Skip to content

v1.2.2

Latest
Latest

Choose a tag to compare

View all tags
@jeremy jeremy released this 03 Aug 23:30
v1.2.2
a5a66e7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

Security fixes

Upgrading is recommended for all installations.

  • Page revision history included pages that had been deleted, so their full contents stayed readable to anyone with read access to the book even though the page itself was gone. Revision history is now restricted to editors and excludes deleted pages. (GHSA-29h9-cgxp-w2m9)

  • Uploading into a book's storage was authorized by a token issued when the editor page was rendered, and never re-checked. Someone whose access had been revoked could keep writing files indefinitely. Uploads are now authorized against current access, and the token carries a purpose and an expiry. (GHSA-h97r-8rhg-m67g)

  • Uploaded attachments were served to anyone with the URL and cached publicly for a year, regardless of whether the book was published. Attachments of unpublished books now require access to the book and are no longer publicly cacheable.

Reported by @chroxx-0000, @sps-sdp, @isacaya and @fg0x0. Full details: #463.

Full changelog: v1.2.1...v1.2.2

Assets 2
Loading