OmniWeb 5.1.1 beta 1
Released Tuesday, May 3rd, 2005


Requires Mac OS X 10.3 or later (due to an issue with Java under 10.2 which can cause a crash).


Important

Fixed a problem that could cause "Too many redirects" errors on nytimes.com.
OmniWeb can now make use of the Java plug-in supplied by Apple with Tiger. We'll also continue to correctly use the plug-in on 10.3, but currently the plug-in under 10.2 will cause a crash.


Security

Fixed the "Arbitrary file disclosure vulnerability" in WebCore.
We don't allow access to local files from remote resources. When we load a local file, we check the referring address to see whether the request came from remote resources (any referrer that isn't another local file), and if it did we raise an exception (refusing the request). If the request for a local file has no referring address, we check to see whether it has any outer content and use that content's address to do our security check.
This issue was detailed here:

Decoding of IDN hostnames is now controlled by the DecodeIDNHostnames setting, which is turned off by default. This prevents an issue where International Domain Name support could be used to spoof other domains.
This issue was detailed here:



Internationalization

Several changes were made to facilitate localization of OmniWeb. We are including all localized resources with this release, even though some localizations are very incomplete.
Swedish and French localizations have been updated for this release. (Thanks Corentin Cras-Méneur and Peter Baeckstrom!)
If you are interested in working on a localization of OmniWeb please contact omniweb5@omnigroup.com.


Interface

Corrected an issue that could leave 'dirt' from the previous page behind when switching tabs.
Note there is still a drawing issue when using the zoom button on a window where scrollbars are displayed prior to the zoom but not afterwards.

Updated the OmniOutliner icon on the unlicensed page.
A 'Safari' option has been added to the preconfigured font style settings in the Page Appearance preferences.
In some cases the autocomplete popup on the location bar could become detached and cause a crash. This has been fixed.
You can now force the address completion window to be at least a certain width by setting the new AddressAutocompleteMinimumWidth default. (It currently defaults to 0.)
Fixed a problem where "transparent" text would render in random colors; sometimes invisible, sometimes picking up another random color off the page.


Other

OmniWeb was using private API to draw text shadows on Mac OS X 10.2 and 10.3. This was causing errors to be logged to the console where there is public API available under Tiger. Now, we use the public API when running on Tiger and fall back to the private API on older systems.
Updated our content-type guesser to be smarter about PDF files, preventing them from displaying as text in the browser window under more circumstances.
Work has been done to reduce AppleScript-related errors being logged, though there are still some remaining issues we need to solve.
Fixed a regression from 5.0 where clicking links would have no effect on some pages whose styles modify the active link.
OmniWeb now detects keys held during startup sooner, meaning you can hold the shift key down right after starting OmniWeb and let go much sooner than before while still having OmniWeb recognize you had the key down.
Fixed a problem where OmniWeb would pause (doing a hostname lookup for the local host) for up to 30 seconds on some users' systems.
Fixed a bug where going back to a cached page in history would cause a delay in the tab thumbnail updating to reflect the change.