ruTorrent v5.3.15 — v5.3.14..7e01249, 56 commits
. A security-hardening release across the XML-RPC pass-through, the HTTP client, file operations,
credential handling and DOM output. Version bumped in #3296; tag 7e01249.
Security
- XML-RPC pass-through: a denied command is refused wherever it is named,
spelled, aliased or nested, at both entry points (rpc2.php and the httprpc
plugin); a system.multicall member is judged the way the same call is judged
alone, and only the bytes this side validated are sent on; command names
carrying markup are refused. The addition allowlist still permits the commands
the bundled plugins build, so a legitimate batched add is no longer refused
for a command or a label it carries. (#3277, #3282, #3284, #3297, #3299,
#3303, #3305, #3306, #3315, #3322) - Add-torrent: the result is reflected as data with content-type sniffing
forbidden, and the reply stays a valid call even when a torrent name or result
carries bytes that are not UTF-8. (#3280, #3312) - File operations: a move or automove refuses to overwrite a file already at the
destination, stays inside the directory it was given — following no symlink a
torrent's own path elements introduce — and rolls back cleanly if it stops
partway; erasedata deletes only the files that belong to the download, follows
no symlink out of it, and publishes its deletion list before the torrent
becomes erasable rather than on trust. (#3285, #3286, #3301, #3304, #3317,
#3318, #3324) - HTTP client (Snoopy): HTTPS certificates are verified, an install may opt out,
and a certificate failure is reported only when one actually occurred; a
redirect is judged by its (scheme, host, port) origin rather than its host
name, and credentials are no longer handed to the host a redirect names.
(#3289, #3290, #3300, #3311) - External addresses: only http(s), ftp and magnet addresses from remote
sources — feeds, look-at, external search — are opened, and external help and
remote pages open without a handle back to the ruTorrent tab. (#3293, #3298,
#3307, #3310, #3326) - DOM output: context-menu, track-label and help actions run functions instead
of eval'd command strings; the torrent comment, the feed picker, feed (bbcode)
markup and RSS errors render as inert text, elements or a lang key rather than
evaluated HTML; settings interpolated into emitted script are JSON-encoded;
the mobile pane escapes the values it builds HTML from. (#3278, #3279, #3287,
#3288, #3292, #3294, #3295, #3316, #3321, #3325) - Credentials kept out of the browser: stored tracker passwords and loginmgr
accounts stay off the page (accounts emitted as data, stored as scalars), and
the XMPP settings page is told whether a password is stored, not what it is,
and escapes the values it sends back. (#3291, #3308, #3309, #3325) - Cache files: a serialized cache file that names a class or a path of its own
is refused, and the walk that checks it is bounded so a self-referential or
exponentially branching graph cannot hang the process. (#3283, #3323)
Core
- A failed AJAX request shows the fault it carries rather than the transport
envelope. (#3275) - The unlaunch command no longer falls through into the done handler. (#3281)
Interface
- The torrent list clears its range-selection anchor when rows are cleared, so a
later shift-click does not extend from a stale one. (#3266) - A context-menu entry with no command is drawn as a disabled item instead of
dropping the rest of the menu. (#3302)
Plugins
- trafic: the ratio columns stay filled, and rStat can read a profile other than
the default. (#3270) - seedingtime: elapsed duration is clamped to zero across a backward clock step.
(#3271) - mobile: adds a help link. (#3268)
Localization
- Updated Polish translation. (#3276)
Development
- The editorconfig-checker CI job is pinned to node 24 (on older node it exits 0
without reading a file), and the tests/ tree is held to the same whitespace
rules as the rest of the checkout. (#3314, #3327) - Deployment docs: README and nginx-example spell out what the deny rules do not
cover and lead with moving the profile directory and denying share/. (#3291,
#3313) - Test dependency js-yaml bumped 3.14.2 → 3.15.2. (#3272)
- Version bumped to 5.3.15. (#3296)
##Play by play from GitHub##
What's Changed
- s-table: clear the range-selection anchor in clearRows by @noctuum in #3266
- mobile plugin: add help link by @koblack in #3268
- Title: trafic: keep the ratio columns filled, and let rStat read another profile by @xirvik in #3270
- fix(seedingtime): clamp elapsed duration to zero on clock skew by @jakobbg in #3271
- Ajax: show the fault a failed request carries, not the envelope by @xirvik in #3275
- build(deps): bump js-yaml from 3.14.2 to 3.15.2 in /tests by @dependabot[bot] in #3272
- update Polish translation.. by @koblack in #3276
- Refuse XMLRPC command names that carry markup by @xirvik in #3277
- Render the torrent comment as text instead of as HTML by @xirvik in #3278
- Build the feed picker options as elements, not as html strings by @xirvik in #3279
- Reflect the add-torrent result as data, and forbid type sniffing by @xirvik in #3280
- Stop the unlaunch command falling through into done by @xirvik in #3281
- Stop a request naming the rtorrent commands an add runs by @xirvik in #3282
- Refuse a cache file that names a class, or a path, of its own by @xirvik in #3283
- Refuse a denied command wherever it is named, spelled or nested by @xirvik in #3284
- Delete only files that belong to the download being erased by @xirvik in #3285
- Refuse a move that would write over a file already at the destination by @xirvik in #3286
- Parse feed markup into a document that cannot act on it by @xirvik in #3287
- Render rss errors from a lang key instead of evaluating them by @xirvik in #3288
- Stop sending credentials to the host a redirect names by @xirvik in #3289
- Encode settings interpolated into emitted script as JSON by @xirvik in #3292
- Open the track label editor from a function, not an eval string by @xirvik in #3294
- Keep stored tracker passwords out of the browser, and say to deny share/ by @xirvik in #3291
- Check HTTPS certificates, and let an install say not to by @xirvik in #3290
- Escape the remaining values the mobile pane builds html from by @xirvik in #3295
- Open only http(s), ftp and magnet addresses from remote sources by @xirvik in #3293
- Bump version to 5.3.15 by @xirvik in #3296
- Permit the addition commands the shipped plugins build by @xirvik in #3297
- Keep feed items whose address the browser is willing to open by @xirvik in #3298
- Stop a batched add being refused for the label it carries by @xirvik in #3299
- Say a certificate failed only when one did by @xirvik in #3300
- Refuse an automove that would write over a file already at the destination by @xirvik in #3301
- Keep a context menu entry that has no command to run by @xirvik in #3302
- Quote what a load call carries, and judge it as the daemon reads it by @xirvik in #3303
- Leave nothing half applied when a move is refused by @xirvik in #3304
- Let a client attach the commands the bundled plugins attach by @xirvik in #3305
- Refuse a denied command under every name the daemon registers for it by @xirvik in #3306
- Keep the feed items and look-at entries the browser will open by @xirvik in #3307
- Emit the loginmgr accounts as data, and store them as scalars by @xirvik in #3308
- Tell the page whether an XMPP password is stored, not what it is by @xirvik in #3309
- Keep the add-torrent reply a call even for bytes that are not UTF-8 by @xirvik in #3312
- Judge a redirect by its origin, not by its host name by @xirvik in #3311
- Hold tests/ to the whitespace rules the rest of the tree follows by @xirvik in #3314
- Say what the deny rules do not cover, and lead with moving the profile by @xirvik in #3313
- Open a remote address without a handle back to this tab by @xirvik in #3310
- Send the bytes that were judged, at every level of a proxied call by @xirvik in #3315
- Keep a move inside the directory it was given, and undo one that stops part way by @xirvik in #3317
- Delete what is inside the download and nothing a symlink leads to by @xirvik in #3318
- Give a menu entry a function to run, never a string to evaluate by @xirvik in #3316
- Open a plugin's help address without a handle back to this tab by @xirvik in #3326
- Indent the menu entries with tabs, and pin node 24 for the editorconfig job by @xirvik in #3327
- Budget the walk that checks a cache file for a refused class by @xirvik in #3323
- Give the feed and saved-search menus functions to run, not strings by @xirvik in #3321
- Judge a system.multicall member the way the same call is judged alone by @xirvik in #3322
- Publish the erasedata list before the torrent is erased, and not on trust by @xirvik in #3324
- Escape the values the XMPP settings form sends by @xirvik in #3325
Full Changelog: v5.3.14...v5.3.15