This is a minor release of MRBS.
Changes since MRBS 1.12.2:
- Fixed command injection vulnerability in 'ext' authentication (GHSA-m25x-gcj8-36f9).
The external program is now run without a shell. $auth["params"] may now be an
array, and a string is split on whitespace, so configurations with quoted arguments
containing spaces need to be changed to the array form. Thanks to Artur Chlebicki
for reporting this. (GHSA-m25x-gcj8-36f9) - Fixed reflected XSS via unknown tags in language strings (GHSA-5wqw-q7gh-j65v).
Thanks to leediay153 for reporting this. (GHSA-5wqw-q7gh-j65v) - 'ext' authentication is no longer supported on Windows with PHP versions affected
by CVE-2024-5585. - Add automatic refreshing of the current user's data after a configurable interval.
See GitHub Issue #4004. - Add option of forcing unique email addresses when using 'db' authentication.
See GitHub Issue #4023. - Add Galician translation. See GitHub PR #4035.
- Upgrade to jQuery Version 4.0.0 and Select2 Version 4.1.0.
- Improve performance when using the 'wordpress' and 'joomla' authentication types.
See GitHub Issue #4046. - Fix bug making it impossible to enter kiosk mode, and preventing logon, when using
Joomla. - Fix bug preventing logon to WordPress after an incorrect login.
- Fix bug where Search ignored the search string and from date after the jQuery 4
upgrade. - Fix DataTables error "Invalid JSON response".
- Fix bug where administrators were not automatically booking administrators.
See GitHub Issue #4038. - Fix bug when logging in with a gmail.com/googlemail.com address using PostgreSQL
and 'db' authentication. See GitHub Issue #4022. - Fix LDAP authentication failure on non-AD servers when using bind/search DN.
See GitHub PR #4020. - Fix representation of dates in week ranges when in the Norwegian locale.
See GitHub Issue #4055. - Use singular version of time units in durations, eg '1 hour' instead of '1 hours'.
See GitHub Issue #4061. - Fix uncaught exception when moving a room to an area that already has a room with
the same name. - Many other minor bug fixes and improvements
See NEWS or ChangeLog in the release for more details.
Enjoy!
The MRBS Development Team