Updated endpoint image querying to generally follow the same logic to
ensure filtering on just the expected types which are intended to be
managed by this endpoint, and it err on the side of caution in terms of
access control.
Updated exception handler to reduce the amount of detail shown to
prevent potentially sensitive details (like internal paths) being shown
in the error message.
Added an interface for specifically marking exceptions whos messages we
may want to show.
Thanks to Tanner Marks for reporting.
- Added more complex srcset parsing and URI handling via custom built
HTMLPurifier filter, which I've also provided upstream.
- Added a custom URI filter to force require URI schemes.
- Adds a dummy hash attempt to balance the time of unknown user login
attempt with known user login attempt to help prevent timing being
used to indicate existing accounts.
- Adds some random variance to failed login attempts to help prevent
timing based information discovery.
Thanks to Tanner Marks for their responsible disclosure of this.
Thanks to Ashutosh Jena(MAVERICK-VF142) for reporting.
Not considered a significant security issue since it already required
page update permissions, which would generally be considered higher
privileged than the added page view.
Added a central URLFilter class to check & clean URLs used for
attachments, which is also used for validation, and by the purifier to
standardise protocols (and to make protocol config easier in future).
Thanks to mfk25 for reporting.
Upstream libraries used did not specifically treat values in srcset as
URIs like other attributes, so this adds a simple filter for possible
bad values.
Updated tests to cover.
Thanks for Gurmandeep Deol for reporting.
- Fixed issues picked up by PHPStan updates.
- Not sure why it was flagging the BookSorter issue, but swapping if
statements made it go away.
- Updated BookSortMapItem with modern syntax.
- Attempted to fix CI issues by adding DOM extension.
- Attempted to make migration CI more efficient via tmpfs
This is to reduce the amount of content which will be logged, since
these messages don't really indicate an actual system error but advise
the user of something which went wrong with their request.
Avoids providing responses with potential sensitive attachment info
before permission checks.
Added tests to cover.
Thanks to Rafael Castilho for reporting.
Updated allow list/purifier system to only allow file protocol use on
anchor hrefs to avoid potential security concerns with, after export,
content being auto loaded via interactive elements like
embeds/objects/videos etc...
Updated tests to cover.
Thanks to Gurmandeep Deol at Seneca Polytechnic for reporting.
## Details
<!-- Write details of your pull request in here -->
<!-- Include references to any relevant issues/discussions -->
## Checklist
<!-- Put an 'x' in between the brackets below to confirm these elements -->
- [ ] I have read the [BookStack community rules](https://www.bookstackapp.com/about/community-rules/).
- [ ] This PR does not feature significant use of LLM/AI generation as per the community rules above.
Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
Reviewed-on: https://codeberg.org/bookstack/bookstack/pulls/6139
- Removed unused import
- Added some trailing newlines to code files
- Prevented <hr>s confusing logic in MD editor
- Aligned logic to select end of header across editors
