Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bookstack: 24.05.2 -> 24.05.4 #338990

Merged
merged 1 commit into from
Sep 3, 2024
Merged

bookstack: 24.05.2 -> 24.05.4 #338990

merged 1 commit into from
Sep 3, 2024

Conversation

HritwikSinghal
Copy link
Contributor

@HritwikSinghal HritwikSinghal commented Sep 2, 2024 •
edited
Loading

Description of changes

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

@HritwikSinghal
Copy link
Contributor Author

bookstack 24.05.4 is a security update as mentioned here

@HritwikSinghal
Copy link
Contributor Author

changelog since 24.05.2: BookStackApp/BookStack@v24.05.2...v24.05.4
changelog for 24.05.4: https://github.com/BookStackApp/BookStack/releases/tag/v24.05.4

Security Release

    [Update Instructions](https://www.bookstackapp.com/docs/admin/updates)
    [Update details on blog](https://www.bookstackapp.com/blog/bookstack-release-v24-05-4/)

BookStack v24.05.4 has been released.

This is a security release to address issues found in LDAP group syncing, where in certain scenarios a user could be matched to extra roles incorrectly, and an issue with content visibility in "book-show" API responses which would not have permissions applied properly.

Upgrade is strongly advised for instances where LDAP authentication is used with group syncing, or where the REST API is used to fetch contents of books ("books-read" endpoint).

Thanks to Linus Nagel and their team at WorkSimple GmbH for reporting this API vulnerability.
Full List of Changes

    Updated API docs with consistent parameter types. (https://github.com/BookStackApp/BookStack/issues/5183)
    Updated default content iframe embed max-width to align with other content types. (https://github.com/BookStackApp/BookStack/issues/5130)
    Updated LDAP group sync to query via full DN.
    Updated translations with latest Crowdin changes. (https://github.com/BookStackApp/BookStack/pull/5118)
    Fixed books read API response not applying visibility control to chapter contents.
    Fixed API docs users response showing extra property. (https://github.com/BookStackApp/BookStack/issues/5178)
    Fixed database error thrown when using out dev docker setup. (https://github.com/BookStackApp/BookStack/issues/5124)
    Fixed RTL display issues with tasklist checkboxes. (https://github.com/BookStackApp/BookStack/issues/5134)

@HritwikSinghal
Copy link
Contributor Author

last PR #322136

@ofborg ofborg bot requested a review from ymarkus September 2, 2024 12:34
@HritwikSinghal
Copy link
Contributor Author

can we also backport this?

@HritwikSinghal HritwikSinghal mentioned this pull request Sep 3, 2024
Merged
13 tasks
SuperSandro2000
SuperSandro2000 reviewed Sep 3, 2024
View reviewed changes
pkgs/servers/web-apps/bookstack/default.nix

src = fetchFromGitHub {
owner = "bookstackapp";
repo = pname;
rev = "v${version}";
sha256 = "13yln6b5j9plkcrp1mwfvgcv67gm2ayb2l2grhw2h4ncqnvmxhwv";
sha256 = "1aa4im2khxycv5i2ff23ss91p4kr7d2a4yhjm0k0n6av64zhz2x3";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
sha256 = "1aa4im2khxycv5i2ff23ss91p4kr7d2a4yhjm0k0n6av64zhz2x3";
hash = "sha256-o4sPPzFbGQsmqBJ6okQ7eZIbktZDOCdi2cx3OEWNRKk=";

@SuperSandro2000 SuperSandro2000 added the backport release-24.05 Backport PR automatically label Sep 3, 2024
@SuperSandro2000
Copy link
Member

can we also backport this?

sure, just add the label for it if you think it should be

@SuperSandro2000 SuperSandro2000 merged commit f501c97 into NixOS:master Sep 3, 2024
45 of 46 checks passed
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Sep 3, 2024

Backport failed for release-24.05, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release-24.05
git worktree add -d .worktree/backport-338990-to-release-24.05 origin/release-24.05
cd .worktree/backport-338990-to-release-24.05
git switch --create backport-338990-to-release-24.05
git cherry-pick -x a8f5ef66e5d6e7f03a2c7af026d096372f651c74

@HritwikSinghal
Copy link
Contributor Author

can we also backport this?

sure, just add the label for it if you think it should be

Thanks for quickly reviewing and merging it. will add label for backport. What should i do after cherry-pick? should i open another PR?

@phanirithvij
Copy link
Member

phanirithvij commented Sep 3, 2024 •
edited
Loading

Since the bot failed, yes you should send a pr targeting release-24.05 branch. See for eg. #336734

https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#manually-backporting-changes

@HritwikSinghal HritwikSinghal mentioned this pull request Sep 4, 2024
Open
13 tasks
@HritwikSinghal
Copy link
Contributor Author

Since the bot failed, yes you should send a pr targeting release-24.05 branch. See for eg. #336734

https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#manually-backporting-changes

#339492

can you merge this.

@NickCao NickCao mentioned this pull request Sep 8, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@SuperSandro2000 SuperSandro2000 SuperSandro2000 approved these changes

@ymarkus ymarkus Awaiting requested review from ymarkus

Assignees
No one assigned
Labels
1.severity: security 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 10.rebuild-linux: 1 backport release-24.05 Backport PR automatically
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@HritwikSinghal @SuperSandro2000 @phanirithvij