Changelog

Current platform version: 3.1.1

Earlier history

Openclipart was born from Inkscape by Jon Phillips (rejon) as a graduate student in the Visual Arts department at UC San Diego. The first version of the site was an unfiltered PHP upload form he made for the Flags of the World project so Inkscape contributors could submit SVG flags. From that grew a public-domain SVG clip art library (2004).

Later package releases (for example 0.20 in 2010), the Openclipart 2.0 site built on Bassel Khartabil's Aiki Framework (2010), the 2013 rebrand, the 2019 outage, and the gift to community hosting are summarized on Wikipedia.

Openclipart on Wikipedia - history, Openclipart 2.0, rebrand, lockdown, and Fabricatorz hosting.

Before 3.x (summary)

  • 2004 - Origin: Inkscape / Flags of the World upload form by rejon (UCSD Visual Arts); Open Clip Art Library begins.
  • 2004–~2010 - Early packages on ccHost (the engine that powered ccMixter); downloadable collections for Linux and Windows.
  • 2.0 (2010) - Aiki Framework website; easier browse and upload. Powered by Bassel Khartabil's Aiki Framework (also known as Bassel Safadi), who joined Openclipart in 2008 and led much of the 2.0 platform work. Covered on Wikipedia as Openclipart 2.0.
  • 2013 - Scissors logo and site rebrand (still the 2.x line).
  • 2019 - Site offline after attack / account issues; plan for a new codebase.
  • 3.0.0 (2019-12-25) - Gifted to the community; hosted by Fabricatorz Foundation. Start of the public 3.x version line tracked below.

Tracked releases (3.x)

From 3.0.0 onward we publish product versions in VERSION and release notes here. Patch releases are mostly hardening and ops fixes; see each entry for details.

3.1.1 - 2026-10-18

Changed

  • Admin SPA (`/admin/`): blue header matching the compact site bar, with a clear Admin badge.
  • Shared login bridge: site session sets `ocal_sid`; Admin exchanges it for an API JWT via `GET /api/auth/from-site`. Admin password login also syncs a PHP site session via `POST /auth/session-sync`.
  • Site header shows an Admin link for usergroup 1.

3.1.0 - 2026-10-18

Changed

  • Compact site header: Search and Random sit in one slim green bar between the logotype and the top-right account menu (removed the tall second green search band).
  • Header Search/Random share the same solid button style; search field grows wider on desktop.

3.0.12 - 2026-10-18

Added

  • Public `/changelog` page: earlier history (with Wikipedia link) plus tracked 3.x release notes from `CHANGELOG.md`. Footer version links there.
  • Changelog earlier history credits [Bassel Khartabil](https://en.wikipedia.org/wiki/Bassel_Khartabil) for the Aiki Framework / Openclipart 2.0 era;

Fixed

  • Changelog release dates no longer show mojibake after the date separator (UTF-8-safe parsing).

3.0.11 - 2026-10-18

Fixed

  • OCP016: stop anonymous empty galleries — purge/shorten HTML edge cache; harden `get_total()` so browse shows real page counts; Browse CTA → `/search/`.

Security

  • OCP015: API dependency bumps (Node 20, jwt 9 / express-jwt 8, Sequelize 6, email-templates 13 / nodemailer 10). Production `npm audit` Critical **0**.

3.0.10 - 2026-10-17

Changed

  • Public PNG sizes are only **Small (400)**, **Medium (800)**, **Large (2000)** — matching the detail download buttons. Any other `/image/{N}px/` redirects to the nearest canonical size (edge defaults unknown sizes to Medium).

3.0.9 - 2026-10-17

Fixed / Hardened

  • OCP012: cap public `/image/` PNG delivery at **800px** (redirect larger sizes); sitemap no longer advertises 2000px — stops post-prune runder storms. SVG masters unchanged via `/download`.

3.0.8 - 2026-10-17

Fixed / Hardened

  • OCP014: stop WordPress/adminer probe `.php` from reaching PHP-FPM (`try_files`); edge-reject common probe paths; quiet missing `.svg` `open()` error_log noise.

3.0.7 - 2026-10-17

Fixed / Hardened

  • OCP011: 404 obsolete high-N `/sitemap-NNNN.xml` without running heavy OFFSET queries (stops crawl-driven Postgres storms after the 5000-per-page sitemap fix).

3.0.6 - 2026-10-17

Fixed / Hardened

  • OCP010: raise inner-nginx FastCGI buffers to stop `fastcgi_temp` warn spam on large PNG/SVG.
  • Missing artist: `get_artist` returns null; `/artist/` and `/loved_by/` 404 cleanly.

3.0.5 - 2026-10-17

Fixed / Hardened

  • OCP009: stop sitemap from redefining `CLIPART_PER_PAGE` (use `SITEMAP_CLIPART_PER_PAGE=5000` and pass limit into `get_cliparts`).
  • Gate router 404/405 `error_log` behind development.
  • Fix PNG `escape_string` fatal → ezsql `escape()`; correct inverted filename lookup branch; quiet PNG/PDF delivery debug logs in production.
  • Harden `Fav.php` empty result foreach; safer `pdf.php` referer / runder null handling.

3.0.4 - 2026-10-17

Added

  • Show live product version from `VERSION` in the site footer (OCP003).

Fixed / Hardened

  • Revproxy: percent-heavy `/tag/` rejects now match `$request_uri` (decoded `location` regex never saw `%XX`).

3.0.3 - 2026-10-17

Fixed / Hardened

  • OCP008: sanitize `get_by_ids` to positive integers only (stop broken `IN (...)` SQL from Manticore junk IDs).
  • Fix undefined `$query` on empty search; 404 early exit for missing detail pages; guard missing `upload_tags` on upload form POST.
  • Quiet production nginx noise: gate router `hander` and SVG delivery `error_log` lines to development only.
  • Revproxy: tighter `/tag/` length (80) + reject percent-heavy encoded spam paths.

3.0.2 - 2026-10-17

Fixed / Hardened

  • OCP007: disk reclaim on production; revproxy `/tag/` edge rejects, `worker_processes auto`, fail-fast proxy timeouts, stronger `/image/` cache + `X-Cache-Status`.
  • GIN index on `ocal_files.upload_tags` for cheaper tag membership lookups.

3.0.1 - 2026-10-17

Fixed

  • Fail-fast on abusive `/tag/` URLs: structural tag validation before SQL (`libs/tag_validation.php`, `pages/tag.php`).
  • Parameterized `get_by_tag_count` and short `statement_timeout` on tag queries (`api/Clipart.php`) to stop Postgres full-scan storms under crawl/spam load.

3.0.0 - 2019-12-25

Changed

  • Fabricatorz Foundation hosting era begins (site gifted to the community). Marks the public **3.x** line after Openclipart **2.0** (Aiki, 2010). Exact intermediate commits are not retrospectively numbered; **3.0.0** is the epoch for this versioning scheme.