Skip to content

v1.11.3-beta

Pre-release
Pre-release

Choose a tag to compare

View all tags
@daveearley daveearley released this 24 Oct 00:08
v1.11.3-beta
c3b1301
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security fixes for 1.x. We recommend upgrading to v2.0.0; this release is for installs that need to stay on 1.x for now.

Upgrade note: rotate JWT_SECRET if you used the example value

Earlier versions shipped a fixed JWT_SECRET in backend/.env.example. If your install still uses that value (most likely if you set it up without Docker), anyone could forge login sessions for it. From this release, the backend refuses every request with a 503 while that value is configured, and logs why.

Generate a new secret before or right after upgrading:

php artisan jwt:secret --force

This signs everyone out. Docker installs that set their own JWT_SECRET (as the Docker instructions describe) are not affected.

Fixes

  • Organizer pages escape organizer-provided text in their structured data correctly.
  • backend/.env.example no longer ships an example JWT_SECRET or APP_KEY; the setup scripts and install guide now generate them.
  • Public check-in only accepts tickets for the check-in list's own event. Scanning another event's ticket now returns "Invalid attendee code detected" instead of naming the attendee.
Assets 2
Loading