Skip to content

v1.3.1

Choose a tag to compare

View all tags
@MichelleFindlay MichelleFindlay released this 24 Oct 11:41
· 5 commits to main since this release
v1.3.1
33740f4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Pillbox v1.3.1

A security release. It fixes the issues found by an automated code scan and an independent penetration test. Updating is recommended for everyone, especially if you share your Pillbox with a carer or partner.

🔒 Security

Sharing with a carer or partner

Each part's permission now applies wherever that information appears, not only on its own page.

  • Medicines: someone without access to Medicines doesn't see your medicines anywhere, including Care, Mind, the summaries and the report.
  • Readings: someone without access to Readings doesn't see your readings anywhere, including Diabetes, Blood pressure, Today and the report. Nor can they add them from the hypo guide, sleep log, Diabetes, Blood pressure or antenatal check-ups.
  • The report and CSV downloads only include the parts that have been shared. Downloads of anything else are refused.
  • Mind: Mind notes and check-in summaries stay hidden on appointments while Mind is locked, and blood pressure side-effect notes need Mind access.
  • Changing medicines from Care or Mind (logging a headache dose, marking a medicine returned, Mind's "mental health medicine" setting) needs Medicines permission.
  • Hidden Care categories: their checks, payments, periods and sleep can't be reached through another category.
  • Private medicines are left out of every shared view.

Signing in and accounts

  • Two-factor sign-in on every route: an authenticator app or security key is asked for with Microsoft and other single sign-on too.
  • Limits per account: wrong codes, PINs and passwords are counted per account, not per browser session. PINs are limited to 5 wrong tries in 15 minutes and 15 a day.
  • Changing your email address needs your current password, and your old address is told about the change.
  • Adding a password to a single sign-on account needs you to confirm it's you first.
  • Removing a forgotten Mind PIN needs a real sign-in, not a remembered device.
  • Single sign-on can only be started from Pillbox's own buttons.
  • Sign-up: checking whether usernames are taken is limited.
  • Microsoft pre-registration: a pre-registered Microsoft account is only linked by email for your own tenant or tenants you list by ID, never through '*' (any tenant).

New installs

  • Setup code: creating the first administrator needs a one-time code, found in storage/setup_code.txt on the server and in PHP's error log. This applies whether you use the setup page, single sign-on or sign-up.

Links and emails

  • Trusted site address: password reset links and other links in emails use your Pillbox's real address, never one taken from a forged request. Without a site address set, reset emails wait until an administrator has visited.

Medicine safety

  • "Log anyway" for a too-soon dose only works through Pillbox's own confirmation.
  • Daily maximum: an as-needed medicine's daily maximum is checked by the server.

The server

  • Notifications only go to the browsers' own push services.
  • The updater only downloads this Pillbox's own release from GitHub.
  • Nightscout needs https://.
  • Uploads: health uploads and stored photos are limited.
  • Private pages don't reveal by name which ones someone has used.
  • Deleting a medicine, or everything on a private page, cleans up fully.

🔧 Improvements

  • Damaged config: if config/config.php is empty or damaged (for example, overwritten by an upload), Pillbox explains what's wrong instead of showing a PHP error.
  • Changelog: "Check for updates" refreshes the in-app changelog too.

⬆️ Upgrading

Upload the new files over your current ones, keeping config/ and storage/. The database needs no changes.

After upgrading:

  • Set your site address under Admin → Site settings, so password reset emails can be sent.
  • If you share your Pillbox, check each person's permissions under Sharing. They now apply everywhere, so someone may see less than before if a part wasn't shared with them.
  • If you use Microsoft sign-in with other tenants, list only tenants you trust in allowed_tenants, and check whether any pre-registered accounts from them are administrators.
  • Single sign-on: links straight to auth_entra.php or oidc_start.php now go to the sign-in page. Use the buttons there.

Full changelog: v1.3.0...v1.3.1

Assets 2
Loading