What's Changed

This is a security release on the 3.2.3 line. It closes two Critical vulnerabilities that let an unauthenticated visitor execute code on the TeamPass server: a bypass of the access guard shared by the AJAX handlers (GHSA-988j-pf6f-2m2r) and an installer that could still be run after installation (GHSA-8xp7-fh3p-5pcr). It also keeps backup files private on disk, fixes the upgrade of a database whose name contains a dot, and adds a Licence tab to the statistics that charts the browser extension seats. Upgrading is required for every installation.

This release is code only: no ALTER TABLE, no schema change and no new data migration. UPGRADE_MIN_DATE is deliberately left at its 3.2.3.0 value, so installations already running 3.2.3.0 are not sent back through the upgrade wizard.

🔒 Security fixes

• Anonymous requests no longer pass the access guard of the AJAX handlers (GHSA-988j-pf6f-2m2r, Critical, reported by @Al-oxos) - every sources/*.queries.php handler checks the session and the page rights through a shared guard. A request without any session could pass it: the guard accepted an empty identity, and the per-action session key check compared two empty values. Most administration actions rely on that guard alone, so an anonymous visitor could change the settings, point the files folder to a directory served by the web server, allow every extension, and then upload a PHP file and run it. The guard now refuses any request without an authenticated user and session key, and the administration and upload handlers check both again themselves. Defence in depth: the upload handler refuses any upload type it does not process, the files and upload folders can no longer be set inside the public directory of TeamPass (the setting is refused with a message), and the Docker image's nginx configuration, like the samples in the installation and upgrade guides, no longer executes a PHP file under /assets or /plugins. Affected: 3.0.10 to 3.2.3.0.

• The installer can no longer be run on an installed instance (GHSA-8xp7-fh3p-5pcr, Critical, reported by @fernandobortotti) - the steps of the installation wizard had no authentication and no working CSRF protection, and stayed reachable once TeamPass was installed. One step ran any method named in the request, and the one that writes app/config/settings.php copied the database values of the request into its PHP source without escaping them: a crafted request injected PHP code that ran at the next page load. The wizard is now refused once TeamPass is installed, every step requires the install session and its CSRF token, the steps that dispatch actions only run the ones they declare, the table prefix is validated, and every value written to settings.php is escaped. Affected: every version up to 3.2.3.0.

• Backup files are no longer readable by every local account (PR #5432, @guerricv) - on-the-fly, scheduled and local externalized backups, and their .meta.json files, were created with the default mode of the process, often 0644: right after the permission repair plan of System Health was applied, the next backup brought a permission warning back. The plaintext SQL dump written during a backup is now 0600, and the archives and their metadata at most 0640, an owner-only file keeping 0600. The mode is set before the content is written, and a backup whose protection fails is not published. During a restore, the decrypted archive and the SQL extracted from a package are also 0600, and a failed decryption attempt removes its output before the next key is tried; restored documents, such as avatars, keep the group read the web server needs. When chmod() is refused or disabled, the backup stops; when a filesystem accepts it but keeps its own modes (SMB/CIFS without Unix extensions, WSL drives), TeamPass logs a warning and continues. Existing archives are not changed. See Backups.

✨ New features

• Browser extension seats in a Licence tab of the statistics - Statistics gains a Licence tab with the seats used this month against the quota, the users refused this month because the quota was reached, the users active today and the licence expiry, and a chart of the seats used on each of the last 31 days. Seats are counted per calendar month (UTC), so the bars climb during the month and drop back on the 1st, which the chart marks. The tab reads the licence state the dashboard already keeps: opening it does not call the licence server when that state is fresh. The Browser Extension tile of the administration dashboard links to it. The history comes from the licence server, which records one point per day: until it provides that history, the tab shows the current figures and says that no history is available yet.

🐛 Bug fixes

• The upgrade no longer stops on a database whose name contains a dot (PR #5433, @MarMarAba) - with a database named, for example, co.example.passwords, the upgrade wizard stopped at the 3.1.5 step with an SQL syntax error. The conversion to utf8mb4 quoted the name as a table name, which splits it on each dot, and produced `co`.`example`.`passwords`. The name is now quoted as a whole, in the upgrade, in step 5 of the installer and in the conversion run for upgrades from versions older than 2.1.26.

• Changing the comment of a backup reports a failure - when the metadata file of a backup could not be written, the Backups page still reported the comment as saved. It now reports the error.

📚 Documentation

• The Browser extension page is rewritten around two short paths: how a user connects the extension, in one click from Profile → Browser extension, and how an administrator enables it in Settings → API. The details (vault lock, passkeys, licence, free trial, troubleshooting) are condensed in a reference section, with the labels of the current extension.
• The Backups page describes the permissions of backup files and the mount options for SMB/CIFS destinations.

⬆️ Upgrade notes

• Schema. No schema change: installations already on 3.2.3.0 are not sent through the upgrade wizard.
• Your own web server configuration. The Docker image is updated by the release. If you run TeamPass behind your own nginx, add the rule of the installation guide that denies .php files under /assets and /plugins, before the PHP location. With Apache, the .htaccess shipped in public/assets already disables PHP there, provided AllowOverride lets it apply.
• Files and upload folders. Check in Settings that the files folder and the upload folder are outside the public directory of TeamPass. An existing value is not changed by the upgrade, but saving a folder inside it is now refused.
• Backups written by another account. New backup files are no longer readable by every account of the server. If a scheduled backup runs under an account other than the web server's, give both a common group, or run it as the web server's account, as the documentation and the Docker image already do.
• Seat history. The Licence tab fills in once the licence server provides the daily history; until then it shows the current figures only.
• Back up your database before upgrading, as always.

Full Changelog: 3.2.3.0...3.2.3.1

Important

• Requires at least PHP 8.2

Languages

Please join Teampass v3 translation project on Poeditor and translate it for your language.

Installation

Follow instructions from Documentation.

Upgrade

Follow instructions from Documentation.

Ideas and comments

Are welcome ... please use Discussions.