leomoon-studios/wiki-go v1.9.2

Release v1.9.2

on GitHub

Wiki-Go v1.9.2

This is a security release. Users running Wiki-Go 1.9.1 or earlier should upgrade to 1.9.2.

Security fixes

1. Fixed double-decoding path traversal and missing authorization checks affecting restricted documents and document APIs.
2. Fixed attachment rename traversal that could move files outside the documents directory.
3. Fixed encoded-backslash traversal affecting document read, write, move, and version operations.
4. Fixed server-side request forgery in metadata fetching by blocking private, loopback, link-local, and cloud metadata destinations.
5. Fixed comment-deletion traversal that could target files outside the comments directory.
6. Fixed unauthenticated login log injection by neutralizing control characters in log records.

Version information

• Affected versions: <= 1.9.1
• Patched version: 1.9.2

Commit history

• test: cover page backslash traversal (177ee6d by Amin Persia)
• security: audit sensitive logging (af27b23 by Amin Persia)
• test: cover login log injection (f93c8f9 by Amin Persia)
• security: neutralize log control characters (2ed3666 by Amin Persia)
• test: cover comment deletion traversal (bbae067 by Amin Persia)
• security: enforce comment storage boundary (224ef2a by Amin Persia)
• security: contain comment file paths (98c0adc by Amin Persia)
• security: unify attachment path boundaries (bba3e64 by Amin Persia)
• test: cover metadata endpoint security (1c7f473 by Amin Persia)
• security: enforce metadata request policy (c587c70 by Amin Persia)
• security: validate metadata request destinations (25498eb by Amin Persia)
• test: cover editor path containment (20b0d50 by Amin Persia)
• security: contain document editor paths (94f7e73 by Amin Persia)
• security: resolve document paths safely (92fcec4 by Amin Persia)
• security: enforce safe attachment renames (8adbcb7 by Amin Persia)
• security: constrain attachment rename paths (81cd12e by Amin Persia)
• test: cover document access containment (e86940b by Amin Persia)
• security: enforce document access rules on editor APIs (78843c0 by Amin Persia)
• security: canonicalize document request paths (b62aa4b by Amin Persia)
• ci: link authors in release history (3a4c07d by Amin Persia)