v26.09.2-ls292

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.2-ls291...v26.09.2-ls292

Remote Changes:

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

v26.09.2-ls291

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.1-ls290...v26.09.2-ls291

Remote Changes:

Security Release

• Update Instructions
• Update details on blog

This is a security release to address the following vulnerabilities:

• Comments of deleted pages could remain visible to API users while the page remained in the recycle bin.
• Attachments of pages could be modified by others (that have attachment update/delete permissions), while that page remained in draft status.

This update also includes various security improvements, which can be found listed below.

Updating is generally advised, but more so if either of the above two scenarios is a concern for your instance.

A big thanks to the following researchers for responsibly reporting vulnerabilities and security considerations, which were addressed in this release:

• Huzaifa Dal (GitHub, LinkedIn)
• Nicol (cqliuke)
• Semilore Osofisan (of Seneca Polytechnic, reporting as part of their WAS705 application security project)
• VG
• Xora (Website)

Full List of Changes

• Updated user password change to also drop any remember-me cookies to limit existing session use.
• Updated ZIP import validation to check total uncompressed sizes to help limit denial of service attacks.
• Updated SAML2 routes to prevent nuisance cross-site requests causing logouts.
• Updated PHP package versions.
• Fixed comments incorrectly showing in the API when their related pages are in the recycle bin.
• Fixed the permissions checked for attachment actions to consider draft status of the related page.

v26.09.1-ls290

CI Report:

N/A

LinuxServer Changes:

• aadd upstream release notes by @aptalca in #300

Full Changelog: v26.09.1-ls289...v26.09.1-ls290

Remote Changes:

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated audit log to use the configured display timezone. Thanks to @assyrus-favolo. (#6170)
• Updated translations with latest changes from Crowdin. (#6229)
• Updated ZIP import handling to verify the actual uncompressed size before extraction.
• Updated PHP package versions.
• Fixed page permissions not being regenerated on chapter promotion. (#6226)
• Fixed API attachment list endpoint showing attachments for pages in the recycle bin. (#6194)

Thanks to ma4ter (GitHub) for responsibly reporting the ZIP import scenario.

v26.09.1-ls289

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.1-ls288...v26.09.1-ls289

Remote Changes:

Updating to v26.09.1

v26.09.1-ls288

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09.1-ls287...v26.09.1-ls288

Remote Changes:

Updating to v26.09.1

v26.09.1-ls287

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09-ls286...v26.09.1-ls287

Remote Changes:

Updating to v26.09.1

v26.09-ls286

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.09-ls285...v26.09-ls286

Remote Changes:

Updating to v26.09

v26.09-ls285

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.05.5-ls284...v26.09-ls285

Remote Changes:

Updating to v26.09

v26.05.5-ls284

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.05.4-ls283...v26.05.5-ls284

Remote Changes:

Updating to v26.05.5

v26.05.4-ls283

CI Report:

N/A

LinuxServer Changes:

Full Changelog: v26.05.4-ls282...v26.05.4-ls283

Remote Changes:

Updating to v26.05.4