v4.1.1

Spug 4.1.1 is a security release. It fixes six security issues reported privately through GitHub, and updates GitPython, python-ldap and axios to versions without known vulnerabilities. All 4.x installations should upgrade; details are in the security advisories.

docker compose pull && docker compose up -d

Behaviour changes

Most fixes are invisible, but a few tighten what Spug accepts. Check these before upgrading if you use the open API or Webhooks:

• The Webhook dialog of an application shows the Secret Token to administrators only; other users are asked to get it from an administrator
• POST /apis/exec/<template_id>/ only runs on hosts preset in the template. host_ids can narrow that set but not extend it, and a template without preset hosts can no longer be triggered through the API
• Parameter names passed to /apis/exec/ and /apis/pipeline/ must be valid environment variable names (letters, digits, _ and -, not starting with a digit)
• File distribution requires absolute source and target paths without spaces or shell special characters
• Git repository addresses must use http(s)://, ssh://, git://, file://, the user@host:path form or an absolute local path
• The host API no longer returns independent private keys. When editing a host that has one, it is kept unless you remove it in the form
• Monitoring tasks of the process and custom script types, and their test button, require access to the target hosts, as batch execution does. Administrators may want to review existing tasks of these types

Dependencies

• GitPython 3.1.40 → 3.1.62
• python-ldap 3.4.3 → 3.4.8
• axios 0.21 → 0.33 (web UI)

Installations from source should run pip install -r requirements.txt in spug_api after updating the code.

Thanks to White0xdi3, 5ud0 (Tarmo Technologies) and hackchang for reporting these issues responsibly.