Freika/dawarich 1.14.5

on GitHub

Security

• Self-hosted registration bypass (GHSA-x483-3xv3-vp52, medium). On self-hosted instances with email/password registration disabled, which is the default, anyone who could reach the instance could create an active account through the mobile app registration endpoint (POST /api/v1/auth/register). A family invitation could also be used to register an email address other than the one it was sent to. Versions 1.7.1 through 1.14.4 are affected.
  • Upgrade to 1.14.5. If you can't upgrade right away, block POST /api/v1/auth/register at your reverse proxy.
  • If your instance is reachable from the internet, check Settings → Users for accounts you don't recognize and delete them.
  • Thanks to @y4poo for reporting this responsibly.

Added

• Video Studio can select exact start and end times for map ranges.
• Family members can consent to sharing location history recorded before they started sharing.
• The import edit page can change or clear an import's source.

Changed

• Visit detection no longer sends a notification for every new suggested visit.
• Poster Studio waits for the map to load the selected date range and disables the studio switch while loading.

Fixed

• Yearly digests for cloud-Lite users read seasonality and country time spent from the same data window as monthly distances and toponyms.
• The per-email API login brute-force throttle now counts application/json request bodies, so password grinding against POST /api/v1/auth/login is bounded per account even when an attacker rotates source IPs.
• API sign-in ignores leading and trailing spaces in the email address.
• Manual OIDC configuration falls back to the default port when OIDC_PORT is blank, non-numeric or out of range.
• OAuth account linking reports when a verification email was not re-sent because of rate limiting, with the real remaining wait.
• Signing up through an OAuth provider without a name claim no longer saves the username or email as the first name.
• SMTP_AUTHENTICATION=none no longer sends credentials when SMTP_USERNAME is set.
• Cloud Lite subscribers in a paid Family can use the map features the Family plan includes.
• Users whose trial has ended are no longer shown an import form they cannot submit.
• GPX imports continue past recoverable XML errors instead of aborting.
• OwnTracks .rec imports skip malformed lines instead of aborting.
• Google Phone Timeline imports no longer drop or reorder points when groups of identical timestamps sit close together.
• Transportation mode backfill uses activity data from Google Phone Timeline imports.
• Track generation keeps each tracker's points on its own track when several tracks share a time window.
• Reverse geocoding keeps the identity of places created by imports, so re-imports no longer duplicate them.
• Visit names use nearby points of interest on Photon and Geoapify instead of falling back to addresses.
• Place search results from Geoapify include OpenStreetMap IDs.
• Restoring a user archive no longer fails or keeps empty records when the export could not include some raw data archive files.
• The web digest page no longer generates a year-end digest for the year still in progress.
• Unauthorized visits to Sidekiq no longer leave browsers caching a permanent redirect.
• Map and trip pages handle timezones saved under legacy names such as Berlin.
• The map's date range fields follow day navigation from the timeline.
• Self-hosted registration settings apply to mobile app sign-ups, and a family invitation only admits the email address it was sent to.

💙 This release is supported by Steven B., James Manolios, chenrik, aldumil, derpderpington, Chippie, dint, jhalpern, Lex Fradski, Schlufo, cyberswan.at, craftyklaus, Andre, hogenf, naraxius, Embrace, martin4861, Alex, evetters, GregF, Jon Coffee, Lukas, Robbie G, Kilian, Hans G, Chris, tabaha, Andre, Michael C, Chris, Jonah B., Dante, daallex, Tanner A., Milien M., Mathias, Travis S., Matthew F., Johnathan D., bleibdirtroy, no1etal, dixet, Bailey J., Alex D., Benjamin M., Daniel A., Florian, BeeHappy, ChemistryDachshund, OrangeWindies, Michelangelo V., Edward, Erazem Z., Denis Abt, Tony G., Lomky, Osamu Y., Linus T., Christian C., Sebastian, Jan K., Nathan T., Max G., Karol B., Konstantin, Johannes H., t3hero, g3lin, Tim, Philipp M., Brand K., Pablo F. M., Jon H., fkB, Mikael, Dániel A., Hai_Tsung, ShooTex, GreenTentacle, PinkahPandah, David, Ken, Denna G., Andre, Hendl91, Jon H., MrRed, Arkadiusz Z., Jake, Bator T., Alex J. H., eps-dev, twiggu, Dragan V., Jerome G., Sheya B., Gustav B., higgs01, Frank F., F. J. Kruz, Jon D., Alexander J. H., Daniel D., Gonzalo M., Ricardo T., Christof Z., Narrator, JohnSmith21, smartbert, A.M., Matthew Z., Dror T., Jonathan K., Kyle C., Mario B., Albin H., Phillip S., Bernd, Tom, Nick O., greeting7416, Dick, Brian R., Markus, TheSlimShady, Andrew M., Mason B., Chance, GoogilyBoogily, Dragon, Oliver, HexitNiels, Michael G., Pablo A., Leo L., Daniel D., DSKun, Jonathan K., Erik K., Tiebolt v. d. L., Steven, Mathias, Sam B., Manuel F., K8BCO, Samuel D., duckduck, David, heydabop, Riccardo N., Tim. S., Jonas, Kenji I. Pascal M., Raymond W., Julien, Roman, Mario B., Talis and Andreas R. on Patreon and KoFi 💙

What's Changed

• fix: strip whitespace from API login email before lookup by @detail-app[bot] in #3561
• Scope reuse_existing_track lookup by tracker_id by @detail-app[bot] in #3562
• Skip malformed OwnTracks .rec lines instead of aborting the import by @detail-app[bot] in #3563
• Reject in-progress current year in web digest generation by @detail-app[bot] in #3565
• Strip file_error and rescue unknown attributes in raw data archive import by @detail-app[bot] in #3564
• Preserve imported place identity through reverse geocoding by @detail-app[bot] in #3566
• Distinguish OAuth account-link rate-limited retries from genuine sends by @detail-app[bot] in #3567
• Default blank or non-numeric OIDC_PORT to 443 in manual mode by @detail-app[bot] in #3568
• Align SafeSettings read path with Entitlements write path by @detail-app[bot] in #3569
• Report the real remaining window in account-link Retry-After by @Freika in #3609
• Skip raw data archive rows the export could not write by @Freika in #3610
• Backfill activityRecord for Google Phone Takeout imports by @detail-app[bot] in #3571
• Reject out-of-range OIDC_PORT instead of composing an unreachable URL by @Freika in #3611
• Surface Geoapify osm_id and osm_type from datasource nesting by @detail-app[bot] in #3570
• Fix POI name voting for Photon and Geoapify stays by @detail-app[bot] in #3572
• Clear SMTP credentials when SMTP_AUTHENTICATION=none by @detail-app[bot] in #3573
• Preserve distinct timestamps across Google Timeline tie groups by @detail-app[bot] in #3574
• Permit source in import update params by @detail-app[bot] in #3575
• Fix per-email API login throttle bypass for JSON request bodies by @detail-app[bot] in #3576
• fix(gpx): don't abort import on recoverable SAX errors by @detail-app[bot] in #3577
• Fix import form access for expired trial users by @detail-app[bot] in #3579
• fix: prevent OAuth handle/email from being saved as first_name when provider omits name claim by @detail-app[bot] in #3580
• Scope yearly digest seasonality and country time-spent to the Lite data window by @detail-app[bot] in #3581
• chore: remove unused TimelineHelper#timeline_all_day? and #day_label by @detail-app[bot] in #3585
• chore: remove unused Points::AnomalyBackfillJob dispatcher by @detail-app[bot] in #3586
• chore: remove unused archived/not_archived/with_archived_raw_data scopes by @detail-app[bot] in #3587
• Use temporary redirect for unauthorized Sidekiq access by @detail-app[bot] in #3578
• fix: stop notifying about suggested visits by @Freika in #3614
• feat: add family history consent and sharing metadata by @Freika in #3613
• feat: add time range controls to video studio by @Freika in #3616
• Bump the ruby-minor-patch group across 1 directory with 18 updates by @dependabot[bot] in #3583
• 1.14.5 by @Freika in #3612

Full Changelog: 1.14.4...1.14.5