Skip to content

dotPulse 3.2.2 (security release)

Latest
Latest

Choose a tag to compare

View all tags
@davmont davmont released this 12 Nov 22:19
v3.2.2
e586313
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release date: 2026-11-12

dotPulse 3.2.2 is a security release. The contacts list shows a private contact only to its owner, and only contacts of companies the user may view, but four other pages ignored both rules: any logged-in user could read other users' private contacts. Upgrade every installation of 3.2.1 or earlier. See advisory GHSA-mhjh-m8pc-7x79.

It upgrades 3.2.1 in place, with no database changes.

Security

Every issue below needs a logged-in account that may use the module concerned.

  • Contacts › CSV Download exported every contact, with all fields: address, phones, e-mail, birthday and notes.
  • Smart search found every contact.
  • Calendar: the month and week views showed every contact's name and birthday.
  • Resource management: the project filter listed every project, including those the user may not open, and the user filter listed every contact.

All four now apply the contacts list's rule (CContact::visibleWhere()): private contacts only for their owner, and only contacts of companies the user may view. Resource management lists only the projects the user may open, and only users whose contact they may see.

The CSV export also had a CSV injection: a value starting with =, +, - or @ ran as a formula when the file was opened in a spreadsheet. Such values now start with '.

Fixes

  • CSV export: every value is quoted (a quote in a name broke the file), Job Title and Title were swapped, and the contact category is named after the site instead of "dotProject".
  • Smart search: highlighting gave a PHP warning per result, and Ignore case had no effect.
  • Users logged in before an upgrade kept seeing the old version in System Admin: the version was kept in the session.
  • Projects list: the All and Gantt tabs showed the first status tab instead, in every theme.
  • Task log list: a PHP warning per log, and the edit link ignored the tab view.

Upgrading

  1. Back up the database and the files/ directory.
  2. Replace the code. Keep includes/config.php and files/.
  3. Run the installer (install/ in a browser) to record the new version. There are no database changes. Then remove install/ again or deny access to it.

From a version older than 3.2.1, read the 3.2.1 release notes first.

Assets 2
Loading