediately)
 - URL-encode video src/poster/download links like photos already are
 - harden createthumb() against bad dimensions and free GD handles
 - create thumbnail cache directory as 0755 instead of world-writable 0777
 - align default $VIDEOSREGEX with qdconf (require extension at end of name)
 - link qdgal-custom.css only when the file is present
 - sort photos and galleries with natural order (photo2 before photo10)
 - recognize gif and webp photos; generate thumbnails when GD supports them
 - invalidate cached gallery covers when the gallery directory mtime changes
 - AUTOROTATE re-saves JPEGs at quality 92; warn in qdconf that originals are rewritten
 - add htaccess.example (Options -Indexes) for use with AUTH_PASS
 - hygiene: fix qdlang.php name in readme, html lang=, use $STR_VIDFILE, drop dead vars
 - harden AUTH_PASS: hash_equals, sha256 session token, HttpOnly cookie; require PHP 5.6+
 - escape favicon href; drop debug HTML comments; use https homepage link
 - relicensed from BSD to MIT

2023-05-07
 - added missing isthumbavailable() argument (fixes compat with PHP 7.4)
 - improved styling for mobile devices.

2020-11-12
 - thumbnails of subdirectories are cached for better performance,
 - thumbnail are stored in a separate directory (defaults to ".qdgal-cache"),
 - AUTOROTATE allows to automatically rotate jpeg files based on EXIF data,
 - video previews are available even without thumbnails (slow),
 - improved UI when viewing on small (mobile) screens,
 - configurable footer (through a footer.html file),
 - custom style can overload default styling through qdgal-custom.css,
 - a proper 404 status code is returned if url points to a non-existing file.

2018-01-26
 - Support for video files (requires a HTML5-enabled browser),
 - Password field (when enabled) gets auto-focus.

2017-08-05
 - Configurable favicon ($FAVICON),
 - qdgal can execute any command before creating thumbnails ($PRETHUMB_CMD),
 - Added an explicit control over browser's cache ($CACHELIMIT),
 - Global password protection (optional, $AUTH_PASS and $AUTH_TIME).

2017-05-20
 - Fixed handling of images that contain a '#' character in their filenames,
 - Slideshow is kept on if user clicks on next/prev links during a slideshow,
 - Slideshow link doesn't appear if no JS is available to avoid confusion,
 - Slideshow starts counting only once the image is fully loaded,
 - Unavailable next/prev links are shown with a special style (were hidden),
 - Translations are parsed as UTF-8 even if php.ini another default_charset,
 - Configurable bullet symbol for action links (was hardcoded to a star).

2017-05-13
 - Added the slideshow feature,
 - Thumbnail's timestamp is set to image's time to detect obvious changes.

2016-10-18
 - Language autodetection (English, French, German, Polish and Russian),
 - Fixed orientation of thumbnails if jpeg source has exif rotation applied,
 - Empty galleries inherit their cover from their first non-empty sub-gallery,
 - Configurable sorting orders for photos and galleries,
 - Original image is shown as thumbnail if actual thumbnail creation fails,
 - Sub-galleries can use customized CSS styles (disabled by default).

2016-10-14
 - Support for sub-galleries (ie. sub-directories within an album),
 - Thumbnails support,
 - Adaptations for PHP 5.3 compatibility,
 - Displaying an explicit error message when no photos are found in a gallery,
 - All URLs are escaped properly to avoid glitching on weird filenames.

2016-07-17
 - First public release.
