Skip to content

v1.2.4 — Security fix (file manager symlink reads) + PHP 8.4.1 upgrade check

Choose a tag to compare

View all tags
@crivion crivion released this 21 Sep 15:30
· 6 commits to main since this release
v1.2.4
6d79c5f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This is a security release. Every install that hosts more than one tenant should upgrade.

Security

  • The file manager could read other tenants' files through a symlink (GHSA-4j2j-vpcj-ffxv). Writes were already protected against symlinks, but reads were not. The panel runs as www-data, which is in every tenant's group, so a tenant could put a symlink in their own home and read, list or probe files in another tenant's home through the file manager. Every read, listing and file-info check now goes through the same helper as writes, which refuses to follow a symlink at any point in the path. Reported by mattw-services.

Fixed

  • The upgrader let PHP 8.3 servers through and then failed partway. The Laravel 13 dependencies need PHP 8.4.1, but the upgrader only checked for 8.3. It now refuses to start on anything older than 8.4.1, before changing anything. Installer-built servers and the Docker image already run PHP 8.4.

Changed

  • The file editor now refuses files larger than 10 MB. You can change the limit with max_editable_file_size in config/laranode.php.

Upgrading

curl -sSL https://raw.githubusercontent.com/crivion/laranode/refs/heads/main/laranode-scripts/bin/laranode-upgrade.sh | bash

Once it finishes, check that the commit the upgrader prints matches this release.

Assets 2
Loading