GeezerVison

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.2-ls296...v26.09.3-ls297

Remote Changes:

Security Release

• Update Instructions
• Update details on blog

This is a security release to address a range of vulnerabilities:

• Images & drawings could be unexpectedly accessed and modified when attached to inaccessible draft/trashed pages.
• Page editor personal draft content could be made visible to other users in certain scenarios.
• On book/chapter conversion, content could be wrongly permanently deleted when in the recycle bin.
• Attachment endpoints could indicate existence of non-accessible pages.

Updating is advised if any of the above scenarios are a concern to your use-case.

A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:

• CayCon (Reporter), VulnCheck (Coordinator)
• Tanna Zu (GitHub)
• Dickson Wu (SEAL & CertiK)
• Zeng Yu
• Efe Çam
• dracaryxxd

Full List of Changes

• Updated application PHP package versions
• Updated attachment validation, and page fetching, to avoid responses which indicate page existence.
• Updated image fetching to fully check access via page access, considering draft and trashed status.
• Updated revision diffing to filter on revision type.
• Updated chapter/book conversion to properly handle child items which are in the recycle bin.

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.2-ls295...v26.09.2-ls296

Remote Changes:

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.2-ls294...v26.09.2-ls295

Remote Changes:

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

CI Report:

N/A

LinuxServer Changes:

• Use vendor zip from upstream instead of composer for php deps, with fallback to composer if it fails by @aptalca in #303

Full Changelog: v26.09.2-ls293...v26.09.2-ls294

Remote Changes:

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

Contributors

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.2-ls292...v26.09.2-ls293

Remote Changes:

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.2-ls291...v26.09.2-ls292

Remote Changes:

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.1-ls290...v26.09.2-ls291

Remote Changes:

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

CI Report:

N/A

LinuxServer Changes:

• aadd upstream release notes by @aptalca in #300

Full Changelog: v26.09.1-ls289...v26.09.1-ls290

Remote Changes:

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated audit log to use the configured display timezone. Thanks to @assyrus-favolo. (#6170)
• Updated translations with latest changes from Crowdin. (#6229)
• Updated ZIP import handling to verify the actual uncompressed size before extraction.
• Updated PHP package versions.
• Fixed page permissions not being regenerated on chapter promotion. (#6226)
• Fixed API attachment list endpoint showing attachments for pages in the recycle bin. (#6194)

Thanks to ma4ter (GitHub) for responsibly reporting the ZIP import scenario.

Contributors

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.1-ls288...v26.09.1-ls289

Remote Changes:

Updating to v26.09.1

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.1-ls287...v26.09.1-ls288

Remote Changes:

Updating to v26.09.1