v1.11.1-beta
Security release — upgrading is recommended, especially for hosted or multi-tenant setups. Thanks to the researchers who reported these privately.
Security
- Webhook SSRF — URLs were only checked at save time; redirects were followed anywhere and IPv6 transition addresses bypassed the filter. Delivery now re-validates, pins the resolved address, and checks every redirect hop — thanks @tonghuaroot, @de3erve, @JaimeRamirez-coder, @senti-man, @angelystor, @1amplant, @tikket1, @Fewword, @dizconnectz
- Formula injection in exports — buyer-supplied names and answers were written as live spreadsheet formulas; now written as text — thanks @senti-man
- Order completion race — concurrent requests could complete an order twice, duplicating attendees and exhausting capacity — thanks @tonghuaroot
- Sale windows not enforced at checkout — products and price tiers could be bought before going on sale, after closing, or at an expired tier — thanks @angelystor
max_per_orderbypass — the limit was applied per order line, so repeating a product multiplied it — thanks @angelystor- Product ownership not checked — questions, capacity assignments and check-in lists accepted products from other events, and cross-event edits detached the owner's products — thanks @Fewword
- Promo code enumeration — the public lookup endpoint is now throttled — thanks @senti-man
- Cross-event question tampering — editing or deleting a question via another event rewrote its product links and deleted its answers
Fixes
- Order, attendee, product and check-in webhooks now dispatch on the queue instead of inline
Other changes
- Update contact message by @daveearley in #1270
- Update email subject by @daveearley in #1271
Upgrading
No migrations or config changes. Three behaviour changes worth knowing: webhooks to endpoints that redirect to internal addresses now fail; webhook delivery runs on the queue, so a non-sync connection needs a worker; export cells starting with =, +, - or @ render as text.
Full Changelog: v.1.11.0-beta...v1.11.1-beta
Contributors
daveearley, angelystor, and 8 other contributors