github jhuckaby/Cronicle v0.8.10
Version 0.8.10

latest releases: v0.9.46, v0.9.45, v0.9.44...
5 years ago

This is mainly a security patch release. The WebSocket API used to watch live job logs on the Job Details page wasn't validating the user's Session ID, effectively allowing the API to be hit by anyone who has HTTP access to the Cronicle server. This is a nasty security hole, but note that requests also need to specify the exact Job ID, which is a 11-character hash, and would be difficult (but not impossible) to guess.

This live job log API is read-only, and only allows a user to follow a live job log. It does not allow the user to make any changes to the server, or abort or modify any running jobs.

A security audit was performed across all the remaining Cronicle APIs, both HTTP REST and WebSocket, and they all require proper authentication (either session ID or API key). The live job log API was the only one missing a session ID check, and is now fixed as of this version.

Also in this release, if the live job log API fails to connect (this is a direct socket connection to the individual server running the job), a visual error message is emitted to the UI, so the user can see what is happening.

Don't miss a new Cronicle release

NewReleases is sending notifications on new releases.