pixari/OpenTodo v0.14.2

OpenTodo v0.14.2

on GitHub

OpenTodo 0.14.2 is the second security release of the internal audit; please upgrade. It narrows what the server can reach on its own network (map proxy, private-target switch), keeps one client from using up a hosted tenant's or the demo's limits, tightens single sign-on linking and password reset, and closes attachment quota and cache gaps. The first-run setup code is now off by default: a fresh server can be set up without reading its log; set OPENTODO_SETUP_CODE=required to keep the code.

Upgrade notes

• The first-run setup code is now off by default. If you relied on it to protect a fresh server reachable from the internet, set OPENTODO_SETUP_CODE=required; OPENTODO_SETUP_TOKEN works as before. Without either, the first person to open a server with no owner becomes its owner: finish setup right after starting it. (The setup code)

Changed

• The setup code for a new server is opt-in. A fresh server no longer asks for the one-time code from its log: the first person to open it creates the owner account, and the log says so at every start until then. Set the new optional OPENTODO_SETUP_CODE=required to ask for the code again; OPENTODO_SETUP_TOKEN still works and wins. On a server reachable from the internet, finish setup right after starting it, or set OPENTODO_SETUP_CODE=required. (The setup code)

Security

• Hosted services: the map proxy no longer reaches the operator's network. On a server that hosts several tenants, a tenant's owner could choose a map provider that made the server fetch addresses on the operator's private network or a cloud metadata service. The map proxy of a hosted tenant now reaches only public addresses. Found in an internal audit. (Host mode)
• The map provider can no longer point your server at your local network. A self-hosted tile or search server on your network keeps working, but only the two hosts you typed may be local: tile, font and sprite addresses that a provider's style names, and redirects, follow the same rules as a webhook. Found in an internal audit. (Maps)
• "Allow private network targets" no longer opens cloud metadata and link-local addresses. With the switch on, webhooks, notification channels, calendar subscriptions, issue connections and AI providers still reach your LAN and this machine, but never 169.254.0.0/16, fe80::/10, 0.0.0.0/8 or a cloud metadata address. Webhook test sends and redeliveries are limited to 30 per account per hour. Found in an internal audit. (Webhooks)
• Hosted services: one client can no longer lock a tenant out. The request limit per minute applied to all of a tenant's traffic, signed in or not, so anyone could use it up and every user of that tenant got "too many requests". It now counts each client address separately. Found in an internal audit. (Host mode)
• Public demo: the sandbox limit can no longer be held by one party. When the demo is full, the oldest sandbox now makes room for a new visitor after 15 minutes even if it is being kept busy, new sandboxes per IPv6 site (/48) are limited together, and the demo creates at most twice its sandbox limit per hour. Found in an internal audit. (Demo instance)
• Single sign-on links to an existing account only when its address was confirmed. An address nobody confirmed (set without outgoing email) could catch another person's first sign-on. Accounts whose address was confirmed through an emailed link, or that already signed on with the same address, still link at the first sign-on; others sign in with their password once and link the provider in Settings → Account → Security. Found in an internal audit. (Single sign-on)
• The setup code, when turned on, is asked for from every other machine. With OPENTODO_SETUP_CODE=required, a browser on the local network no longer skips it: behind Docker's port publishing, a NAT or a rootless container, a visitor from the internet could look local. Only a browser on the server itself, connecting directly, skips it. Behind a reverse proxy, a forged leading X-Forwarded-For entry no longer becomes the client's address. Found in an internal audit. (The setup code)
• "Forgot password?" no longer reveals which addresses have accounts by its response time. The reset email is now sent after the answer. Found in an internal audit.
• The attachment total can no longer be exceeded. Undoing the removal of a file is now checked against your total, and several uploads at once share it, so neither can store more than the owner allows. Found in an internal audit. (Attachments)
• Files no longer stay readable in the browser after signing out. Attachments are now checked with the server each time they are shown, and signing out asks the browser to empty its cache for OpenTodo (on https), so the next person on a shared computer cannot open them. Found in an internal audit.
• Links from encrypted data open only as web links. A task's source link and a link attachment of an encrypted account open only http and https addresses; anything else is shown without a link. Found in an internal audit.

Fixed

• The Assistant page shows its title on a phone in every language. On a narrow phone, the page's History and New chat buttons took the whole top bar in French, Spanish, Italian, German and Portuguese, leaving no room for the title. Below tablet width the two buttons now show their icons only, and their names stay available to screen readers.

Install

• Docker: docker run -d -p 8080:8080 -v opentodo:/data ghcr.io/pixari/opentodo:0.14.2
• Binary: download opentodo-<os>-<arch> below, then run it (data goes to ./data).
• Command-line client: ot-<os>-<arch>. Browser extension: opentodo-browser-extension-chrome.zip and opentodo-browser-extension-firefox.zip.

Verify downloads with sha256sum -c SHA256SUMS. Self-hosting guides: docs/self-hosting.