- Updated examples to ensure they show results of the same page/book.
- Added method to controller to share the same request data logic.
- Tweaked tests.
This specifically alters the checkbox label implementation to use the
existing checkbox label instead of always adding an extra label to the
custom checkbox element itself, unless they diverge (like for permission
checkboxes).
Prevents the same IDs from different systems leading to access of other
accounts, and allows registration of same ids under different services.
Thanks to Google and Ada Logics for discovery and reporting.
Cells could have an 'align' attribute, especially when created via
markdown. This updates the allow filtering to retain valid align values
on table cells.
For #6167
Updated LDAP group handling to properly handle empty group values by
checking the explode's count property instead of performing a general
array count.
Also updated logic with DN validation/filtering before LDAP calls are
made.
For #6088
For #6181
Just in users' my account area for now.
To add to admin-level actions in the future once we can better trace
session life.
Updated/added tests to cover.
Also changed the UI based forms to submit as changelog instead of
summary to align with more sensible name used on the API.
Added testing to cover.
For #6162
Actually registered the SFTP protocol with HTMLPurifier to allow SFTP
links.
Replaced the default MakeAbsolute URI filter for HTMLPurifier so that
fragment based links are allowed, and are not forced to have a base URL
and/or protocol.
For #6178, Related to #6186
Fixed lack of permission update scope in permission builder where
trashed pages on chapter permission updates would not get permission
updates.
Also added permission rebuild on restore as an extra assurance.
Added tests to cover.
Thanks to SVO — svo.com.br for reporting.
- Updates ZIP imports to validate that actual mime type of book cover
images to ensure they are a supported image file.
- Updates lower level ImageStorage to validate extensions of images when
cleaning their name pre-storage.
- Updates ZIP import Image and Book handling so book cover and image
files have their extension forced from file mime types in the same
way.
Added testing to cover.
Thanks to the submersion.ai security research team for reporting.
The lack of the filter could result in draft pages, from other users,
showing in locations like search results.
Thanks to Ahmed Ibrahim (github.com/skeletonsec) for reporting.
To prevent the ability to use the draft publish endpoint on non-draft
pages which the user may not have the ability to update by default.
Thanks to SVO for reporting.
Mainly to prevent non-image files being streamed in scenarios where the
underlying image data is somehow a non-image.
Thanks to Emanuele Cervelli (https://github.com/M4nu02) for reporting.
Specifically check the mime type of Base64 drawing data to ensure
that it reads as image data rather than anything else which could be
potentially dangerous.
Thanks to Emanuele Cervelli (https://github.com/M4nu02) for reporting.
On the change of an attachment uploaded_to (page) this ensures that a
PageUpdate permission check is made against the original attachment
page, in addition to the new page.
Thanks to Wade Sparks / ByteMe.Red for reporting.
So that their metadata can be read without having to create instances
and fullfill dependancy injection just to list.
Also added title to interface prefs page.
Updated endpoint image querying to generally follow the same logic to
ensure filtering on just the expected types which are intended to be
managed by this endpoint, and it err on the side of caution in terms of
access control.
Updated exception handler to reduce the amount of detail shown to
prevent potentially sensitive details (like internal paths) being shown
in the error message.
Added an interface for specifically marking exceptions whos messages we
may want to show.
Thanks to Tanner Marks for reporting.
- Added more complex srcset parsing and URI handling via custom built
HTMLPurifier filter, which I've also provided upstream.
- Added a custom URI filter to force require URI schemes.
- Adds a dummy hash attempt to balance the time of unknown user login
attempt with known user login attempt to help prevent timing being
used to indicate existing accounts.
- Adds some random variance to failed login attempts to help prevent
timing based information discovery.
Thanks to Tanner Marks for their responsible disclosure of this.
Thanks to Ashutosh Jena(MAVERICK-VF142) for reporting.
Not considered a significant security issue since it already required
page update permissions, which would generally be considered higher
privileged than the added page view.
Added a central URLFilter class to check & clean URLs used for
attachments, which is also used for validation, and by the purifier to
standardise protocols (and to make protocol config easier in future).
Thanks to mfk25 for reporting.
Upstream libraries used did not specifically treat values in srcset as
URIs like other attributes, so this adds a simple filter for possible
bad values.
Updated tests to cover.
Thanks for Gurmandeep Deol for reporting.
Avoids providing responses with potential sensitive attachment info
before permission checks.
Added tests to cover.
Thanks to Rafael Castilho for reporting.
Updated allow list/purifier system to only allow file protocol use on
anchor hrefs to avoid potential security concerns with, after export,
content being auto loaded via interactive elements like
embeds/objects/videos etc...
Updated tests to cover.
Thanks to Gurmandeep Deol at Seneca Polytechnic for reporting.
