v1.7.2-rc-2

[nielsdrost7]

InvoicePlane v1.7.2 RC 2

v1.7.2-rc-2.zip

Hash Format	Hash
MD5	b692fe6a4d37e8d240bad3648f086fc8
SHA-256	a9233b41859c05d16d002f0b41bae6313c9b0e9614081398ad328f3ed639c4c1

---

Thank you

Special thanks to code contributors @drewangell, @mpldr, @snajafov, and @PatrickGTR for their feature and infrastructure improvements.

Enormous thanks to our security researchers who reported vulnerabilities. All changes are listed in the CHANGELOG.md
Please read the CHANGELOG, there are some things you need to do when you have Custom Invoice and Quote templates (instead of the default ones)

@0raN9ewww, @5ud0er, @akgul7990, @alanturing881, @alham-rizvi, @ali-iltizar, @ashrexon, @baozongwi, @capt-bl4ck0ut, @chakrapani150, @Char0n1507, @Chittu13, @cyabell, @de3erve-hunter, @EvidentObscurity, @FelipeSilvany, @FORIMOC, @geo-chen, @HuajiHD, @iiihaiii, @kitu232, @lighthousekeeper1212, @mattmumford-git, @PLpaPLpa, @polybjorn, @QiaoNPC, @radoi-teodor, @Santoshkumarpuppala, @snajafov, @tikket1, @tonghuaroot, @udaypali, @venkatesh2003631, @Vijay-raghav7

Security & Stability

• #1651 Guest invoice/quote access keys and the CRON authentication key now use cryptographically secure token generation instead of random_string() / str_shuffle() / Mersenne Twister; password-reset token comparison now uses hash_equals() (GHSA-chqc-v432-8pj8, GHSA-wcqc-qqv5-65ph)
• #1658 Security hardening from @Char0n1507: password-reset IP/email rate limits now use persistent database-backed counters instead of PHP session data, and Users::change_password() now allows only the account owner or primary administrator (user_id=1) to change a user password (GHSA-p7w2-hmm5-qw7m, GHSA-p875-mj5j-x2fc).
• #1659 Security hardening from @FelipeSilvany: the HTTP setup controller now rejects access when SETUP_COMPLETED=true, preventing unauthenticated post-installation access to database upgrade operations when DISABLE_SETUP=false (GHSA-pp5w-98m2-gvc8).
• #1660 Security hardening from @Char0n1507: email-template placeholders now resolve only documented invoice, quote, client, user, SUMEX, and custom-field tags; unknown tags render empty, and invoice/quote queries no longer select password hashes, salts, or password-reset tokens from ip_users.
• #1661 Security hardening from @Char0n1507: report PDF date labels are now normalized before rendering and escaped in all affected report templates, preventing injected HTML resources in date fields from triggering server-side HTTP requests.
• #1663 Security hardening from @Char0n1507: Sumex::pdf() now rejects any SUMEX_URL that isn't https:// and restricts SUMEX cURL requests/redirects to HTTPS with certificate verification, closing an admin-configuration SSRF into local files, internal hosts, or cloud metadata endpoints; XML control characters are now stripped from SUMEX free-text fields and invoice_number/user_subscribernumber are restricted to a strict character allowlist before use in the generated XML; and storage/ (which holds the temporary SUMEX XML containing patient PII) now denies direct web access on both Apache and nginx.
• #1664 Security hardening from an internal audit: recalculate_all_invoices()/recalculate_all_quotes() now require a valid POST + CSRF token, closing a GET-reachable bulk-mutation gap; invoice_logo_pdf() now escapes the logo filename before writing it into PDF <img src> output; the Stripe guest callback now sanitizes checkout_session_id and its error-log output before logging, closing a log-injection gap; and several defense-in-depth fixes (JSON_HEX_* flags on the email-compose modal's JSON, shared path-validation helper in Upload::delete_file(), $cldr allowlisting in country_helper.php, and a user_active check on password-reset requests).
• #1668 Security fix reported by @polybjorn: the account-lockout auto-unlock was unreachable dead code, so a locked-out account stayed locked forever (recoverable only via a manual database DELETE) — the per-account guard also gated the failure counter so it could never reach the unlock threshold, and the unlock branch mis-measured elapsed time. Lockouts now expire after the intended 12-hour window (GHSA-cjwm-qx8w-hrq2).
• #1670, #1671 Security fix reported by @baozongwi: incomplete-fix follow-up to the password-reset token-expiry advisory (GHSA-5r28-6rw3-25c2). Expiry was enforced only on the reset-link GET flow, so the password-change POST could still use an expired-but-stored token, and the schema shipped without the expiry column. Expiry is now enforced on both flows (user_passwordreset_token_expiry added in 043_1.7.2.sql), parsing is strict, the POST validates CSRF and uses the safe-referer helper, and all failures return one generic message (GHSA-fwj7-c84x-jvjq).
• #1674 Security fix reported by @ashrexon (Yash Shendge): state-changing-GET CSRF on PDF generation. With mark_invoices_sent_pdf / mark_quotes_sent_pdf enabled, invoices/generate_pdf/<id> and quotes/generate_pdf/<id> assigned the next official number, moved the document draft→sent, updated its due date, and could lock it — all on a plain authenticated GET, so a hidden <img> on any page an admin visited could fire it. The mutation now runs only with a valid same-origin CSRF token (new verify_get_csrf_token() / _csrf_query()); the PDF still streams either way, so download links and the auto-mark-sent workflow are unchanged.

Improvements / Changes

Custom Templates & Configuration

• #1648 Custom template allowlist constants added to ipconfig.php, making custom invoice and quote template selection explicit while preserving the no-filesystem-scan RCE fix.
• #1652 Upgrade documentation corrected to state that CUSTOM_TEMPLATES_FOLDER alone lists no templates; template names must be copied into the relevant ipconfig.php allowlist variable.
• #1653 Custom template documentation clarified: administrators must provide both the template file under CUSTOM_TEMPLATES_FOLDER and the matching CUSTOM_*_TEMPLATES allowlist entry.
• #1656 Administrators upgrading with selected legacy custom templates now get a targeted /setup completion and Settings-page warning listing the saved custom template names and the exact CUSTOM_INVOICE_TEMPLATES_PDF, CUSTOM_INVOICE_TEMPLATES_PUBLIC, CUSTOM_QUOTE_TEMPLATES_PDF, or CUSTOM_QUOTE_TEMPLATES_PUBLIC variable to update.

Payment Processing

• #1677 Stripe zero-decimal currencies: Checkout Sessions now convert invoice balances using the configured currency's minor unit instead of multiplying every amount by 100. Callback validation, recorded payments, and merchant-response details use the same conversion, preventing JPY, KRW, CLP, and other zero-decimal invoices from charging customers 100 times the invoice total. Thanks to @snajafov.

Full Changelog (since v1.7.1): v1.7.1...v1.7.2-rc-2

---

This discussion was created from the release v1.7.2-rc-2.