Skip to content

6.7.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Oct 20:01
6.7.1
6086906

Mage 6.7.1

Mage 6.7.1 adds two new plugins: ArcGIS, which syncs Mage observations to ArcGIS, and ClamAV, which scans attachments for viruses and malware. It also lets you choose which fields go into an export, can remember each user's recent dropdown choices, and updates the SFTP and NGA MSI plugins, along with fixes for OAuth/SAML/OIDC sign-in and a number of security issues.

Highlights

  • ArcGIS sync (new plugin): Syncs Mage observations to one or more ArcGIS feature service layers in near real time. New observations, edits and deletions in Mage show up in ArcGIS automatically.
  • ClamAV attachment scanning (new, optional plugin): Attachment uploads are scanned by a running clamd daemon before they become available. Infected attachments, and ones that can't be scanned, are rejected.
  • Export field selection: Choose which form fields go into an export.
  • Recently used choices: Dropdown and multiselect fields can remember each user's recent picks for each event, form and field. This is turned on per field.
  • Feed map defaults: Admins can set whether a feed shows on the map by default.
  • Attachment carousel: Thumbnail attachments can be viewed in a carousel.

Upgrade Notes

  • Plugins now require @ngageoint/mage.service ^6.7.0. Upgrade your plugins to the versions listed below together with the server.
  • To turn on ClamAV scanning, you need a running clamd daemon. Add @ngageoint/mage.clamav.service to servicePlugins / MAGE_PLUGINS, and set MAGE_CLAMAV_HOST / MAGE_CLAMAV_PORT. See the ClamAV plugin README.

Security

  • The unauthenticated /api endpoint no longer exposes the local password policy's rule thresholds. It only shows a help message written by an admin, and only when that message is turned on.
  • The password policy is now checked on the server only and is no longer sent to the client.
  • The IdP sign-in popup no longer trusts the request's Host header when posting results back. This removes a possible host-header injection.
  • Upgraded dependencies to fix all high and critical npm audit findings.

Notable Fixes

  • OAuth/SAML/OIDC sign-in no longer hangs on a stuck popup or in-app browser when authentication fails.
  • Inactive or disabled accounts that sign in through OAuth/SAML/OIDC now see a clear account status screen instead of failing silently.
  • Attachment uploads no longer fail when the file name differs from the name on the attachment record.
  • GeoPackage export and import work again. They had been broken by a missing better-sqlite3 dependency.
  • Users can get, download and delete their own exports.
  • Fixed intermittent 400 errors when loading plugin UI assets.
  • Fixed a server crash when deleting a failed attachment.
  • Fixed problems with the signup form and the re-authentication dialog, such as forms that couldn't be scrolled and an Accept button you couldn't reach.
  • Various web app UI fixes.

Plugins

ArcGIS (new, 1.0.0)

  • Syncs Mage observations to ArcGIS feature service layers in near real time. See the ArcGIS plugin README for setup.

ClamAV (new, 1.0.0)

  • Scans attachment uploads for viruses and malware before they become available. See Upgrade Notes for setup.

SFTP (1.0.0)

  • Added a sync health dashboard
  • Fixed SFTP client listeners piling up over time

NGA MSI (2.0.0)

  • Added the World Port Index feed
  • Removed the deprecated ASAM topic

Image (2.0.0)

  • Upgraded sharp to fix high-severity vulnerabilities in its bundled image libraries

Full Changelog: CHANGELOG.md · 6.7.0...6.7.1

Assets 6
Loading