This is a important security update, with a change in configuration to fix one of those security issues.
Thanks to @nrbxyz and @enchant97 for reporting their related security reports.
⚠️ New & Changed Configs ⚠️
Due to security implications BEHIND_PROXY has been replaced.
| Name | Description | Default |
|---|---|---|
PROXY__REAL_IP_HEADER
| Header where the real ip is sent from proxy | |
PROXY__TRUSTED_IP
| comma seperated ip prefixes, e.g 192.168.1.1/24 |
Changes
Changed
- GHSA-g3gp-m83w-qmwv; replace real-ip usage with improved method
- bump deps
Fixed
- GHSA-g52v-2233-fcvj; CSRF on certain endpoints can result in account/paste deletion
Full Changelog: v2.4.1...v2.5.0