Skip to content

v0.16.0

Choose a tag to compare

View all tags
@Rombond Rombond released this 07 Nov 20:21
· 11 commits to master since this release
v0.16.0
66d38ff
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release: fixes the findings of an external security audit, plus the groundwork for 1.0 (mobile apps on the public demo, store metadata). Upgrading is strongly recommended.

Security

  • Settings that change sign-in or identity (OIDC, LDAP, Jellyfin API key, public address, dashboard API key) now require the admin role. Before, the delegable "Manage settings" permission was enough, which allowed a privilege escalation.
  • Admin role follows Jellyfin and your SSO group: a user who loses admin there is demoted at the next sign-in or hourly check. Roles granted by hand in Tipsarr are kept.
  • OIDC matching: configurable username claim (default preferred_username), exact match, no fallback to name/nickname, unverified e-mail refused.
  • Login throttling is stored in the database, with an escalating lockout (up to 1 hour) and a short delay after each failure.
  • Outbound webhooks can no longer reach loopback or link-local addresses, and reach private (LAN) addresses only when their host is listed in Admin > Webhooks > Allowed internal hosts. Checked at connection time, so DNS rebinding does not get around it.
  • Secrets are encrypted at rest (AES-256-GCM): API keys, OIDC/LDAP secrets, webhook secrets and headers, relay key.
  • Secrets are no longer sent back by the settings API (show/regenerate buttons instead); remote error messages and internal 5xx details are no longer shown to users; avatar images are size-checked before decoding; the stored Radarr/Sonarr key is not sent to a new host.
  • Client IP taken from trusted proxies only (TIPSARR_TRUSTED_PROXIES); TIPSARR_COOKIE_SECURE=true now really forces the Secure flag; HTTP server timeouts, HSTS, and a CSP without unsafe-inline for scripts.
  • Setup token required by default on a fresh install unless TIPSARR_JELLYFIN_URL is set. The ?token= form of the Jellyfin webhook URL is deprecated (use the X-Tipsarr-Token header).
  • Supply chain: GitHub Actions pinned by commit, base images by digest, Dependabot; the image now ships an SBOM and provenance and is signed with cosign (see SECURITY.md to verify).

Also in this release

  • The mobile apps can sign in to the public demo (https://tipsarr-demo.brebond.com, admin / demo or user / demo).
  • Store listings and review material for the 1.0 apps; PRIVACY.md completed.

Upgrade notes

  • Migration 031_auth_hardening runs automatically.
  • Back up secret.key (created in the config folder at first start, or set TIPSARR_SECRET_KEY) together with the database. Without it the stored secrets have to be entered again. Going back to 0.15 needs a database restored from before the upgrade.
  • Webhooks to LAN addresses (ntfy, Home Assistant…) fail until their host is added to Allowed internal hosts; the startup log lists them.
  • OIDC usernames now match Jellyfin's exactly (case-sensitive).
  • After upgrading, review the admin roles in Users (existing admins without a known origin are kept as manual admins, with a log warning).
  • A reverse proxy on a public address must be added to TIPSARR_TRUSTED_PROXIES.
  • New optional env vars: TIPSARR_SECRET_KEY, TIPSARR_TRUSTED_PROXIES, TIPSARR_SESSION_TTL, TIPSARR_SESSION_RECHECK_GRACE.
Assets 2
Loading