Skip to content

Release v1.18.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 07:53
· 58 commits to main since this release
v1.18.1
93e9931

Release v1.18.1: security - setup API closed after completion, hardened setup inputs.

Changelog

Security

  • POST /_setup/api/advance closed after setup: it answers 404 once setup is completed (same gate as the wizard page), so {"profile":"minimal"} can no longer create an extra admin and {"profile":"full_database"} can no longer re-import last-restore-dump.sql. The payload profile is only honoured before a run started; afterwards the stored profile is pinned. Responses no longer include answers.
  • GET /_setup/api/progress requires the setup token (when configured) and no longer returns answers (admin email, DATABASE_URL, SQL path).
  • DATABASE_URL step: the value is always written single-quoted to .env.local (Symfony Dotenv no longer expands $VAR / $(cmd) or mangles passwords containing $ / \), the existing line is replaced literally (no regex backreferences), and URLs containing ', line breaks or control characters are rejected (percent-encode them).
  • sql_import_path (bootstrap mode / sql_file step) is confined to existing .sql files under var/site-backup/ (real path; absolute paths elsewhere, ../ and symlink escapes are rejected). SQL import errors report the file name and SQLSTATE only, never the dump contents.
  • Restore progress.json: callers that are not authorised for the panel get active / phase / percent / message only (no log, error or backup id).
  • Backup archives are chmod 0600; var/site-backup/last-restore-dump.sql is 0600 and deleted after the setup sql_file step imports it.
  • Docs: setup.setup_token is mandatory on internet-facing hosts (SECURITY.md, CONFIGURATION.md).

Full Changelog: v1.18.0...v1.18.1

Assets 2
Loading