Reitti v5.3.2 Release Notes

Hey everyone, Daniel here! 👋

Short release this time, but an important one: one security fix and a big cleanup of the main page. If you only read one section today, make it the next one.

Security Fix — Please Update

@kgaut reported a vulnerability in reitti's setup flow: it was possible to bypass the setup filter on an already-configured instance and grant admin rights to any user. This is now fixed, and I added tests to make sure the setup filter actually does its job from now on.

⚠️ If your instance is reachable from the outside world, update immediately. Because reitti is open source, there is unfortunately no way for me to ship this fix without also revealing the details.

Can't update right now? There is a stopgap: block the setup route in your reverse proxy.

# nginx
location /setup {
    return 403;
}

# Caddy
respond /setup 403

A big thank you to @kgaut who reported this — responsible reports like this are what keep open source projects healthy.

The setup filter in every release before v5.3.2, apparently.

It was not fine. v5.3.2 puts out the fire.

The Main Page, Reworked

The other big part of this release is a rework of the main UI, based on requests from many of you.

Pick Your Date Picker Style

Not a fan of the date band? In Map Settings → Date Picker Style you can now switch to a more traditional date picker that uses one or two plain input fields instead of the band.

Type Your Way Through Time

There is also a completely new way of navigating dates: on the main page, just start typing a date and a popup appears showing what reitti understood. You can:

• enter dates in your locale's format,
• span ranges by typing something like 2025 - 2026,
• or simply type today or yesterday.

As a heavy keyboard user myself, this is my favorite little addition in a long time.

One Clean Bar at the Top

While reworking the inputs, I also tidied up the whole top of the page:

• The time control for scrubbing through the selected range now sits directly on top of the date band — it is no longer a floating panel, and it doesn't jump around the screen anymore.
• The floating action button container moved into the new bar at the top as well.

Everything now lives in one place, and the main page finally has a much calmer, cleaner look.

Help Spread the Word

Small release or not, word of mouth is what keeps reitti growing. If you know someone looking for a private Google Timeline alternative or a way to geotag their Immich library, mention reitti — I would much rather spend my time writing code than posting on social media, so every mention helps more than you know.

Full Changelog: v5.3.1...v5.3.2

Getting Started

The latest docker-compose.yml is available in the GitHub release assets.

• GitHub: Report issues & view source
• RSS: Stay updated by adding .atom to the end of our releases URL
• Discuss: Join the conversation on Lemmy
• IRC: #reitti on libera.chat

If you have any questions, feel free to add them to the release discussion.

Thank you all for being part of this journey. Happy tracking — and happy typing!

— Daniel