kobotoolbox/kpi 2.026.23a

on GitHub

• search: restrict relational lookups in q searches (#7189)

We have resolved an information-disclosure vulnerability within the API search (q) parameter. There is no evidence that this vulnerability has been exploited in the wild.

Security Context

KoboToolbox has a powerful and flexible query parser that allows a variety of comparison operators, including operators that check for partial matches. The query parser also permits traversing related objects and applying the comparison operators to fields from those related objects. This allows us, for example, to find library items whose parent collections match some desired criteria. The flaw was that sensitive fields could be targeted as operands for these queries. While the contents of these fields could not be revealed directly, they could be guessed in a piecemeal fashion by invoking partial-match operators and observing the effect on the query results.

The Fix

The query parser now strictly validates every field path against the search's root model:

Lookups can no longer traverse into blocked sensitive models, regardless of the relation names used.

A specific set of sensitive column names is explicitly rejected wherever it appears.

Legitimate searches are completely unaffected, and the generated SQL for accepted searches remains unchanged.

Action Required ⚠️

Self-hosted installations should update to this release as soon as possible to ensure their environments are protected. Sign up for future security announcements on this page.

Credit

Thank you to Santosh Kumar Puppala (https://github.com/Santoshkumarpuppala) for reporting this issue responsibly.

• users: add last_project_activity field and backfill LRM (#7167)

  Internal only — no user-visible change.

  👷 Description for instance maintainers

  A new last_project_activity field on ExtraUserDetail tracks the most
  recent project-related activity for each user, including data
  submissions, submission edits, and asset creation or modification. The
  field is updated automatically on each relevant action and is throttled
  (default: 1 hour) to avoid write storms.

  A long-running migration (LRM 0026) backfills the field for existing
  users. Users with a recent login are skipped as they are already
  classified as active.

  This lays the groundwork for optimizing mass email filters and the
  Django admin user filters in the next release.

• longRunningMigrations: backfill root_uuid missed by LRM 0005 (#7178)

  Some submissions returned a 404 on the supplementary data endpoint
  because their `root_uuid` was never backfilled by LRM 0005 due to a
  taggit multi-DB routing bug that silently skipped affected XForms.

• processing: enable processing view for questions in renamed groups (#7187)

  Enables users to view/process answers to audio questions that are
  included in groups that have been renamed after the relevant submission.