This is mainly a security release. All users are encouraged to upgrade.
- 🔒 Fixed an ACL bypass in the DAV server: appending
?sabreAction=assetto a URL skipped every permission check, letting any authenticated user read other users' events, contacts and files, and letting anonymous clients overwrite existing objects. The shortcut is now limited to the browser plugin's assets on the DAV root - 🔒 Empty passwords are now rejected by all authentication backends. With LDAP, an empty password was passed to ldap_bind, which some directories (notably Active Directory) treat as a successful anonymous bind, allowing a login as any user
- 🔒 Destructive actions in the admin dashboard are now protected against CSRF: deleting users, calendars and address books, sharing and revoking calendars, and managing delegates are now POST requests carrying a token, instead of plain GET links
- 🔒 The dashboard and the API now check that a calendar or address book belongs to the user in the URL before showing, editing, sharing or deleting it. Deleting a calendar that was shared with a user only removes that share and no longer touches the owner's calendar; a calendar can no longer be shared with its own owner
- 🐛 The API no longer deletes all of a user's subscriptions and inbox items when one calendar is deleted, and GET
/api/v1/calendars/{userId}no longer fails for users who have a calendar subscription
API note: PUT/PATCH/DELETE /api/v1/calendars/{userId}/{calendar_id} and the /shares endpoints now return 400 when calendar_id is a calendar merely shared with the user. DELETE on such an instance removes the share only.
What's Changed
- Fixed security hole by @SeLLeRoNe in #268
- Fixed Invitation replies (accepted / declined / tentative) sent by e-mail showing the attendee as "(null)" in some mail clients, Apple Mail in particular (db8e571)
- Security fixes in #283
New Contributors
- @SeLLeRoNe made their first contribution in #268
How to upgrade
Nothing to do if you're on v5.4.3
Full Changelog: v5.4.3...v5.4.4