Release: Merge back 2.49.1 into dev from: master-into-dev/2.49.1-2.50.0-dev

[github-actions]

Release triggered by rossops

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request contains sensitive edits to multiple files including Python and shell script files, and also includes potential security risks such as a hardcoded weak password in Docker documentation and information disclosure in webhook payloads that expose user personal information.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in docker/entrypoint-nginx.sh

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templatetags/display_tags.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/templatetags/navigation_tags.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Hardcoded Weak Password in Documentation in readme-docs/DOCKER.md

Vulnerability

Hardcoded Weak Password in Documentation

Description

The documentation for Docker Compose includes an example command to change the admin password that contains a hardcoded, weak password ('Password123!'). There is no prominent warning or instruction advising users to change this password to a strong, unique one, or to use a placeholder. This could lead to users deploying instances with a known, easily guessable admin password, making them vulnerable to unauthorized access.

django-DefectDojo/readme-docs/DOCKER.md

Lines 152 to 162 in e335e63

	docker compose exec -it uwsgi ./manage.py changepassword admin
	```
	Alternatively, you can run the command below to change the admin password in a single command. Useful for automation.
	```zsh
	docker compose exec uwsgi ./manage.py shell -c 'from django.contrib.auth.models import User; u = User.objects.get(username="admin"); u.set_password("Password123!"); u.save()'
	```
	# Logging
	For docker compose release mode the log level is INFO. In the other modes the log level is DEBUG. Logging is configured in `settings.dist.py` and can be tuned using a `local_settings.py`, see [template for local_settings.py](../dojo/settings/template-local_settings)). For example the deduplication logger can be set to DEBUG in a local_settings.py file:

Information Disclosure in Webhook Payload in dojo/templates/notifications/webhooks/subtemplates/user.tpl

Vulnerability

Information Disclosure in Webhook Payload

Description

The user.tpl template, which is included in various webhook notification payloads, explicitly exposes sensitive user information. This includes the user's ID, email address, username, first name, last name, and UI/API URLs. This data is transmitted in webhook events, creating a risk of information disclosure if the webhook endpoint is untrusted or the communication is intercepted. There is no apparent mechanism within the application's configuration to control or redact this PII from the webhook payloads.

django-DefectDojo/dojo/templates/notifications/webhooks/subtemplates/user.tpl

Lines 1 to 16 in e335e63

	{% load display_tags %}
	{% load as_json %}
	{% if user %}
	{% url 'view_user' user.id as user_url_ui %}
	{% url 'user-detail' user.id as user_url_api %}
	user:
	id: {{ user.pk }}
	email: {{ user.email | as_json_no_html_esc }}
	username: {{ user.username | as_json_no_html_esc }}
	first_name: {{ user.first_name | as_json_no_html_esc }}
	last_name: {{ user.last_name | as_json_no_html_esc }}
	url_ui: {{ user_url_ui | full_url | as_json_no_html_esc }}
	url_api: {{ user_url_api | full_url | as_json_no_html_esc }}
	{% else %}
	user: {{ user | as_json_no_html_esc }}
	{% endif %}

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.