This is a major release of MRBS.
Upgrade note: password reset now requires $url_base to be set, including the scheme and host. Check your configuration before upgrading; see UPGRADE.md.
Security fixes
- Fixed LDAP injection in the authentication filter (GHSA-r543-f38c-cq6v). Filter and DN values are now escaped with ldap_escape(). Thanks to Duc Anh Le (GitHub: @leediay153) for reporting this.
- Fixed CSV formula injection in report exports (GHSA-9rvp-v4ff-wpwr). Values starting with =, +, -, @, TAB or CR are now prefixed, both from the server and from the DataTables CSV export button. Thanks to Duc Anh Le (GitHub: @leediay153) for reporting this.
- Fixed password reset poisoning via Host header injection (GHSA-73cv-hx7f-9v27). Password reset is now only offered when $url_base is set, and the reset link is never built from HTTP_HOST or SERVER_NAME. Thanks to Duc Anh Le (GitHub: @leediay153) for reporting this.
- Fixed ordinary users being able to request more info about other users' bookings, and to remind admins about other users' bookings (GHSA-rgxh-mqpj-353h). Thanks to tsurutanmen (GitHub: @tsurutanmen) for reporting this.
Changes
- Upgrade DataTables to Version 3.1.5, with Buttons 4.1.3, ColReorder 3.1.2 and FixedColumns 6.1.2, and fix the print CSS and MRBS custom CSS following the upgrade.
- Upgrade PHPMailer to Version 7.2.0.
Bug fixes
- Fix badly formed element in the brief description column of reports, which also stopped DataTables from respecting the locale when sorting that column.
- Add missing closing tags to reports and summaries.
- Fix TypeError when logging out while on the view_entry page, logging back in, editing the entry and then saving. See GitHub Issue #4079.
See NEWS or ChangeLog in the release for more details.
Enjoy!
The MRBS Development Team