Skip to content

FediHome v1.10.1 — security

Choose a tag to compare

View all tags
@TemujinCalidius TemujinCalidius released this 07 Jul 04:38
v1.10.1
5fd5570
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

FediHome v1.10.1 — security hotfix 🔒

A security patch for two related draft-content-leak issues (found during the FediHome-macOS edit-post work). Self-hosters should update promptly.

  • Unpublished drafts & scheduled posts could be read without authentication. GET /api/micropub?q=source returned a post's full source — including unpublished drafts and scheduled posts — but, unlike the POST handler, required no token. Anyone who could guess a post's slug (slugs derive from the title, or the first words + a timestamp) could read draft content. It now requires a valid token. q=config (public discovery info) is unchanged. (GHSA-x3j3-ghcw-8r77)
  • Editing an unpublished post federated its content early. Editing a draft or a not-yet-published scheduled post via a token sent a public ActivityPub Update of its content to your followers before it was ever published. Unpublished edits now update silently and federate nothing (the scheduler still delivers a Create at publish time). (#224)

Upgrade

npm run update. No schema change. This is a patch on top of v1.10.0 — no other behaviour changes.

Full changelog: the 1.10.1 section of CHANGELOG.md

Assets 2
Loading