Skip to content

v1.5.45 — Security hardening

Choose a tag to compare

View all tags
@ZL154 ZL154 released this 15 Apr 19:49
· 245 commits to main since this release
v1.5.45
af49230

Security hardening

  • Enforce per-user authorization on user-scoped API endpoints. Admin-only endpoints are unchanged.
  • Validate and sanitize admin-supplied custom badge definitions, webhook URLs, and imported profiles.
  • Escape user-controlled strings in the achievements UI renderers.
  • Return 404 for unknown users on the public profile card endpoint and stop creating empty profiles on anonymous reads.
  • Additional input bounds on playback completion API.
  • Cap response buffering in the injection middleware.

Thanks to @xdnewlun1 (Techno Cricket, CCDC) for responsible disclosure.

Users are encouraged to update promptly.

Also included

  • Custom Xbox logo — admins can upload an SVG in the Feature Controls section to replace the Xbox logo in toasts (useful for custom server branding)
  • 8 languages — expanded translations from 3 to 8: English, Français, Español, Deutsch, Italiano, Português, 中文, 日本語. ~220 UI strings each. Users pick their language in settings, admin sets server default.
Assets 3
Loading