Update to v26.03.4 - #10
Open
rbertram90 wants to merge 422 commits into
Open
Conversation
…in-docker
Git 2.35+ may refuse to operate on bind-mounted repos with differing ownership ("dubious ownership"), Mark /app as safe within the container.
Added Id to crowdin config for compatibility with upcoming change to crowdin CLI process after switch to codeberg
Within the responsibility of the theme service instead of being part of the app configuration.
Adds a registration system via the logical theme system, to tell BookStack about views to render before or after a specific template is included in the system.
Updated function name also.
Changed the system out to be a theme event instead of method, to align with other registration events, and so that the theme view work can better be contained in its own class.
Added test to cover.
Added and updated tests to cover. Also updated API auth to a narrower focus of existing session instead of also existing user auth. This is mainly for tests, to ensure they're following the session process we'd see for activity in the UI.
Not yet tested at all, either manually or via PHPUnit
- Added (limited) redirect handling to module downloads. - Adjusted wording/text for consistency and clarity. - Fixed scenarios where process was not stopped on error. - Fixed module folder creation check/logic. - Added better failed request handling to module downloads. - Updated download response streaming to monitor/limit download size.
- Updated the system to work with modules. - Updated module docs to consider namespacing. - Fixed view loading and registration event ordering. - Fixed checking if views are registered.
Added a central URLFilter class to check & clean URLs used for attachments, which is also used for validation, and by the purifier to standardise protocols (and to make protocol config easier in future). Thanks to mfk25 for reporting.
Aligns it with other actions/endpoints, and ensures an extra layer of control against malicious use. Thanks to mfk25 for reporting.
Adds a more substantial URL check, via a new class which is shared and used in other parts of the app for consistency. Thanks to mfk25 for reporting.
…(#6153) from PolarniMeda/bookstack:development into development Reviewed-on: https://codeberg.org/bookstack/bookstack/pulls/6153
… (#6166) from l10n_development into development Reviewed-on: https://codeberg.org/bookstack/bookstack/pulls/6166
|
The composer.lock diff comment has been updated to reflect new changes in this PR. |
Thanks to Ashutosh Jena(MAVERICK-VF142) for reporting. Not considered a significant security issue since it already required page update permissions, which would generally be considered higher privileged than the added page view.
- Adds a dummy hash attempt to balance the time of unknown user login attempt with known user login attempt to help prevent timing being used to indicate existing accounts. - Adds some random variance to failed login attempts to help prevent timing based information discovery. Thanks to Tanner Marks for their responsible disclosure of this.
- Added more complex srcset parsing and URI handling via custom built HTMLPurifier filter, which I've also provided upstream. - Added a custom URI filter to force require URI schemes.
Added tests to cover. Thanks to whale120 for reporting.
Updated exception handler to reduce the amount of detail shown to prevent potentially sensitive details (like internal paths) being shown in the error message. Added an interface for specifically marking exceptions whos messages we may want to show. Thanks to Tanner Marks for reporting.
Aligns with ImageController permissions by checking related item view access only if that still exists. Thanks to Tanner Marks for reporting.
Updated endpoint image querying to generally follow the same logic to ensure filtering on just the expected types which are intended to be managed by this endpoint, and it err on the side of caution in terms of access control.
…) from l10n_development into development Reviewed-on: https://codeberg.org/bookstack/bookstack/pulls/6175
|
The composer.lock diff comment has been updated to reflect new changes in this PR. |
|
@rbertram90 Whatever happened to this? PS I've just set up mail as I realised it wasn't working for notifications, there might be some changes needed in the env vars if they have updated the Laravel Framework verison. |
Author
|
@mojowill I want to rebase and merge, not squash as don't want the squash commit but some issue with github isn't allowing it. There might be a workaround https://github.com/orgs/community/discussions/27521, haven't got round to trying it. Ticket sitting in blocked. |
|
I've seen this before with the GitHub UI and large diffs. Only solution was to do it locally and then force push. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.