Security release
This release fixes a path traversal vulnerability in the tenant-aware file
storage, static files storage/finder and template loader. Each tenant's
directories are built from its schema_name, and the validator accepted /
and ., so a schema name such as x/../victim or ../../app could point a
tenant's media/static/template root at another tenant's directory or outside
the configured root. Applications that let an untrusted user influence a
tenant's schema_name could be exploited for cross-tenant file access or for
reading and writing files elsewhere on the server.
Affected: 3.4.1 – 4.0.1. All users should upgrade.
See the advisory for full details, impact and mitigations:
GHSA-xpxg-j6jm-rp27
Upgrade note
Schema names may no longer contain /, and may not be . or ... Such names
are extremely unusual; a tenant using one will raise ValidationError (or
SuspiciousFileOperation when its file paths are built) after upgrading.
Letters, digits, underscores, hyphens, dots within a name and mixed case are
still accepted.
Because the schema name is checked on every database connection, a tenant with
such a name will lose database access as well as file access. To recover, run
python manage.py rename_schema --rename_from <old> --rename_to <new> to give
the tenant a valid name, ideally before upgrading.