Security patch release: a crafted link to the Google Calendar connection page could run script in the browser of a logged-in user. Upgrading is recommended for every instance. No migrations, no configuration change.
Security
- Reflected XSS in the Google Calendar OAuth callback (#299) - The callback page echoed the provider's
errorparameter into the page without escaping it, and it is read before the OAuth state is checked, so anyone could put markup in a link to/dashboard/sources/google/callback. A logged-in user who followed such a link ran the attacker's script with their session, which against an admin could act in the admin panel. The parameter is now escaped, and so are the two other messages that page echoes from Google's responses. Found while reviewing #260.