Skip to content

1.0.3

Latest
Latest

Choose a tag to compare

View all tags
@sassanix sassanix released this 20 Oct 20:49
· 3 commits to main since this release
1.0.3
7fe84e7

⚙️ Release 1.0.3 – Security Fixes, Dashboard Upgrades & CSV Round-Trip

Version 1.0.3 is a hardening and polish release. It closes two responsibly disclosed security vulnerabilities, adds the Total Value and Archived dashboard cards, makes CSV export/import a true round-trip, and fixes dozens of bugs found through a 14-day QA sweep of every page, API endpoint, and edge case.

🔒 Security

  • Broken access control in /api/files/ (High): the legacy file route served any uploaded document to any logged-in user with no ownership check, ignoring the admin's document-sharing setting. Both file routes now share a single authorization helper (owner, admin, or global-view setting), and /api/files/ gained the path-traversal guard it was missing. Reported by humidnhefty (Malik Abdullah, Lupine Security).
  • Stored XSS via warranty fields: warranty cards rendered user-controlled fields into innerHTML without escaping, so a malicious value (e.g. via CSV import) executed JavaScript in every viewer's browser. All user-controlled fields are now HTML-escaped, and product_url links reject javascript:/data:/vbscript: schemes. Reported by lazymaster101 and the CSCE 413 (Texas A&M University) vulnerability-research team.
  • Passwords over 72 bytes no longer crash login/registration/password change (bcrypt limit) — they now return a clean HTTP 400.

Self-hosters: if you cannot update immediately, block /api/files/ at your reverse proxy — the UI only uses /api/secure-file/.

📊 Dashboard

  • Total Value card (#192): shows the sum of purchase prices for non-archived warranties, in your default currency only (no cross-currency mixing). Clicking the card opens a tooltip explaining the calculation.
  • Archived card: archived warranties are now excluded from all dashboard counts and shown in their own card.
  • Status page CSV export: the Export button now downloads a CSV of the currently displayed (filtered and sorted) warranties instead of showing a "not implemented" toast.
  • Global view: the expiration timeline now includes other users' warranties, matching the rest of the dashboard.
  • Expiry-day consistency: a warranty expiring today is now counted the same way by statistics, the UI, and notifications — still valid.

🔁 CSV Import/Export

  • True round-trip: exports now include Notes, Currency, ModelNumber, and WarrantyType — re-importing an export no longer loses data.
  • Tags and serial numbers containing commas survive the round-trip (JSON-encoded cells, with fallback for legacy files).
  • Real-world files handled: BOM/cased/whitespace headers (#236), short rows, overlong product names, and oversized fields now produce clean per-row errors instead of HTTP 500s or leaked database errors.

📱 Mobile & Frontend

  • Font Awesome is served locally, so icons work on offline/restricted networks.
  • Expired sessions redirect to login instead of leaving a broken UI (#225).
  • Frontend JavaScript refactored into ES modules; service worker no longer caches JS indefinitely, so updates reach returning users.

🛠 More Fixes

  • Uploads: same-second uploads of the same filename no longer overwrite each other; oversized uploads return HTTP 413 with the configured limit.
  • Downloads: missing files return 404 (not 500); local downloads no longer return empty files.
  • Notifications: expiry emails notify once per threshold instead of repeating daily (#188).
  • Paperless-ngx: full tag pagination (#255), "Test Connection" tests unsaved values, uploads link documents reliably.
  • Reliability: Docker health check now verifies the backend (#239), migrations handle mixed-case DB_USER (#187), DATABASE_URL is honored (#108), OIDC redirects keep nonstandard ports (#238), password reset no longer crashes (#216), nginx no longer logs at debug level (#211).
  • i18n: 66 missing English keys added; all 19 non-English locales fully translated (machine translation — native-speaker review welcome).
  • Currency preference now applies to warranty cards; NOK/DKK no longer revert to SEK (#205); long labels no longer overflow cards (#212); invisible toasts no longer block clicks (#197).

🙏 Credits

Security reports: Malik Abdullah (Lupine Security) and lazymaster101 + the CSCE 413 Texas A&M team. Issue reports and testing: the Warracker community — thank you.

Full details in the CHANGELOG.

Assets 2
Loading
0 Join discussion