v0.150.0-ls174

CI Report:

https://ci-tests.linuxserver.io/linuxserver/manyfold/v0.150.0-ls174/index.html

LinuxServer Changes:

Full Changelog: v0.150.0-ls173...v0.150.0-ls174

Remote Changes:

This release is all about security! We've been through a big list of security issues that have been identified and fixed them. We've also upgraded the security of ActivityPub federation with RFC9421 signing and verification. Hopefully though, you won't notice any of that, because it's all behind the scenes!

There's one visible thing if you have a recent Prusa printer; you should be able to now use it via the modern API - before, we only had support for the legacy API.

What's Changed

✨ New Features ✨

• RFC9421 HTTP signature/verification via Fedipub by @Floppy in manyfold3d/manyfold#7118
• Print via new prusalink api by @samuel-sarmah in manyfold3d/manyfold#7157

🔒 Security 🔒

• Prevent moderators from editing administrators' user settings (including setting password) by @Floppy in manyfold3d/manyfold#7119
• Correctly sanitize markdown to remove unsafe HTML output by @Floppy in manyfold3d/manyfold#7120
• Fix possible conversion of unauthorized files by @Floppy in manyfold3d/manyfold#7121
• Fix sending out of user invitations before group permissions check by @Floppy in manyfold3d/manyfold#7122
• Prevent moderators from managing administrator's OAuth applications/tokens by @Floppy in manyfold3d/manyfold#7127
• Apply complete sandboxing to files displayed in frames, including HTML by @Floppy in manyfold3d/manyfold#7128
• Fix OAuth privilege escalation by @Floppy in manyfold3d/manyfold#7129
• Require user authentication for new follow page by @Floppy in manyfold3d/manyfold#7131
• Add proper permission checks to all associations in form deserializers by @Floppy in manyfold3d/manyfold#7150

🐛 Bug Fixes 🐛

• Upgrade activity records to work with Fedipub name change by @Floppy in manyfold3d/manyfold#7091
• Fix occasional sync errors from MyMiniFactory by @Floppy in manyfold3d/manyfold#7156

🌍 Internationalization 🌏

• Translations updated: de by @Floppy in manyfold3d/manyfold#7068
• Translations updated: es by @Floppy in manyfold3d/manyfold#7029

🛠️ Other Improvements 🛠️

• Add tests for report creation permissions by @Floppy in manyfold3d/manyfold#7132
• Add note about CVE fishing bans in security file by @Floppy in manyfold3d/manyfold#7149

New Contributors

• @samuel-sarmah made their first contribution in manyfold3d/manyfold#7157

Full Changelog: manyfold3d/manyfold@v0.149.0...v0.150.0