Skip to content

v4.11.0

Choose a tag to compare

View all tags
@jake-low jake-low released this 09 Oct 00:08
· 20 commits to main since this release
v4.11.0
5c83eb6

Important security fixes!

These patches have already been deployed to https://maproulette.org. If you run your own MapRoulette instance, you should upgrade to this version as soon as possible.

  • Omit sensitive fields when serializing user objects on public endpoints (5125337)
  • Treat an empty super key as disabled (72b76cd)
  • Disable API key authentication (7a8cdb1)
  • Hash the OSM token when storing it in the session cookie (efad905)
  • Send session cookie only over HTTPS; set a 30 day default session timeout (538dc8d)
  • Fix SQL injection in task and challenge comment GET endpoints (f89391f)
  • Fix SQL injection in task search endpoints (c9994c3)
  • Fix SQL injection in GET and POST /challenge/view/:id endpoints (b90e3e1)
  • Fix SQL injection in task review endpoints (51adaa7)
  • Return a generic 500 error instead of a full stack trace (f9c5a80)
  • Fix SQL injection in task property search and attachment lookups (e21dd74)
  • Use a stricter cross site cookie policy by default (4259fef)
  • Fix user authentication check in GET /users endpoint (31a640f)
  • Add X-Route response header containing matched route pattern (5c83eb6)

Full Changelog: v4.10.1...v4.11.0

Assets 2
Loading