Release 1.2.2 · MrDDream/ShortcutWall

ShortcutWall 1.2.2 fixes an open redirect and several bugs found in a full audit. Updating is recommended for every install.

🐳 Docker image

docker compose pull && docker compose up -d

ghcr.io/mrddream/shortcutwall:1.2.2 (also tagged 1.2 and latest), for linux/amd64 and linux/arm64.

Open redirect fixed: a link such as http://your-wall//evil.example showed the 404 page, and its language switch then sent the visitor to evil.example.
Google's favicon service is no longer asked about internal sites (private addresses, .lan/.local names): it couldn't know them, and the request disclosed the internal address.
An upload sent with an invalid CSRF token is deleted at once.

SVG favicons are stored too (GitHub and many modern sites): they are rendered to a 256 px WebP. Only pixels are kept: scripts can't survive and the renderer loads no external file or URL.
A favicon lookup is cut off after 25 seconds instead of possibly taking more than a minute.

A site that is down, or only reachable from the browsers, can be renamed or described again: its address is only checked when it changes.
The session lasts 2 hours from the last action, not from the login. If it does expire, the dialog keeps your values and says so, instead of jumping to the login page.
A logo over 5 MB gets a clear message; a logo shared by two sites is kept while one of them uses it; replacing the wall with an empty backup is refused.

Full changelog: 1.2.1...1.2.2