What's New in Version 2.14.1
You can find all issues related to this release on our Roadmap.
This release requires Icinga PHP Library 1.1.0 or later.
Security Fixes
This release fixes four vulnerabilities. The most severe one lets unauthenticated attackers read files accessible to the web server and overload it through the standalone chart endpoints, which are removed. LDAP and database users with a * in their login name could also receive the group memberships of other users. A navigation item label could inject HTML into the sidebar, and any authenticated user could remove remembered devices of other users.
- Remove the standalone chart endpoints to prevent file reads and denial of service GHSA-mph2-hvq4-8423
- Match usernames literally in database and LDAP backends GHSA-jff6-vjrf-q9gj
- Escape navigation item labels in sidebar submenu headers GHSA-grpw-587v-93vw
- Restrict remembered device management to the user's own devices GHSA-fmf2-272p-p3r9
Password Policy Password Parameters Marked as Sensitive
Password arguments are marked as #[SensitiveParameter] to keep them out of stack traces.
- Modernize password policy #5537
Password Policy Moved to the Security Configuration
The password policy setting moved from Configuration > Application > General to Configuration > Application > Security. Managing it now requires the config/security permission instead of config/general. Roles that were granted config/general to manage password policies must be updated to config/security, otherwise they lose access to the setting.
- Modernize password policy #5537
CSRF Protection for Config Forms
Icinga\Web\Form\ConfigForm callers must now set a session-stable ID with setCsrfCounterMeasureId() before assembly or explicitly disable protection with disableCsrfCounterMeasure().
- Add
CsrfCounterMeasuretoConfigForm#5552
CompatForm-based Repository Form
Icinga\Web\Form\RepositoryForm is a new CompatForm-based base class for forms that work with extensible, updatable, and reducible repositories. It supersedes Icinga\Forms\RepositoryForm, which will be deprecated in version 2.15. Relevant for developers: it's no drop-in replacement! The constructor signature, assembly method names, notification ownership, and submit controls all differ and have to be adjusted when migrating.
- Modernize repository form #5536
Sensitive Two-Factor Token
The $token parameter of Icinga\Authentication\TwoFactor::verify() is now marked #[SensitiveParameter] so the entered token is redacted from stack traces and error reports. Implementations of the contract should mark their own verify() parameter the same way.
- Mark TwoFactor::verify() token parameter as sensitive #5559
ConfigFormEventsHook Deprecation
Icinga\Application\Hook\ConfigFormEventsHook is deprecated and will be removed in version 2.15. The hook never evolved into a proper implementation, so there will be no replacement. Its documentation has been dropped to keep new code from depending on it.
- Modernize password policy #5537
Default Theme Mode
Administrators can set the default theme mode (system, dark, or light) in the theming configuration. Users without a personal theme mode preference get this default.
- Add configurable default theme mode to theming configuration #5541
- Add documentation about the default theme mode #5551
Fixes
Pages that need a configuration database explain what is missing instead of showing a stack trace. PostgreSQL authentication works with pdo_pgsql alone. Links with schemes such as data: or mailto: work again, which fixes downloads in Safari. Changing the timezone reloads the page like changing the locale does. Database migrations work with TLS client certificates, and hosts that modules allow for all users are no longer blocked by the browser.
- Handle a missing or unusable configuration database gracefully #5356
- Let PDO decode PostgreSQL password hashes #5584
- Support URLs whose scheme has no authority #5565
- Reload on timezone/locale preference changes and after authentication #5540
- Set
baseTargetfor user and group access-control list tabs #5558 - Fix config form value & Simplify CspConfigForm #5533
- Check for a preference store before accepting the primary submit button #5542
- Guard
TwoFactorHook::yieldMethods()#5543 - Sync
ipl\Html\Error::showTraces()with displayExceptions setting #5555 - Avoid a null array offset when selecting the dashboard pane #5588
- Fix logging level description in configuration #5566
- Tell DbTool about the resource's TLS settings #5571
- Add
getCspForAllUsers()directives to every user's CSP #5595
Framework Changes
Interface-based hooks cannot use HookEssentials, so Module::provideHook(), Hook::has(), Hook::all(), and Hook::first() are no longer deprecated. Hook::register() remains deprecated. The datetime picker behavior has been removed because all supported browsers support datetime-local inputs. CspHook::getCspForUser() is optional and returns only the directives a user needs in addition to getCspForAllUsers(). Icinga.renderHooks in JavaScript is deprecated.
- Keep hook APIs needed by interface-based hooks supported #5585
- Remove datetime picker behavior #5532
- Add
getCspForAllUsers()directives to every user's CSP #5595 - Docs: Mention that RenderHooks should not be used anymore #5557