v1.5.3

What's Changed

Security fixes

Upgrading is recommended for all installations.

• A room member could post a message that runs script for other members who open the room. Message text was linked after sanitizing, so a crafted message could put a link inside an attribute value, and replying to a message could insert a quoted mention as markup. Links are now made only in a message's text, and a quoted mention is inserted as text. Cached message markup is cleared on upgrade. Campfire also now sends an enforcing Content-Security-Policy that only allows its own scripts (see the upgrade notes below). (GHSA-f7cr-5282-7xxj)
• Changing a password left the account's other sessions signed in. Changing a password now ends every session of the account and closes its live connections. The browser the change was made from is signed straight back in. Push subscriptions end with the sessions, sign-in transfer links made before the change stop working, and changing the password now requires the current one. (GHSA-4wph-3hfj-qmch)

Reported by Kareem Abfe and @namespaceMarcello.

Also published today: GHSA-4fx9-pr3g-h7fj, link unfurling with no overall deadline. It was fixed in 1.5.2.

Upgrade notes

Campfire now sends an enforcing Content-Security-Policy that only allows its own scripts, loaded from its asset directory. Scripts that come from somewhere else stop running. That includes scripts a proxy injects into pages (Cloudflare Rocket Loader or Cloudflare Web Analytics, for example) and a <script> an administrator adds through custom styles.

The policy names the host each request arrives on. If a reverse proxy replaces the Host header with its own upstream address, have it pass the original host along (nginx: proxy_set_header Host $host;, or X-Forwarded-Host). Otherwise Campfire's own scripts won't load. The same goes for opening Campfire at a bare IPv6 address, which a policy can't name. To turn the policy off, set DISABLE_CONTENT_SECURITY_POLICY=true and restart.

Changing a password on the profile page now asks for the current one, and signs the account out everywhere else; the browser it was changed from stays signed in. Other devices stop getting push notifications until they're signed in again; a signed-in browser picks them back up on its own. Sign-in links and QR codes made before the upgrade stop working, so make a new one if you need it. An administrator can still reset a password with script/admin/reset-password.

Files that aren't plainly media, a PDF or plain text are now served as downloads.

Other changes

• Link previews connect to the address they checked, even when an http_proxy environment variable is set.
• Brakeman 8.1.0.
• Security fixes for 1.5.3 in #367 (from #364, #365, #366 and #371).

Full changelog: v1.5.2...v1.5.3