Actually registered the SFTP protocol with HTMLPurifier to allow SFTP
links.
Replaced the default MakeAbsolute URI filter for HTMLPurifier so that
fragment based links are allowed, and are not forced to have a base URL
and/or protocol.
For #6178, Related to #6186
Fixed lack of permission update scope in permission builder where
trashed pages on chapter permission updates would not get permission
updates.
Also added permission rebuild on restore as an extra assurance.
Added tests to cover.
Thanks to SVO — svo.com.br for reporting.
- Updates ZIP imports to validate that actual mime type of book cover
images to ensure they are a supported image file.
- Updates lower level ImageStorage to validate extensions of images when
cleaning their name pre-storage.
- Updates ZIP import Image and Book handling so book cover and image
files have their extension forced from file mime types in the same
way.
Added testing to cover.
Thanks to the submersion.ai security research team for reporting.
The lack of the filter could result in draft pages, from other users,
showing in locations like search results.
Thanks to Ahmed Ibrahim (github.com/skeletonsec) for reporting.
To prevent the ability to use the draft publish endpoint on non-draft
pages which the user may not have the ability to update by default.
Thanks to SVO for reporting.
Mainly to prevent non-image files being streamed in scenarios where the
underlying image data is somehow a non-image.
Thanks to Emanuele Cervelli (https://github.com/M4nu02) for reporting.
Specifically check the mime type of Base64 drawing data to ensure
that it reads as image data rather than anything else which could be
potentially dangerous.
Thanks to Emanuele Cervelli (https://github.com/M4nu02) for reporting.
On the change of an attachment uploaded_to (page) this ensures that a
PageUpdate permission check is made against the original attachment
page, in addition to the new page.
Thanks to Wade Sparks / ByteMe.Red for reporting.
Updated endpoint image querying to generally follow the same logic to
ensure filtering on just the expected types which are intended to be
managed by this endpoint, and it err on the side of caution in terms of
access control.
Updated exception handler to reduce the amount of detail shown to
prevent potentially sensitive details (like internal paths) being shown
in the error message.
Added an interface for specifically marking exceptions whos messages we
may want to show.
Thanks to Tanner Marks for reporting.
- Added more complex srcset parsing and URI handling via custom built
HTMLPurifier filter, which I've also provided upstream.
- Added a custom URI filter to force require URI schemes.
- Adds a dummy hash attempt to balance the time of unknown user login
attempt with known user login attempt to help prevent timing being
used to indicate existing accounts.
- Adds some random variance to failed login attempts to help prevent
timing based information discovery.
Thanks to Tanner Marks for their responsible disclosure of this.
Thanks to Ashutosh Jena(MAVERICK-VF142) for reporting.
Not considered a significant security issue since it already required
page update permissions, which would generally be considered higher
privileged than the added page view.
Added a central URLFilter class to check & clean URLs used for
attachments, which is also used for validation, and by the purifier to
standardise protocols (and to make protocol config easier in future).
Thanks to mfk25 for reporting.
Upstream libraries used did not specifically treat values in srcset as
URIs like other attributes, so this adds a simple filter for possible
bad values.
Updated tests to cover.
Thanks for Gurmandeep Deol for reporting.
- Fixed issues picked up by PHPStan updates.
- Not sure why it was flagging the BookSorter issue, but swapping if
statements made it go away.
- Updated BookSortMapItem with modern syntax.
- Attempted to fix CI issues by adding DOM extension.
- Attempted to make migration CI more efficient via tmpfs
