Security Release
This is a security release to address a range of vulnerabilities:
- Images & drawings could be unexpectedly accessed and modified when attached to inaccessible draft/trashed pages.
- Page editor personal draft content could be made visible to other users in certain scenarios.
- On book/chapter conversion, content could be wrongly permanently deleted when in the recycle bin.
- Attachment endpoints could indicate existence of non-accessible pages.
Updating is advised if any of the above scenarios are a concern to your use-case.
A big thanks to the following researchers for responsibly reporting vulnerabilities which were addressed in this release:
- CayCon (Reporter), VulnCheck (Coordinator)
- Tanna Zu (GitHub)
- Dickson Wu (SEAL & CertiK)
- Zeng Yu
- Efe Çam
- dracaryxxd
Full List of Changes
- Updated application PHP package versions
- Updated attachment validation, and page fetching, to avoid responses which indicate page existence.
- Updated image fetching to fully check access via page access, considering draft and trashed status.
- Updated revision diffing to filter on revision type.
- Updated chapter/book conversion to properly handle child items which are in the recycle bin.