Skip to content

v1.7.2-rc-1

Latest
Latest

Choose a tag to compare

View all tags
@nielsdrost7 nielsdrost7 released this 30 Jul 19:46
v1.7.2-rc-1
893e824

InvoicePlane v1.7.2 RC 1

Hash Format Hash
MD5 398d355d1bdfc5ca040386af781d6d8e
SHA-256 9ab69432acb07a9802d351fcfffc0bf061d5bb3e022d662bd63fa2006d5d6eaf

Many thanks to @drewangell, @Jannomag, @mpldr, and @PatrickGTR for their contributions to this release.

Huge thanks to @0raN9ewww, @5ud0er, @akgul7990, @alanturing881, @ali-iltizar, @capt-bl4ck0ut, @chakrapani150, @Char0n1507, @Chittu13, @cyabell, @de3erve-hunter, @EvidentObscurity, @FelipeSilvany, @FORIMOC, @geo-chen, @HuajiHD, @iiihaiii, @kitu232, @lighthousekeeper1212, @mattmumford-git, @PLpaPLpa, @QiaoNPC, @radoi-teodor, @tikket1, @tonghuaroot, @udaypali, @venkatesh2003631, and @Vijay-raghav7 for responsibly disclosing these vulnerabilities. Without you, this release wouldn't have been possible.

New Contributors

Improvements / Changes

Security & Stability

Full details — severity, CVSS, and GHSA advisories — are tracked in the Security Vulnerability Summary in .github/CHANGELOG.md.

  • #1505 Remote code execution via the writable templates directory closed by replacing dynamic filesystem template discovery with a static allowlist and ipconfig.php-based configuration; also closes five related open-redirect instances (GHSA-v735-2x3r-gwpp)
  • #1514 Password-reset tokens now expire, closing a broken-authentication window that previously allowed indefinite reuse (GHSA-5r28-6rw3-25c2)
  • #1512 Arbitrary file deletion via path traversal in the invoice-logo setting closed with path-traversal guards, symlink protection, and attachment-name XSS prevention (also completed in #1510) (GHSA-65v2-4g37-rxjw, GHSA-45vj-9p52-f8mq)
  • #1494 Password-reset tokens now use a cryptographically secure random_bytes(32) generator instead of a predictable md5(time()) seed (GHSA-jfgr-778p-m943)
  • #1479 SQL/DDL injection via the tax-rate decimal-places setting hardened with transaction-wrapped validation and unit tests (also completed in #1488) (GHSA-x6rh-cr7q-5w7j, GHSA-34g5-4hfc-g983)
  • #1513 Configuration injection in the database setup wizard blocked by rejecting newline characters in db_hostname and related fields (GHSA-ffq5-mw9f-mv6j)
  • #1471 Guest quote approve/reject and payment-gateway callbacks now enforce client scoping and require POST, closing a horizontal-privilege-escalation IDOR and a GET-based CSRF-equivalent vector reachable through email link prefetching (also completed in #1482, #1487) (GHSA-pjf5-c2m5-7m4x, GHSA-6xj3-274m-4mvg, GHSA-7r3g-fppx-2p79)
  • #1517 Guest invoice/payment endpoints gained a guest_visible() filter, closing an access-control bypass that exposed non-public invoices (also completed in #1537) (GHSA-f95x-25mh-wcxv)
  • #1491 Setup wizard locked after install (SETUP_COMPLETED), with an admin security-warning system, closing unauthenticated re-entry into the installer (also completed in #1511, #1518) (GHSA-37pr-q48j-46gg, GHSA-2j6j-6f6q-57vq, GHSA-jx5h-6r8f-m2h3)
  • #1622 CSRF via GET-based logo removal closed by converting the settings logo-removal links to POST forms with CSRF-token validation (GHSA-qx8h-35wf-cgqf)
  • #1559 Missing CSRF protection on invoice delete()/delete_invoice_tax() closed by requiring POST and a valid CSRF token (also completed in #1561, #1624) (GHSA-mhvh-4j3w-7pvj)
  • #1555 Authentication bypass via MD5 magic-hash type juggling hardened on the legacy auth path (GHSA-x66r-7wf6-wgv7)
  • #1621 Deactivated user accounts can no longer authenticate (GHSA-jw57-6692-jh2q)
  • #1620 Sensitive SUMEX invoice XML disclosure closed by writing to a non-web-accessible storage/temp/ directory (GHSA-583r-4pw9-6rc9)
  • #1623 Sensitive import CSV disclosure closed by denying direct web access to uploads/import/ (GHSA-wv2c-c285-9hrq)
  • #1626 Authorization bypass through a user-controlled key (IDOR) closed with can_user_access() / can_user_manage() object-level checks for clients, projects, invoices, and quotes (GHSA-h4xh-4jwc-485r)
  • #1545 Guest attachment access bypass closed — the guest Get controller now enforces the same guest-visible status check as the guest View controller (GHSA-phh5-3jc3-pm6w)
  • #1556 Sensitive financial data exposure via unauthenticated public invoice closed — the guest View controller now extends Guest_Controller and enforces client-ownership scoping (GHSA-9hx6-6h6f-2wq3)
  • #1573 Authenticated and second-order SQL injection via the custom_field_table identifier closed with a server-side allowlist and defense-in-depth sink guards (also completed in #1632) (GHSA-98vm-2r9v-mpgj, GHSA-vv4r-cgmw-w6x2)
  • #1630 SQL injection in the user/client name-search Ajax endpoint closed by replacing string-concatenated LIKE clauses with parameterized query-builder calls (GHSA-g7f2-mj3r-xx88)
  • #1615 Arbitrary local file read via mPDF file:// in the Sales-by-Year report closed (GHSA-j89p-m59x-86r9)
  • #1547 Local file inclusion via the SUMEX PDF template parameter closed by validating the template name in Sumex::pdf() and the guest SUMEX PDF actions before rendering (GHSA-wj6q-j965-2w2v)
  • #1616 Unauthenticated PayPal capture payment forgery closed by validating currency and amount against the invoice (GHSA-35qh-94hc-hm2w)
  • #1492 SSRF via admin-stored PDF footer content closed by sanitizing content before mPDF rendering (GHSA-vgq9-469p-q7j3)
  • #1515 Stripe/PayPal API credential exposure via HTML source closed (GHSA-8543-x4j8-jj4q)
  • #1574 Stored XSS via CSV import (payment method name) closed (GHSA-vm87-2qmm-rhg8)
  • #1516 Stored XSS in the Online Payment settings page (Stripe API key / PayPal client secret fields) closed with proper output escaping (GHSA-xvrc-hv8j-8v8w)
  • #1557 Invoice PDF passwords encrypted at rest instead of stored in plaintext (GHSA-vphv-wmr3-68fp)
  • #1496 Duplicate payment processing (Stripe callback replay) closed with a unique payment_external_id index (GHSA-6cpc-hr8h-xgr2)
  • #1486 Email-template preview XSS closed by rendering previews as sanitized/plain text instead of raw HTML (also completed in #1500, #1516, #1499) (GHSA-4wqv-84px-8jc6)
  • #1635 Stored XSS via unescaped client_email in invoice/quote mailer views closed (GHSA-477r-xmgc-vcvj)
  • #1583 Non-constant-time cron_key comparison in the recurring-invoice cron endpoint fixed (GHSA-jg68-6mqc-hxcr)
  • #1507 Optional EXIF metadata stripping from uploads added (SEC_STRIP_EXIF_FROM_IMAGES, off by default) (GHSA-7j67-2v6p-275v)
  • #1495 PHPMailer SMTP debug output no longer leaks into AJAX responses (internal audit finding)
  • #1567 Session & infrastructure hardening: cookie_httponly=true, default X-Frame-Options: SAMEORIGIN, session-fixation fix, password-reset log-injection sanitization, and a Referrer-Policy header (internal audit findings)
  • #1640 Authentication checkpoint hardened with strict comparison for the user_type/required_key session check (GHSA-346c-gqqq-mrm2, by @Char0n1507)
  • #1639 Log injection via unsanitized cron_key in Cron::recur() fixed (GHSA-g53q-v2pv-xr83, by @Char0n1507)
  • #1638 IDOR closed: the primary administrator's password can no longer be changed by another admin (GHSA-x38q-xhjj-jr8w, by @Char0n1507)
  • #1637 CSRF token validation added to seven delete-style endpoints that relied only on a URL-substring check (GHSA-9372-vj68-hmc3, by @Char0n1507)
  • #1636 CSRF bypass in Recurring::stop() via GET request closed (GHSA-qf9q-2hxm-4wh9, by @Char0n1507)
  • #1536 Review follow-ups: entrypoint.sh config-injection guard, XSS trait ordering fix, logo URL escaping, custom-template allowlisting, Mdl_reports cast fix
  • #1558 Quote PDF passwords encrypted at rest
  • #1560 Local file inclusion via the invoice XML-config identifier closed with strict allowlist validation before the config file is included (GHSA-9248-qccw-7x7j)
  • #1589 Session ID regenerated on login to prevent session fixation
  • #1604 csrf_meta/csrf_token_value refreshed on every XHR request (by @sudwebdesign)
  • #1605 CSRF_REGENERATE option added to ipconfig (by @sudwebdesign)

Other improvements

  • #1288 Re-introduced Stripe & PayPal, adding PayPal Advanced Credit Cards and Venmo support (by @drewangell)
  • #1376 QR-code size on invoices is now configurable
  • #1466 Move the setup-php-composer composite action into .github/actions/
  • #1483 Batch settings save: reduce DB queries from ~70 to 3 (transaction-wrapped)
  • #1490 Add a Laravel Pint code-style check
  • #1503 Add database indexes on frequently queried columns
  • #1509 Add the Docker application container (combined web server + PHP) (by @mpldr)
  • #1529 Document the arbitrary file-deletion vulnerability for CVE allocation
  • #1538 Add v1.7.2 PR/issue/security-advisory release table and security-improvements doc
  • #1548 Implement recipient determination logic in QrCode.php (by @Jannomag)
  • #1552 Remove orphaned docblock left after deduplication of Settings::remove_logo()
  • #1572 Client birthdate field support
  • #1603 Reorganize security documentation and update release notes for v1.7.2
  • #1607 fullpage-loader: move loader-error.svg into loader-error-message (by @sudwebdesign)
  • #1618 Setup now fails loudly when a migration SQL file cannot be read
  • #1627 Add php -l pre-push requirement to CLAUDE.md
  • #1629 GitHub Action release build automation
  • #1140 Remittance slip / QR-code remittance text
  • #1449 quote_templates/public showing the client on both header and footer
  • #1451 QR-code generation for batch invoice processing
  • #1465 Simplify redundant conditionals in email template tags
  • #1180 Undefined-array-key error for mPDF footer names on PHP 8.3+
  • #1478 Add the missing attachment() method to the guest Get controller
  • #1575 Fix MariaDB 1066 duplicate join on guest Payments page
  • #1576 Fix 7 pre-beta bugs found in security-hardening review
  • #1617 Harden migration SQL runner against semicolons in strings/comments
  • #1628 Misc fixes

Full Changelog: v1.7.1...v1.7.2-rc-1

Contributors

sudwebdesign, geo-chen, and 31 other contributors
Assets 3
Loading
0 Join discussion