Skip to content

3.89.11

Latest
Latest

Choose a tag to compare

View all tags
@jens-maus jens-maus released this 18 Sep 18:12
· 6 commits to main since this release
3.89.11
3ed652a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • chore(build): replace Java device type stripper with Bash and awk by @jens-maus in #37.
  • fix: update to upstream 3.89.11 including several upstream JSON-API related security fixes:
    • added input validation and sanitization for JSON-API calls creating system variables (homematicip#13)
    • sanitized HomeMatic Script variable identifiers and improved argument escaping (homematicip#14)
    • added HTML escaping for system variable data displayed in the WebUI (homematicip#13)
    • hardened user.setLanguage by avoiding shell command execution and sanitizing the target profile filename (homematicip#13)
    • raised system.saveObjectModel access level to USER ((homematicip#14)

Full Changelog: 3.89.9...3.89.11

Contributors

jens-maus
Assets 2
Loading