Self-host mosparo

Version 1.5.13 is a security release that fixes multiple security-related issues and many bugs. While this is a security release, it's important to note that the fixed security-related issues are low-severity.

We want to note that this version has nothing to do with the PHP security patches released last week. We prepared this version before the announcement of the PHP security patches, but postponed the release from last week to today.

Update and setup

• Fixed the SAVEPOINT errors that can occur in MySQL setups. Reported by @camlafit in #456
• Added a function to handle errors during migration processing.
• Resolved the duplicate update checks.
• Setup: The admin password is now removed from the session after the user is created.
• Changed the update log filenames to use random_bytes for more random names.

Verification

• Changed the hash verification to hash_equals and made it case-insensitive.
• Fixed a race condition when two requests wanted to verify the same submit token.
• The verification simulation on the submission detail page no longer shows the real hashes.

Security settings

• All IP-based security features (delay, lockout, and so on) use the IPv6 /64 subnet to count based on the IP address.

Frontend

• Switched the delay message's innerHTML to a safer method.
• Fixed the Last-Modified date in the CSS redirect.
• Added the required logic to validate the URL to prevent redirecting to a new host.

Projects

• Added a missing access-level check for creating new projects.
• Adjusted the search in the project list to search case-insensitively.
• Fixed a bug where the user saw an error instead of the empty project group after deleting a project.

Rules

• Submission rule random values: Added constraints to enforce the correct values and fixed a logic bug. The rating needs to be greater than or equal to 0.1. The status is now displayed correctly in the list.

Rule packages

• Changed the hash comparison to case-insensitive and handle missing newlines.
• Adjusted the logic to remove the aborted imports.
• Using a stream wrapper in the file path is no longer possible. The path needs to be an absolute file path.
• Rule packages based on a URL need to start with http:// or https://.
• Added additional logic to handle rule package files larger than 1 MB, which libmagic could identify as text/plain.
• Handle missing sources correctly and prevent errors.

Project import

• The default overrides were not preselected.
• Import and job files were not deleted if the import failed.

Password

• Increased the minimum password length to 8 characters. Existing shorter passwords will still work after the update.
• Password reset no longer shows the error message when sending the email.
• Fixed an error 500 during login when the password hash was automatically upgraded.

Other

• Fixed the reverse proxy header replacement, which was not correctly applied due to a typo.
• Updated all backend dependencies.
• Fixed multiple PHP 8.4 deprecations.

Details of the security issues

Description of the security issue

The most problematic security fix is the functionality to create a new project, which is not limited to users with the 'can create project' role. This means that every authenticated user can create a new project.

Additionally, we increased the minimum password length to 8 characters, adjusted the hash comparison in the verification API, hid the full hash in the verification simulation, and made other adjustments to make mosparo more secure.

Risk assessment

We recommend updating to v1.5.13 as soon as possible.

The only risk in this update is the fix for the missing access check when creating a new project. But this means that an authenticated user can create a new project without the role to create new projects. The user is unable to delete or modify any existing projects; therefore, the risk is considered low. If all your users have the access level to create new projects, there is no risk at all.

The other security-related fixes are not directly a threat to your mosparo installation.

This release is a bug-fix release that fixes an issue when adding new users in the administration.

• Fixed an error that prevented adding new users in the user administration (introduced with v1.5.10).

This version is a bug-fix release that addresses numerous issues across multiple areas of mosparo.

Commands

• Fixed the broken export command, which didn't get the new flags in v1.5. Reported by @thelfensdrfer in #455.
• Fixed the broken import command, which didn't get the new flags in v1.5. In connection with #455.
• Fixed an incorrect comparison that caused a duplicate import.
• Fixed the error handling in the mosparo:rule-package:import command.
• Fixed the error handling in the mosparo:self-update command.

Rules

• Fixed the random values submission rule type, which caused problems with array values and didn't match the textarea fields correctly.
• Added the missing validation in the field rules editor when storing the data.
• Fixed the matching in the Unicode block rule type, which was case-sensitive.
• Fixed the matching in the IP address rule type. Subnets were not correctly matched, and differently written IP addresses didn't match.

Interface

• Fixed a reflected HTML injection in the project search.
• Fixed a stored HTML injection in the rule package delete confirmation.

Frontend widget

• Fixed the handling of fields with names shorter than 3 characters.

API

• Frontend API, request-submit-token: Invalid locales are now ignored correctly and fall back to English.
• Verification API, store-metadata: Fixed incorrect data validation.
• Fixed an incorrectly set HTTP status code for a backend API request without an Authorization header.

Other

• Web cron job: The web cron job no longer stops working when a rule package generates an error.
• Rule package, JSON importer: The importer now correctly counts rule items, as with the ZIP importer.
• Fixed inverted logic in the clearCssCache method, which was doing the wrong thing regarding the shared cache.
• Added the correct escaping to handle translations in JavaScript parts of mosparo.
• Proof-of-work: Switched to random_int to get a more secure random number.
• Two-factor authentication: Use strict comparison for the backup codes.
• Updated the backend and validator translations.

Packaging

• Removed two files from the built ZIP package, reducing the package size by 17.86 MB. Reported by @uluzox in #453

After updating to v1.5.11, mosparo needs to recalculate the prepared values and hashes. Please open the web interface after updating and wait until the process is finished.

We're thankful to all contributors for reporting bugs, suggesting changes, translating strings, and, in general, for making mosparo better.

Version 1.5.10 is a bugfix release. We've fixed numerous bugs and adjusted the layers for the unprivileged Docker images.

• Removed duplicate layers from the unprivileged Docker images. Fixed by @uluzox in PR #451
• Fixed the nginx error handling in the unprivileged Alpine Docker image. Fixed by @uluzox in PR #451
• Fixed a bug in the field rule editor that set the wrong ID on newly created items.
• Fixed the incorrect case and Unicode handling in the word field rule type.
• Fixed the incorrect rule item queries for the domain, email, and website field rule types.
• Fixed the field rule cache, which did not distinguish between field types.
• Fixed the lockout start and lockout times, which were incorrectly calculated.
• Fixed an off-by-one error in the Proof-of-Work logic.
• Fixed the spam submission count when silent mode is enabled.
• Fixed a database query that counted too many requests for the delay and lockout functions.
• Fixed the incorrect handling of the return value when opening a ZIP archive.
• Fixed three small issues in the frontend JavaScript.
• Fixed the exception when nothing was selected in the rule tester.
• Fixed the regeneration of the frontend CSS file if the hash was wrong.
• Fixed a bug in the web cron job that triggered the GeoIP2 download on every cron run.
• Adjusted exception handling in the cleanup command and the web cron job, which now correctly resets the status.
• Hardened the security settings with additional constraints.
• Hardened the processing of the form data fields.
• Hardened project members and users. It's no longer possible to add a project member more than once to the same project. In addition, it is no longer possible to delete your own user account.

The update will automatically delete project members who were added to a project more than once.

After updating to v1.5.10, mosparo needs to recalculate the prepared values and hashes. Please open the web interface after updating and wait until the process is finished.

If you want to monitor the mosparo versions, for example, to get notified when we release a new version, you can use the following URLs:

• https://updates.mosparo.io/v/versions.json (for a JSON containing the latest versions for the three channels)
• https://updates.mosparo.io/v/stable.txt (for just getting the version number, also usable with develop.txt and beta.txt)

Thank you very much, @uluzox, for providing the pull request to adjust the Docker images.

Version 1.5.9 is a bug-fix release of version 1.5.8, which is a security release that was released this morning.

• Fixed the uninitialized property in the form submission validation. Reported by @winkelement in #450.

We recommend updating to v1.5.9 as soon as possible.